better-auth-cookie-consent 0.1.0

package/README.md

@@ -0,0 +1,328 @@
+# better-auth-cookie-consent
+
+GDPR-compliant cookie consent management plugin for [Better Auth](https://better-auth.com/).
+
+- Store and manage user cookie consent preferences
+- Works for both anonymous and authenticated users
+- Automatic merge of anonymous consent on sign-in / sign-up
+- Consent versioning with automatic invalidation
+- Validation schema support (e.g. Zod) to enforce consent shape
+- Generic client plugin — `cookieConsentClient<z.infer<typeof schema>>()` types your consent model end-to-end
+
+## How It Works
+
+### Anonymous User Flow
+
+```
+┌──────────────────┐     ┌─────────────────────┐     ┌──────────────────┐
+│  User visits site │────▶│ Cookie banner shown  │────▶│ User accepts/    │
+│  (no session,     │     │ (no server call if   │     │ rejects/         │
+│   no anonId)      │     │  no anonId cookie)   │     │ customizes       │
+└──────────────────┘     └─────────────────────┘     └────────┬─────────┘
+                                                              │
+                                                              ▼
+                                                    ┌──────────────────┐
+                                                    │ Client calls      │
+                                                    │ setConsent with   │
+                                                    │ typed consent     │
+                                                    │ object → server   │
+                                                    │ stores it         │
+                                                    └──────────────────┘
+```
+
+### Sign-In / Sign-Up Merge Flow
+
+```
+┌──────────────────┐     ┌─────────────────────┐     ┌──────────────────┐
+│ Anonymous user    │────▶│ User signs in or     │────▶│ Server hook reads│
+│ has given consent │     │ signs up             │     │ anonId from      │
+│ (anonId cookie    │     │                      │     │ cookie & merges  │
+│  is set)          │     │                      │     │ consent to user  │
+└──────────────────┘     └─────────────────────┘     └────────┬─────────┘
+                                                              │
+                                                              ▼
+                                                    ┌──────────────────┐
+                                                    │ Consent now tied  │
+                                                    │ to userId —       │
+                                                    │ persists across   │
+                                                    │ devices/sessions  │
+                                                    └──────────────────┘
+```
+
+### Session-Aware Banner Flow
+
+```
+┌──────────────────┐     ┌─────────────────────┐     ┌──────────────────┐
+│ Banner visible    │────▶│ User logs in         │────▶│ Client detects   │
+│ (no consent)      │     │                      │     │ session change   │
+│                   │     │                      │     │ (null → session) │
+└──────────────────┘     └─────────────────────┘     └────────┬─────────┘
+                                                              │
+                                                              ▼
+                                                    ┌──────────────────┐
+                                                    │ Fetches consent   │
+                                                    │ from server →     │
+                                                    │ hides banner,     │
+                                                    │ persists anonId   │
+                                                    │ cookie for logout │
+                                                    └──────────────────┘
+```
+
+## Installation
+
+```bash
+# npm
+npm install better-auth-cookie-consent
+
+# pnpm
+pnpm add better-auth-cookie-consent
+```
+
+## Server Setup
+
+```ts
+import { betterAuth } from 'better-auth';
+import { cookieConsentPlugin, defaultConsentSchema } from 'better-auth-cookie-consent';
+
+export const auth = betterAuth({
+  // ... your config
+  plugins: [
+    cookieConsentPlugin({
+      consentVersion: 'v1',
+      consent: { validationSchema: defaultConsentSchema },
+      onConsentChange: async ({ consent }) => {
+        console.log('Consent changed:', consent);
+      },
+    }),
+  ],
+});
+```
+
+### Plugin Options
+
+| Option                   | Type               | Default | Description                                  |
+| ------------------------ | ------------------ | ------- | -------------------------------------------- |
+| consentVersion           | `string`           | `"v1"`  | Current consent policy version               |
+| consent.validationSchema | `StandardSchemaV1` | —       | Schema to validate consent (e.g. Zod object) |
+| onConsentChange          | `function`         | —       | Callback when consent is created/updated     |
+| rateLimit                | `object`           | —       | Rate limit for set/merge endpoints           |
+| schema                   | `object`           | —       | Schema overrides for the cookieConsent table |
+
+### Validation Schema
+
+The plugin validates consent JSON against a `StandardSchemaV1` (e.g. Zod schema) on every write. A preset `defaultConsentSchema` is exported for the standard categories:
+
+```ts
+import { defaultConsentSchema } from 'better-auth-cookie-consent';
+
+// Equivalent to:
+// z.object({
+//   necessary: z.boolean(),
+//   analytics: z.boolean(),
+//   marketing: z.boolean(),
+//   functional: z.boolean(),
+// })
+```
+
+## Client Setup
+
+The client plugin accepts a generic type parameter for the consent shape. Use `z.infer<typeof schema>` to get full end-to-end typing:
+
+```ts
+import { createAuthClient } from 'better-auth/client';
+import { defaultConsentSchema } from 'better-auth-cookie-consent';
+import { cookieConsentClient } from 'better-auth-cookie-consent/client';
+import type { z } from 'zod';
+
+type ConsentModel = z.infer<typeof defaultConsentSchema>;
+// { necessary: boolean; analytics: boolean; marketing: boolean; functional: boolean }
+
+export const authClient = createAuthClient({
+  plugins: [cookieConsentClient<ConsentModel>()],
+});
+```
+
+This types `setConsent`, `getConsent`, and the nanostore atom so that your consent object is fully checked at compile time.
+
+## Usage
+
+### Set Consent
+
+```ts
+await authClient.cookieConsent.setConsent({
+  anonymousId: 'anon-123',
+  consent: {
+    necessary: true,
+    analytics: true,
+    marketing: false,
+    functional: true,
+  },
+  consentVersion: 'v1',
+});
+```
+
+### Accept All / Reject All
+
+Build the consent object on the client and call `setConsent`:
+
+```ts
+// Accept all
+await authClient.cookieConsent.setConsent({
+  anonymousId: 'anon-123',
+  consent: { necessary: true, analytics: true, marketing: true, functional: true },
+  consentVersion: 'v1',
+});
+
+// Reject all (keep necessary)
+await authClient.cookieConsent.setConsent({
+  anonymousId: 'anon-123',
+  consent: { necessary: true, analytics: false, marketing: false, functional: false },
+  consentVersion: 'v1',
+});
+```
+
+### Get Consent
+
+```ts
+const { data } = await authClient.cookieConsent.getConsent('anon-123');
+// data.consent — the consent record (or null)
+// data.versionMatch — whether stored version matches current
+```
+
+### Merge Anonymous Consent After Login
+
+```ts
+await authClient.cookieConsent.mergeConsent('anon-123');
+```
+
+> **Note:** Manual merging is typically unnecessary — the plugin automatically merges anonymous consent when a user signs in or signs up via server-side hooks.
+
+## Cookie Banner — What You Need to Handle
+
+The plugin provides the server and client APIs but **does not include a cookie banner UI**. You need to implement the banner in your application. Here's what the banner should handle:
+
+### 1. Anonymous ID Management
+
+Store a unique anonymous ID in a cookie named `cookie-consent-anon-id`. This cookie must be:
+
+- Created when the user first interacts with the banner (e.g. `crypto.randomUUID()`)
+- Sent as a standard browser cookie so the server can read it during sign-in/sign-up hooks
+- Readable via SSR (e.g. `injectRequest()` in Analog.js)
+
+```ts
+// Set the anonymous ID cookie
+document.cookie = `cookie-consent-anon-id=${id}; path=/; max-age=31536000; SameSite=Lax`;
+```
+
+### 2. Banner Visibility Logic
+
+```
+On page load:
+  IF anonId cookie exists OR user is logged in:
+    → Fetch consent from server (GET /cookie-consent/get)
+    → If consent exists and version matches → hide banner
+    → Otherwise → show banner
+  ELSE:
+    → Show banner immediately (no server call needed)
+```
+
+### 3. Session Change Detection
+
+Subscribe to the auth client's session state. When the session transitions from `null` → logged-in:
+
+1. Fetch consent from the server
+2. If consent exists, hide the banner and persist the `anonymousId` cookie
+3. This ensures the banner disappears immediately on login without a page reload
+4. The persisted `anonymousId` ensures consent is still found after logout + page reload
+
+### 4. Accept / Reject / Customize
+
+All actions use the `setConsent` endpoint — the client builds the consent object:
+
+- **Accept All**: Build `{ necessary: true, analytics: true, ... }` and call `setConsent`
+- **Reject All**: Build `{ necessary: true, analytics: false, ... }` and call `setConsent`
+- **Custom**: Use form values and call `setConsent`
+
+The consent object is validated against the server's `validationSchema` on every write.
+
+### 5. Typing Categories
+
+Use `keyof` on the inferred consent model to type your banner categories:
+
+```ts
+import type { z } from 'zod';
+import { defaultConsentSchema } from 'better-auth-cookie-consent';
+
+type ConsentModel = z.infer<typeof defaultConsentSchema>;
+type CategoryId = keyof ConsentModel;
+
+const CATEGORIES: { id: CategoryId; label: string }[] = [
+  { id: 'necessary', label: 'Necessary' },
+  { id: 'analytics', label: 'Analytics' },
+  // TypeScript enforces that id must be a valid consent category
+];
+```
+
+### 6. Re-open Banner
+
+After consent is recorded, provide a way for users to manage their preferences (e.g. a "Manage Cookies" link in the footer).
+
+## Server-Side Helpers
+
+```ts
+import { getConsentFromCtx, hasConsent } from 'better-auth-cookie-consent';
+
+// Inside an endpoint handler:
+const record = await getConsentFromCtx(ctx);
+
+if (await hasConsent(ctx, 'analytics')) {
+  // tracking is allowed
+}
+```
+
+## API Endpoints
+
+| Method | Path                    | Description                     |
+| ------ | ----------------------- | ------------------------------- |
+| POST   | `/cookie-consent/set`   | Create or update consent        |
+| GET    | `/cookie-consent/get`   | Retrieve consent                |
+| POST   | `/cookie-consent/merge` | Merge anonymous consent to user |
+
+## Auto-Merge on Sign-In / Sign-Up
+
+The plugin registers a server-side `after` hook that runs on every `sign-in/*` and `sign-up/*` path. When the `cookie-consent-anon-id` cookie is present in the request, the hook automatically merges the anonymous consent record to the newly authenticated user. This covers all auth methods (email, social, biometrics, passkey, etc.).
+
+## Consent Versioning
+
+When the `consentVersion` option changes, the `getConsent` endpoint returns `versionMatch: false` so the client knows to prompt for re-consent.
+
+## Database Schema
+
+The plugin creates a `cookieConsent` table:
+
+| Column         | Type    | Description                      |
+| -------------- | ------- | -------------------------------- |
+| id             | string  | Primary key                      |
+| userId         | string? | References user table            |
+| anonymousId    | string  | Anonymous client identifier      |
+| consent        | string  | JSON-encoded consent preferences |
+| consentVersion | string  | Consent policy version           |
+| timestamp      | date    | When consent was recorded        |
+
+### Prisma Schema
+
+```prisma
+model CookieConsent {
+  id             String   @id @default(cuid())
+  userId         String?
+  anonymousId    String
+  consent        String
+  consentVersion String
+  timestamp      DateTime @default(now())
+  user           User?    @relation(fields: [userId], references: [id])
+}
+```
+
+## License
+
+MIT

package/dist/client.d.mts

@@ -0,0 +1,114 @@
+import { n as cookieConsentPlugin, o as Consent } from "./index-SuR6zFkq.mjs";
+import * as better_auth0 from "better-auth";
+import * as nanostores from "nanostores";
+import * as better_auth_client0 from "better-auth/client";
+
+//#region src/client.d.ts
+/**
+ * Client-side consent state, kept in sync with the server.
+ */
+interface ConsentState<TConsent extends Consent = Consent> {
+  consent: TConsent | null;
+  consentVersion: string | null;
+  versionMatch: boolean;
+}
+/**
+ * Client plugin for cookie consent management.
+ *
+ * @typeParam TConsent - The consent shape, typically `z.infer<typeof yourConsentSchema>`.
+ *
+ * @example
+ * ```ts
+ * import { defaultConsentSchema } from 'better-auth-cookie-consent';
+ * import { cookieConsentClient } from 'better-auth-cookie-consent/client';
+ * import type { z } from 'zod';
+ *
+ * const authClient = createAuthClient({
+ *   plugins: [cookieConsentClient<z.infer<typeof defaultConsentSchema>>()],
+ * });
+ * ```
+ */
+declare const cookieConsentClient: <TConsent extends Consent = Consent>() => {
+  id: "cookie-consent";
+  $InferServerPlugin: ReturnType<typeof cookieConsentPlugin>;
+  getAtoms($fetch: better_auth_client0.BetterFetch): {
+    $consent: nanostores.PreinitializedWritableAtom<ConsentState<TConsent>> & object;
+  };
+  getActions($fetch: better_auth_client0.BetterFetch, $store: better_auth0.ClientStore): {
+    cookieConsent: {
+      /**
+       * Set consent preferences on the server.
+       * Also used for accept-all / reject-all by passing the
+       * appropriate consent object (all `true` or all `false`).
+       */
+      setConsent: (data: {
+        anonymousId: string;
+        consent: TConsent;
+        consentVersion: string;
+      }) => Promise<{
+        data: {
+          status: boolean;
+        };
+        error: null;
+      } | {
+        data: null;
+        error: {
+          message?: string | undefined;
+          status: number;
+          statusText: string;
+        };
+      }>;
+      /**
+       * Retrieve consent from the server.
+       */
+      getConsent: (anonymousId?: string) => Promise<{
+        data: null;
+        error: {
+          message?: string | undefined;
+          status: number;
+          statusText: string;
+        };
+      } | {
+        data: {
+          consent: {
+            id: string;
+            userId?: string | null;
+            anonymousId: string;
+            consent: TConsent;
+            consentVersion: string;
+            timestamp: string;
+          } | null;
+          versionMatch: boolean;
+        };
+        error: null;
+      }>;
+      /**
+       * Merge anonymous consent into the authenticated user's record.
+       */
+      mergeConsent: (anonymousId: string) => Promise<{
+        data: null;
+        error: {
+          message?: string | undefined;
+          status: number;
+          statusText: string;
+        };
+      } | {
+        data: {
+          status: boolean;
+          merged: boolean;
+        };
+        error: null;
+      }>;
+    };
+  };
+  $ERROR_CODES: {
+    MISSING_ANONYMOUS_ID: better_auth0.RawError<"MISSING_ANONYMOUS_ID">;
+    CONSENT_NOT_FOUND: better_auth0.RawError<"CONSENT_NOT_FOUND">;
+    INVALID_CONSENT: better_auth0.RawError<"INVALID_CONSENT">;
+    VERSION_MISMATCH: better_auth0.RawError<"VERSION_MISMATCH">;
+    AUTHENTICATION_REQUIRED: better_auth0.RawError<"AUTHENTICATION_REQUIRED">;
+  };
+};
+//#endregion
+export { ConsentState, cookieConsentClient };
+//# sourceMappingURL=client.d.mts.map

package/dist/client.mjs

@@ -0,0 +1,79 @@
+import { t as COOKIE_CONSENT_ERROR_CODES } from "./error-codes-D3VdAX9J.mjs";
+import { atom } from "nanostores";
+//#region src/client.ts
+/**
+* Client plugin for cookie consent management.
+*
+* @typeParam TConsent - The consent shape, typically `z.infer<typeof yourConsentSchema>`.
+*
+* @example
+* ```ts
+* import { defaultConsentSchema } from 'better-auth-cookie-consent';
+* import { cookieConsentClient } from 'better-auth-cookie-consent/client';
+* import type { z } from 'zod';
+*
+* const authClient = createAuthClient({
+*   plugins: [cookieConsentClient<z.infer<typeof defaultConsentSchema>>()],
+* });
+* ```
+*/
+const cookieConsentClient = () => {
+	return {
+		id: "cookie-consent",
+		$InferServerPlugin: {},
+		getAtoms($fetch) {
+			return { $consent: atom({
+				consent: null,
+				consentVersion: null,
+				versionMatch: false
+			}) };
+		},
+		getActions($fetch, $store) {
+			const consentAtom = $store.atoms.$consent;
+			async function syncFromServer(anonymousId) {
+				let path = "/cookie-consent/get";
+				if (anonymousId) {
+					const params = new URLSearchParams({ anonymousId });
+					path = `${path}?${params.toString()}`;
+				}
+				const res = await $fetch(`${path}`, { method: "GET" });
+				if (res.data) consentAtom.set({
+					consent: res.data.consent?.consent ?? null,
+					consentVersion: res.data.consent?.consentVersion ?? null,
+					versionMatch: res.data.versionMatch
+				});
+				return res;
+			}
+			return { cookieConsent: {
+				setConsent: async (data) => {
+					const res = await $fetch("/cookie-consent/set", {
+						method: "POST",
+						body: data
+					});
+					if (res.data?.status) consentAtom.set({
+						consent: data.consent,
+						consentVersion: data.consentVersion,
+						versionMatch: true
+					});
+					return res;
+				},
+				getConsent: async (anonymousId) => {
+					return syncFromServer(anonymousId);
+				},
+				mergeConsent: async (anonymousId) => {
+					const res = await $fetch("/cookie-consent/merge", {
+						method: "POST",
+						body: { anonymousId }
+					});
+					if (res.data?.merged) await syncFromServer(anonymousId);
+					return res;
+				}
+			} };
+		},
+		$ERROR_CODES: COOKIE_CONSENT_ERROR_CODES
+	};
+};
+//#endregion
+export { cookieConsentClient };
+
+//# sourceMappingURL=client.mjs.map

package/dist/client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import type { BetterAuthClientPlugin } from 'better-auth/client';\nimport { atom } from 'nanostores';\n\nimport { COOKIE_CONSENT_ERROR_CODES } from './error-codes';\nimport type { Consent, cookieConsentPlugin } from './index';\n\n/**\n * Client-side consent state, kept in sync with the server.\n */\nexport interface ConsentState<TConsent extends Consent = Consent> {\n  consent: TConsent | null;\n  consentVersion: string | null;\n  versionMatch: boolean;\n}\n\n/**\n * Client plugin for cookie consent management.\n *\n * @typeParam TConsent - The consent shape, typically `z.infer<typeof yourConsentSchema>`.\n *\n * @example\n * ```ts\n * import { defaultConsentSchema } from 'better-auth-cookie-consent';\n * import { cookieConsentClient } from 'better-auth-cookie-consent/client';\n * import type { z } from 'zod';\n *\n * const authClient = createAuthClient({\n *   plugins: [cookieConsentClient<z.infer<typeof defaultConsentSchema>>()],\n * });\n * ```\n */\nexport const cookieConsentClient = <TConsent extends Consent = Consent>() => {\n  return {\n    id: 'cookie-consent',\n    $InferServerPlugin: {} as ReturnType<typeof cookieConsentPlugin>,\n\n    getAtoms($fetch) {\n      const $consent = atom<ConsentState<TConsent>>({\n        consent: null,\n        consentVersion: null,\n        versionMatch: false,\n      });\n      return { $consent };\n    },\n\n    getActions($fetch, $store) {\n      const consentAtom = $store.atoms.$consent as ReturnType<typeof atom<ConsentState<TConsent>>>;\n\n      async function syncFromServer(anonymousId?: string) {\n        let path = '/cookie-consent/get';\n        if (anonymousId) {\n          const params = new URLSearchParams({ anonymousId });\n          path = `${path}?${params.toString()}`;\n        }\n        const res = await $fetch<{\n          consent: {\n            id: string;\n            userId?: string | null;\n            anonymousId: string;\n            consent: TConsent;\n            consentVersion: string;\n            timestamp: string;\n          } | null;\n          versionMatch: boolean;\n        }>(`${path}`, { method: 'GET' });\n        if (res.data) {\n          consentAtom.set({\n            consent: res.data.consent?.consent ?? null,\n            consentVersion: res.data.consent?.consentVersion ?? null,\n            versionMatch: res.data.versionMatch,\n          });\n        }\n        return res;\n      }\n\n      return {\n        cookieConsent: {\n          /**\n           * Set consent preferences on the server.\n           * Also used for accept-all / reject-all by passing the\n           * appropriate consent object (all `true` or all `false`).\n           */\n          setConsent: async (data: {\n            anonymousId: string;\n            consent: TConsent;\n            consentVersion: string;\n          }) => {\n            const res = await $fetch<{ status: boolean }>('/cookie-consent/set', {\n              method: 'POST',\n              body: data,\n            });\n            if (res.data?.status) {\n              consentAtom.set({\n                consent: data.consent,\n                consentVersion: data.consentVersion,\n                versionMatch: true,\n              });\n            }\n            return res;\n          },\n\n          /**\n           * Retrieve consent from the server.\n           */\n          getConsent: async (anonymousId?: string) => {\n            return syncFromServer(anonymousId);\n          },\n\n          /**\n           * Merge anonymous consent into the authenticated user's record.\n           */\n          mergeConsent: async (anonymousId: string) => {\n            const res = await $fetch<{ status: boolean; merged: boolean }>(\n              '/cookie-consent/merge',\n              {\n                method: 'POST',\n                body: { anonymousId },\n              },\n            );\n            if (res.data?.merged) {\n              await syncFromServer(anonymousId);\n            }\n            return res;\n          },\n        },\n      };\n    },\n\n    $ERROR_CODES: COOKIE_CONSENT_ERROR_CODES,\n  } satisfies BetterAuthClientPlugin;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+BA,MAAa,4BAAgE;AAC3E,QAAO;EACL,IAAI;EACJ,oBAAoB,EAAE;EAEtB,SAAS,QAAQ;AAMf,UAAO,EAAE,UALQ,KAA6B;IAC5C,SAAS;IACT,gBAAgB;IAChB,cAAc;IACf,CAAC,EACiB;;EAGrB,WAAW,QAAQ,QAAQ;GACzB,MAAM,cAAc,OAAO,MAAM;GAEjC,eAAe,eAAe,aAAsB;IAClD,IAAI,OAAO;AACX,QAAI,aAAa;KACf,MAAM,SAAS,IAAI,gBAAgB,EAAE,aAAa,CAAC;AACnD,YAAO,GAAG,KAAK,GAAG,OAAO,UAAU;;IAErC,MAAM,MAAM,MAAM,OAUf,GAAG,QAAQ,EAAE,QAAQ,OAAO,CAAC;AAChC,QAAI,IAAI,KACN,aAAY,IAAI;KACd,SAAS,IAAI,KAAK,SAAS,WAAW;KACtC,gBAAgB,IAAI,KAAK,SAAS,kBAAkB;KACpD,cAAc,IAAI,KAAK;KACxB,CAAC;AAEJ,WAAO;;AAGT,UAAO,EACL,eAAe;IAMb,YAAY,OAAO,SAIb;KACJ,MAAM,MAAM,MAAM,OAA4B,uBAAuB;MACnE,QAAQ;MACR,MAAM;MACP,CAAC;AACF,SAAI,IAAI,MAAM,OACZ,aAAY,IAAI;MACd,SAAS,KAAK;MACd,gBAAgB,KAAK;MACrB,cAAc;MACf,CAAC;AAEJ,YAAO;;IAMT,YAAY,OAAO,gBAAyB;AAC1C,YAAO,eAAe,YAAY;;IAMpC,cAAc,OAAO,gBAAwB;KAC3C,MAAM,MAAM,MAAM,OAChB,yBACA;MACE,QAAQ;MACR,MAAM,EAAE,aAAa;MACtB,CACF;AACD,SAAI,IAAI,MAAM,OACZ,OAAM,eAAe,YAAY;AAEnC,YAAO;;IAEV,EACF;;EAGH,cAAc;EACf"}

package/dist/error-codes-D3VdAX9J.mjs

@@ -0,0 +1,13 @@
+import { defineErrorCodes } from "better-auth";
+//#region src/error-codes.ts
+const COOKIE_CONSENT_ERROR_CODES = defineErrorCodes({
+	MISSING_ANONYMOUS_ID: "Anonymous ID is required",
+	CONSENT_NOT_FOUND: "Cookie consent record not found",
+	INVALID_CONSENT: "Consent must be a non-empty object with boolean values",
+	VERSION_MISMATCH: "Consent version is outdated and must be renewed",
+	AUTHENTICATION_REQUIRED: "Authentication is required for this operation"
+});
+//#endregion
+export { COOKIE_CONSENT_ERROR_CODES as t };
+
+//# sourceMappingURL=error-codes-D3VdAX9J.mjs.map

package/dist/error-codes-D3VdAX9J.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-codes-D3VdAX9J.mjs","names":[],"sources":["../src/error-codes.ts"],"sourcesContent":["import { defineErrorCodes } from 'better-auth';\n\nexport const COOKIE_CONSENT_ERROR_CODES = defineErrorCodes({\n  MISSING_ANONYMOUS_ID: 'Anonymous ID is required',\n  CONSENT_NOT_FOUND: 'Cookie consent record not found',\n  INVALID_CONSENT: 'Consent must be a non-empty object with boolean values',\n  VERSION_MISMATCH: 'Consent version is outdated and must be renewed',\n  AUTHENTICATION_REQUIRED: 'Authentication is required for this operation',\n});\n"],"mappings":";;AAEA,MAAa,6BAA6B,iBAAiB;CACzD,sBAAsB;CACtB,mBAAmB;CACnB,iBAAiB;CACjB,kBAAkB;CAClB,yBAAyB;CAC1B,CAAC"}

package/dist/index-SuR6zFkq.d.mts

@@ -0,0 +1,270 @@
+import * as z from "zod";
+import * as better_auth0 from "better-auth";
+import { BetterAuthOptions, DBAdapter, InferOptionSchema, StandardSchemaV1 } from "better-auth";
+
+//#region src/schema.d.ts
+declare const cookieConsent: {
+  cookieConsent: {
+    fields: {
+      userId: {
+        type: "string";
+        required: false;
+        references: {
+          model: string;
+          field: string;
+        };
+      };
+      anonymousId: {
+        type: "string";
+        required: true;
+      };
+      consent: {
+        type: "string";
+        required: true;
+      };
+      consentVersion: {
+        type: "string";
+        required: true;
+      };
+      timestamp: {
+        type: "date";
+        defaultValue: () => Date;
+        required: true;
+      };
+    };
+  };
+};
+//#endregion
+//#region src/type.d.ts
+/**
+ * Consent categories mapped to boolean values.
+ * Each key represents a cookie category (e.g., "analytics", "marketing").
+ */
+type ConsentSchemaModel = z.ZodObject<Record<string, z.ZodBoolean>>;
+type Consent = z.infer<ConsentSchemaModel>;
+/**
+ * Options for the cookie consent plugin.
+ */
+interface CookieConsentOptions {
+  /**
+   * Current consent version identifier.
+   * When this changes, stored consents with older versions
+   * are considered outdated and users must re-consent.
+   * @default "v1"
+   */
+  consentVersion?: string;
+  /**
+   * Callback invoked whenever consent changes.
+   * @param data the consent record and request
+   */
+  onConsentChange?: (data: {
+    consent: CookieConsentRecord;
+  }, request?: Request) => Promise<void>;
+  /**
+   * Rate limit configuration for consent endpoints.
+   */
+  rateLimit?: {
+    /**
+     * Time window in seconds for which the rate limit applies.
+     * @default 10
+     */
+    window: number;
+    /**
+     * Maximum number of requests allowed within the time window.
+     * @default 10 requests
+     */
+    max: number;
+  };
+  /**
+   * Schema overrides for the cookie consent table.
+   */
+  schema?: InferOptionSchema<typeof cookieConsent> | undefined;
+  /**
+   * Consent validation configuration.
+   */
+  consent?: {
+    /**
+     * A Standard Schema (e.g. Zod) used to validate the consent
+     * object on every `setConsent` call. When omitted, the
+     * consent object is accepted as-is (any `Consent`).
+     */
+    validationSchema?: StandardSchemaV1 & ConsentSchemaModel;
+  };
+}
+/**
+ * A stored cookie consent record.
+ */
+interface CookieConsentRecord {
+  /**
+   * Database identifier.
+   */
+  id: string;
+  /**
+   * The authenticated user ID, if available.
+   */
+  userId?: string | null;
+  /**
+   * An anonymous identifier for unauthenticated users.
+   */
+  anonymousId: string;
+  /**
+   * JSON-encoded consent preferences.
+   */
+  consent: string;
+  /**
+   * The version of the consent policy.
+   */
+  consentVersion: string;
+  /**
+   * Timestamp when the consent was recorded.
+   */
+  timestamp: Date;
+}
+/**
+ * Payload for creating/updating a consent record (without auto-generated fields).
+ */
+type CookieConsentPayload = Omit<CookieConsentRecord, 'id'>;
+//#endregion
+//#region src/index.d.ts
+/**
+ * Cookie name used to store the anonymous consent ID.
+ * The client sets this cookie so the server-side hook can
+ * read it during sign-in to auto-merge anonymous consent.
+ */
+declare const ANONYMOUS_ID_COOKIE = "cookie-consent-anon-id";
+/**
+ * Preset validation schema for cookie consent.
+ * Validates the standard consent categories: necessary, analytics, marketing, functional.
+ * Use this with `consent.validationSchema` in the plugin options.
+ *
+ * @example
+ * ```ts
+ * cookieConsentPlugin({
+ *   consentVersion: 'v1',
+ *   consent: { validationSchema: defaultConsentSchema },
+ * })
+ * ```
+ */
+declare const defaultConsentSchema: z.ZodObject<{
+  necessary: z.ZodBoolean;
+  analytics: z.ZodBoolean;
+  marketing: z.ZodBoolean;
+  functional: z.ZodBoolean;
+}, z.core.$strip>;
+declare const cookieConsentPlugin: <O extends CookieConsentOptions>(options?: O) => {
+  id: "cookie-consent";
+  schema: {
+    cookieConsent: {
+      fields: {
+        userId: {
+          type: "string";
+          required: false;
+          references: {
+            model: string;
+            field: string;
+          };
+        };
+        anonymousId: {
+          type: "string";
+          required: true;
+        };
+        consent: {
+          type: "string";
+          required: true;
+        };
+        consentVersion: {
+          type: "string";
+          required: true;
+        };
+        timestamp: {
+          type: "date";
+          defaultValue: () => Date;
+          required: true;
+        };
+      };
+    };
+  };
+  endpoints: {
+    setConsent: better_auth0.StrictEndpoint<"/cookie-consent/set", {
+      method: "POST";
+      body: z.ZodObject<{
+        anonymousId: z.ZodString;
+        consent: z.ZodRecord<z.ZodString, z.ZodBoolean>;
+        consentVersion: z.ZodString;
+      }, z.core.$strip>;
+    }, {
+      status: boolean;
+    }>;
+    getConsent: better_auth0.StrictEndpoint<"/cookie-consent/get", {
+      method: "GET";
+      query: z.ZodObject<{
+        anonymousId: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+    }, {
+      consent: null;
+      versionMatch: boolean;
+    } | {
+      consent: {
+        id: string;
+        userId: string | null | undefined;
+        anonymousId: string;
+        consent: Consent;
+        consentVersion: string;
+        timestamp: Date;
+      };
+      versionMatch: boolean;
+    }>;
+    mergeConsent: better_auth0.StrictEndpoint<"/cookie-consent/merge", {
+      method: "POST";
+      body: z.ZodObject<{
+        anonymousId: z.ZodString;
+      }, z.core.$strip>;
+    }, {
+      status: boolean;
+      merged: boolean;
+    }>;
+  };
+  hooks: {
+    after: {
+      matcher: (context: better_auth0.HookEndpointContext) => boolean;
+      handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
+    }[];
+  };
+  options: NoInfer<O>;
+  rateLimit: {
+    pathMatcher: (path: string) => boolean;
+    window: number;
+    max: number;
+  }[];
+  $ERROR_CODES: {
+    MISSING_ANONYMOUS_ID: better_auth0.RawError<"MISSING_ANONYMOUS_ID">;
+    CONSENT_NOT_FOUND: better_auth0.RawError<"CONSENT_NOT_FOUND">;
+    INVALID_CONSENT: better_auth0.RawError<"INVALID_CONSENT">;
+    VERSION_MISMATCH: better_auth0.RawError<"VERSION_MISMATCH">;
+    AUTHENTICATION_REQUIRED: better_auth0.RawError<"AUTHENTICATION_REQUIRED">;
+  };
+};
+/**
+ * Extract the parsed consent object from the endpoint context.
+ * Returns `null` if no consent is available.
+ */
+declare function getConsentFromCtx(ctx: {
+  context: {
+    adapter: DBAdapter<BetterAuthOptions>;
+    session?: {
+      user?: {
+        id?: string;
+      };
+    } | null;
+  };
+  query?: {
+    anonymousId?: string;
+  };
+}): Promise<CookieConsentRecord | null>;
+/**
+ * Check if a specific consent category is granted.
+ */
+declare function hasConsent(ctx: Parameters<typeof getConsentFromCtx>[0], category: string): Promise<boolean>;
+//#endregion
+export { hasConsent as a, CookieConsentOptions as c, getConsentFromCtx as i, CookieConsentPayload as l, cookieConsentPlugin as n, Consent as o, defaultConsentSchema as r, ConsentSchemaModel as s, ANONYMOUS_ID_COOKIE as t, CookieConsentRecord as u };
+//# sourceMappingURL=index-SuR6zFkq.d.mts.map

package/dist/index.d.mts

@@ -0,0 +1,2 @@
+import { a as hasConsent, c as CookieConsentOptions, i as getConsentFromCtx, l as CookieConsentPayload, n as cookieConsentPlugin, o as Consent, r as defaultConsentSchema, s as ConsentSchemaModel, t as ANONYMOUS_ID_COOKIE, u as CookieConsentRecord } from "./index-SuR6zFkq.mjs";
+export { ANONYMOUS_ID_COOKIE, Consent, ConsentSchemaModel, CookieConsentOptions, CookieConsentPayload, CookieConsentRecord, cookieConsentPlugin, defaultConsentSchema, getConsentFromCtx, hasConsent };

package/dist/index.mjs

@@ -0,0 +1,333 @@
+import { t as COOKIE_CONSENT_ERROR_CODES } from "./error-codes-D3VdAX9J.mjs";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+import * as z from "zod";
+import { BASE_ERROR_CODES } from "better-auth";
+import { mergeSchema } from "better-auth/db";
+//#region src/routes.ts
+const setConsentSchema = z.object({
+	anonymousId: z.string().meta({ description: "Anonymous identifier for unauthenticated users" }),
+	consent: z.record(z.string(), z.boolean()).meta({ description: "Consent preferences as category-boolean pairs" }),
+	consentVersion: z.string().meta({ description: "Version of the consent policy" })
+});
+const getConsentSchema = z.object({ anonymousId: z.string().optional().meta({ description: "Anonymous identifier fallback when no session exists" }) });
+const mergeConsentSchema = z.object({ anonymousId: z.string().meta({ description: "Anonymous identifier to merge consent from" }) });
+const setConsent = (options) => createAuthEndpoint("/cookie-consent/set", {
+	method: "POST",
+	body: setConsentSchema
+}, async (ctx) => {
+	const { anonymousId, consent, consentVersion } = ctx.body;
+	if (!anonymousId) throw APIError.from("BAD_REQUEST", COOKIE_CONSENT_ERROR_CODES.MISSING_ANONYMOUS_ID);
+	if (!consent || Object.keys(consent).length === 0) throw APIError.from("BAD_REQUEST", COOKIE_CONSENT_ERROR_CODES.INVALID_CONSENT);
+	const validatedConsent = validateConsent(options, consent, ctx.context.logger);
+	const userId = (await getSessionFromCtx(ctx))?.user?.id ?? null;
+	const existing = await findConsentRecord(ctx, userId, anonymousId);
+	const consentJson = JSON.stringify(validatedConsent);
+	const now = /* @__PURE__ */ new Date();
+	if (existing) await ctx.context.adapter.update({
+		model: "cookieConsent",
+		where: [{
+			field: "id",
+			value: existing.id
+		}],
+		update: {
+			userId,
+			consent: consentJson,
+			consentVersion,
+			timestamp: now
+		}
+	});
+	else await ctx.context.adapter.create({
+		model: "cookieConsent",
+		data: {
+			userId,
+			anonymousId,
+			consent: consentJson,
+			consentVersion,
+			timestamp: now
+		}
+	});
+	if (options.onConsentChange) {
+		const record = await findConsentRecord(ctx, userId, anonymousId) ?? {
+			id: "",
+			userId,
+			anonymousId,
+			consent: consentJson,
+			consentVersion,
+			timestamp: now
+		};
+		await ctx.context.runInBackgroundOrAwait(options.onConsentChange({ consent: record }, ctx.request));
+	}
+	return ctx.json({ status: true });
+});
+const getConsent = (options) => createAuthEndpoint("/cookie-consent/get", {
+	method: "GET",
+	query: getConsentSchema
+}, async (ctx) => {
+	const userId = (await getSessionFromCtx(ctx))?.user?.id ?? null;
+	const anonymousId = ctx.query?.anonymousId;
+	if (!userId && !anonymousId) throw APIError.from("BAD_REQUEST", COOKIE_CONSENT_ERROR_CODES.MISSING_ANONYMOUS_ID);
+	const record = await findConsentRecord(ctx, userId, anonymousId);
+	if (!record) return ctx.json({
+		consent: null,
+		versionMatch: false
+	});
+	const currentVersion = options.consentVersion ?? "v1";
+	const versionMatch = record.consentVersion === currentVersion;
+	return ctx.json({
+		consent: {
+			id: record.id,
+			userId: record.userId,
+			anonymousId: record.anonymousId,
+			consent: JSON.parse(record.consent),
+			consentVersion: record.consentVersion,
+			timestamp: record.timestamp
+		},
+		versionMatch
+	});
+});
+const mergeConsent = (_options) => createAuthEndpoint("/cookie-consent/merge", {
+	method: "POST",
+	body: mergeConsentSchema
+}, async (ctx) => {
+	const userId = (await getSessionFromCtx(ctx))?.user?.id;
+	if (!userId) throw APIError.from("UNAUTHORIZED", COOKIE_CONSENT_ERROR_CODES.AUTHENTICATION_REQUIRED);
+	const merged = await mergeAnonymousConsentToUser(ctx.context.adapter, userId, ctx.body.anonymousId);
+	return ctx.json({
+		status: true,
+		merged
+	});
+});
+/**
+* Merge anonymous consent into a user's record.
+* Shared between the merge endpoint and the sign-in/sign-up hook.
+*
+* @returns `true` if consent was merged, `false` if no anonymous record was found.
+*/
+async function mergeAnonymousConsentToUser(adapter, userId, anonymousId) {
+	const anonymousRecord = await adapter.findOne({
+		model: "cookieConsent",
+		where: [{
+			field: "anonymousId",
+			value: anonymousId
+		}]
+	});
+	if (!anonymousRecord || anonymousRecord.userId) return false;
+	const userRecord = await adapter.findOne({
+		model: "cookieConsent",
+		where: [{
+			field: "userId",
+			value: userId
+		}]
+	});
+	if (userRecord) {
+		await adapter.update({
+			model: "cookieConsent",
+			where: [{
+				field: "id",
+				value: userRecord.id
+			}],
+			update: {
+				consent: anonymousRecord.consent,
+				consentVersion: anonymousRecord.consentVersion,
+				anonymousId,
+				timestamp: /* @__PURE__ */ new Date()
+			}
+		});
+		await adapter.delete({
+			model: "cookieConsent",
+			where: [{
+				field: "id",
+				value: anonymousRecord.id
+			}]
+		});
+	} else await adapter.update({
+		model: "cookieConsent",
+		where: [{
+			field: "id",
+			value: anonymousRecord.id
+		}],
+		update: { userId }
+	});
+	return true;
+}
+/**
+* Find a consent record by userId (preferred) or anonymousId fallback.
+*/
+async function findConsentRecord(ctx, userId, anonymousId) {
+	if (userId) {
+		const byUser = await ctx.context.adapter.findOne({
+			model: "cookieConsent",
+			where: [{
+				field: "userId",
+				value: userId
+			}]
+		});
+		if (byUser) return byUser;
+	}
+	if (anonymousId) return ctx.context.adapter.findOne({
+		model: "cookieConsent",
+		where: [{
+			field: "anonymousId",
+			value: anonymousId
+		}]
+	});
+	return null;
+}
+/**
+* Validate the consent object against the configured validation schema.
+* Returns the validated consent or the original consent when no schema is set.
+*/
+function validateConsent(options, consent, logger) {
+	if (!options.consent?.validationSchema) return consent;
+	const validationResult = options.consent.validationSchema["~standard"].validate(consent);
+	if (validationResult instanceof Promise) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.ASYNC_VALIDATION_NOT_SUPPORTED);
+	if (validationResult.issues) {
+		logger.error("Invalid consent", validationResult.issues);
+		throw APIError.from("BAD_REQUEST", COOKIE_CONSENT_ERROR_CODES.INVALID_CONSENT);
+	}
+	return validationResult.value;
+}
+//#endregion
+//#region src/schema.ts
+const cookieConsent = { cookieConsent: { fields: {
+	userId: {
+		type: "string",
+		required: false,
+		references: {
+			model: "user",
+			field: "id"
+		}
+	},
+	anonymousId: {
+		type: "string",
+		required: true
+	},
+	consent: {
+		type: "string",
+		required: true
+	},
+	consentVersion: {
+		type: "string",
+		required: true
+	},
+	timestamp: {
+		type: "date",
+		defaultValue: () => /* @__PURE__ */ new Date(),
+		required: true
+	}
+} } };
+const getSchema = (options) => {
+	return mergeSchema(cookieConsent, options.schema);
+};
+//#endregion
+//#region src/index.ts
+/**
+* Cookie name used to store the anonymous consent ID.
+* The client sets this cookie so the server-side hook can
+* read it during sign-in to auto-merge anonymous consent.
+*/
+const ANONYMOUS_ID_COOKIE = "cookie-consent-anon-id";
+/**
+* Parse a single cookie value from a raw `Cookie` header string.
+*/
+function parseCookieValue(cookieHeader, name) {
+	if (!cookieHeader) return void 0;
+	for (const pair of cookieHeader.split("; ")) {
+		const [key, ...valueParts] = pair.split("=");
+		if (key === name && valueParts.length > 0) {
+			const raw = valueParts.join("=");
+			try {
+				return decodeURIComponent(raw);
+			} catch {
+				return raw;
+			}
+		}
+	}
+}
+/**
+* Preset validation schema for cookie consent.
+* Validates the standard consent categories: necessary, analytics, marketing, functional.
+* Use this with `consent.validationSchema` in the plugin options.
+*
+* @example
+* ```ts
+* cookieConsentPlugin({
+*   consentVersion: 'v1',
+*   consent: { validationSchema: defaultConsentSchema },
+* })
+* ```
+*/
+const defaultConsentSchema = z.object({
+	necessary: z.boolean(),
+	analytics: z.boolean(),
+	marketing: z.boolean(),
+	functional: z.boolean()
+});
+const cookieConsentPlugin = (options = {}) => {
+	return {
+		id: "cookie-consent",
+		schema: getSchema(options),
+		endpoints: {
+			setConsent: setConsent(options),
+			getConsent: getConsent(options),
+			mergeConsent: mergeConsent(options)
+		},
+		hooks: { after: [{
+			matcher: (context) => {
+				return !!context.path && (context.path.startsWith("/sign-in/") || context.path.startsWith("/sign-up/"));
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				const userId = ctx.context.newSession?.user?.id;
+				if (!userId) return;
+				const anonymousId = parseCookieValue(ctx.headers?.get("cookie"), ANONYMOUS_ID_COOKIE);
+				if (!anonymousId) return;
+				await mergeAnonymousConsentToUser(ctx.context.adapter, userId, anonymousId);
+			})
+		}] },
+		options,
+		rateLimit: [{
+			pathMatcher: (path) => ["/cookie-consent/set", "/cookie-consent/merge"].includes(path),
+			window: options.rateLimit?.window ?? 10,
+			max: options.rateLimit?.max ?? 10
+		}],
+		$ERROR_CODES: COOKIE_CONSENT_ERROR_CODES
+	};
+};
+/**
+* Extract the parsed consent object from the endpoint context.
+* Returns `null` if no consent is available.
+*/
+async function getConsentFromCtx(ctx) {
+	const userId = ctx.context.session?.user?.id ?? null;
+	const anonymousId = ctx.query?.anonymousId;
+	if (userId) {
+		const byUser = await ctx.context.adapter.findOne({
+			model: "cookieConsent",
+			where: [{
+				field: "userId",
+				value: userId
+			}]
+		});
+		if (byUser) return byUser;
+	}
+	if (anonymousId) return ctx.context.adapter.findOne({
+		model: "cookieConsent",
+		where: [{
+			field: "anonymousId",
+			value: anonymousId
+		}]
+	});
+	return null;
+}
+/**
+* Check if a specific consent category is granted.
+*/
+async function hasConsent(ctx, category) {
+	const record = await getConsentFromCtx(ctx);
+	if (!record) return false;
+	return JSON.parse(record.consent)[category] === true;
+}
+//#endregion
+export { ANONYMOUS_ID_COOKIE, cookieConsentPlugin, defaultConsentSchema, getConsentFromCtx, hasConsent };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/routes.ts","../src/schema.ts","../src/index.ts"],"sourcesContent":["import {\n  BASE_ERROR_CODES,\n  type BetterAuthOptions,\n  type DBAdapter,\n  type InternalLogger,\n} from 'better-auth';\nimport { APIError, createAuthEndpoint, getSessionFromCtx } from 'better-auth/api';\nimport * as z from 'zod';\n\nimport { COOKIE_CONSENT_ERROR_CODES } from './error-codes';\nimport type {\n  Consent,\n  CookieConsentOptions,\n  CookieConsentPayload,\n  CookieConsentRecord,\n} from './type';\n\nconst setConsentSchema = z.object({\n  anonymousId: z.string().meta({\n    description: 'Anonymous identifier for unauthenticated users',\n  }),\n  consent: z.record(z.string(), z.boolean()).meta({\n    description: 'Consent preferences as category-boolean pairs',\n  }),\n  consentVersion: z.string().meta({\n    description: 'Version of the consent policy',\n  }),\n});\n\nconst getConsentSchema = z.object({\n  anonymousId: z.string().optional().meta({\n    description: 'Anonymous identifier fallback when no session exists',\n  }),\n});\n\nconst mergeConsentSchema = z.object({\n  anonymousId: z.string().meta({\n    description: 'Anonymous identifier to merge consent from',\n  }),\n});\n\nexport const setConsent = <O extends CookieConsentOptions>(options: O) =>\n  createAuthEndpoint(\n    '/cookie-consent/set',\n    {\n      method: 'POST',\n      body: setConsentSchema,\n    },\n    async (ctx) => {\n      const { anonymousId, consent, consentVersion } = ctx.body;\n\n      if (!anonymousId) {\n        throw APIError.from('BAD_REQUEST', COOKIE_CONSENT_ERROR_CODES.MISSING_ANONYMOUS_ID);\n      }\n\n      if (!consent || Object.keys(consent).length === 0) {\n        throw APIError.from('BAD_REQUEST', COOKIE_CONSENT_ERROR_CODES.INVALID_CONSENT);\n      }\n\n      const validatedConsent = validateConsent(options, consent, ctx.context.logger);\n\n      const session = await getSessionFromCtx(ctx);\n      const userId = session?.user?.id ?? null;\n\n      // Look for existing record by userId or anonymousId\n      const existing = await findConsentRecord(ctx, userId, anonymousId);\n\n      const consentJson = JSON.stringify(validatedConsent);\n      const now = new Date();\n\n      if (existing) {\n        await ctx.context.adapter.update<CookieConsentRecord>({\n          model: 'cookieConsent',\n          where: [{ field: 'id', value: existing.id }],\n          update: {\n            userId,\n            consent: consentJson,\n            consentVersion,\n            timestamp: now,\n          },\n        });\n      } else {\n        await ctx.context.adapter.create<CookieConsentPayload, CookieConsentRecord>({\n          model: 'cookieConsent',\n          data: {\n            userId,\n            anonymousId,\n            consent: consentJson,\n            consentVersion,\n            timestamp: now,\n          },\n        });\n      }\n\n      if (options.onConsentChange) {\n        const record =\n          (await findConsentRecord(ctx, userId, anonymousId)) ??\n          ({\n            id: '',\n            userId,\n            anonymousId,\n            consent: consentJson,\n            consentVersion,\n            timestamp: now,\n          } as CookieConsentRecord);\n\n        await ctx.context.runInBackgroundOrAwait(\n          options.onConsentChange({ consent: record }, ctx.request),\n        );\n      }\n\n      return ctx.json({ status: true });\n    },\n  );\n\nexport const getConsent = <O extends CookieConsentOptions>(options: O) =>\n  createAuthEndpoint(\n    '/cookie-consent/get',\n    {\n      method: 'GET',\n      query: getConsentSchema,\n    },\n    async (ctx) => {\n      const session = await getSessionFromCtx(ctx);\n      const userId = session?.user?.id ?? null;\n      const anonymousId = ctx.query?.anonymousId;\n\n      if (!userId && !anonymousId) {\n        throw APIError.from('BAD_REQUEST', COOKIE_CONSENT_ERROR_CODES.MISSING_ANONYMOUS_ID);\n      }\n\n      const record = await findConsentRecord(ctx, userId, anonymousId);\n\n      if (!record) {\n        return ctx.json({ consent: null, versionMatch: false });\n      }\n\n      const currentVersion = options.consentVersion ?? 'v1';\n      const versionMatch = record.consentVersion === currentVersion;\n\n      return ctx.json({\n        consent: {\n          id: record.id,\n          userId: record.userId,\n          anonymousId: record.anonymousId,\n          consent: JSON.parse(record.consent) as Consent,\n          consentVersion: record.consentVersion,\n          timestamp: record.timestamp,\n        },\n        versionMatch,\n      });\n    },\n  );\n\nexport const mergeConsent = <O extends CookieConsentOptions>(_options: O) =>\n  createAuthEndpoint(\n    '/cookie-consent/merge',\n    {\n      method: 'POST',\n      body: mergeConsentSchema,\n    },\n    async (ctx) => {\n      const session = await getSessionFromCtx(ctx);\n      const userId = session?.user?.id;\n\n      if (!userId) {\n        throw APIError.from('UNAUTHORIZED', COOKIE_CONSENT_ERROR_CODES.AUTHENTICATION_REQUIRED);\n      }\n\n      const merged = await mergeAnonymousConsentToUser(\n        ctx.context.adapter,\n        userId,\n        ctx.body.anonymousId,\n      );\n      return ctx.json({ status: true, merged });\n    },\n  );\n\n/**\n * Merge anonymous consent into a user's record.\n * Shared between the merge endpoint and the sign-in/sign-up hook.\n *\n * @returns `true` if consent was merged, `false` if no anonymous record was found.\n */\nexport async function mergeAnonymousConsentToUser(\n  adapter: DBAdapter<BetterAuthOptions>,\n  userId: string,\n  anonymousId: string,\n): Promise<boolean> {\n  const anonymousRecord = await adapter.findOne<CookieConsentRecord>({\n    model: 'cookieConsent',\n    where: [{ field: 'anonymousId', value: anonymousId }],\n  });\n\n  if (!anonymousRecord || anonymousRecord.userId) return false;\n  // ^ Skip if record doesn't exist or is already linked to a user (already merged)\n\n  const userRecord = await adapter.findOne<CookieConsentRecord>({\n    model: 'cookieConsent',\n    where: [{ field: 'userId', value: userId }],\n  });\n\n  if (userRecord) {\n    // User already has consent; update with anonymous data\n    await adapter.update<CookieConsentRecord>({\n      model: 'cookieConsent',\n      where: [{ field: 'id', value: userRecord.id }],\n      update: {\n        consent: anonymousRecord.consent,\n        consentVersion: anonymousRecord.consentVersion,\n        anonymousId,\n        timestamp: new Date(),\n      },\n    });\n    await adapter.delete({\n      model: 'cookieConsent',\n      where: [{ field: 'id', value: anonymousRecord.id }],\n    });\n  } else {\n    // Attach anonymous consent to user\n    await adapter.update<CookieConsentRecord>({\n      model: 'cookieConsent',\n      where: [{ field: 'id', value: anonymousRecord.id }],\n      update: { userId },\n    });\n  }\n\n  return true;\n}\n\n/**\n * Find a consent record by userId (preferred) or anonymousId fallback.\n */\nasync function findConsentRecord(\n  ctx: {\n    context: {\n      adapter: DBAdapter<BetterAuthOptions>;\n    };\n  },\n  userId: string | null | undefined,\n  anonymousId: string | undefined,\n): Promise<CookieConsentRecord | null> {\n  if (userId) {\n    const byUser = await ctx.context.adapter.findOne<CookieConsentRecord>({\n      model: 'cookieConsent',\n      where: [{ field: 'userId', value: userId }],\n    });\n    if (byUser) return byUser;\n  }\n\n  if (anonymousId) {\n    return ctx.context.adapter.findOne<CookieConsentRecord>({\n      model: 'cookieConsent',\n      where: [{ field: 'anonymousId', value: anonymousId }],\n    });\n  }\n\n  return null;\n}\n\n/**\n * Validate the consent object against the configured validation schema.\n * Returns the validated consent or the original consent when no schema is set.\n */\nfunction validateConsent(\n  options: CookieConsentOptions,\n  consent: Consent,\n  logger: InternalLogger,\n): Consent {\n  if (!options.consent?.validationSchema) {\n    return consent;\n  }\n  const validationResult = options.consent.validationSchema['~standard'].validate(consent);\n\n  if (validationResult instanceof Promise) {\n    throw APIError.from('INTERNAL_SERVER_ERROR', BASE_ERROR_CODES.ASYNC_VALIDATION_NOT_SUPPORTED);\n  }\n\n  if (validationResult.issues) {\n    logger.error('Invalid consent', validationResult.issues);\n    throw APIError.from('BAD_REQUEST', COOKIE_CONSENT_ERROR_CODES.INVALID_CONSENT);\n  }\n\n  return validationResult.value as Consent;\n}\n","import { type BetterAuthPluginDBSchema } from 'better-auth';\nimport { mergeSchema } from 'better-auth/db';\n\nimport type { CookieConsentOptions } from './type';\n\nexport const cookieConsent = {\n  cookieConsent: {\n    fields: {\n      userId: {\n        type: 'string',\n        required: false,\n        references: {\n          model: 'user',\n          field: 'id',\n        },\n      },\n      anonymousId: {\n        type: 'string',\n        required: true,\n      },\n      consent: {\n        type: 'string',\n        required: true,\n      },\n      consentVersion: {\n        type: 'string',\n        required: true,\n      },\n      timestamp: {\n        type: 'date',\n        defaultValue: () => new Date(),\n        required: true,\n      },\n    },\n  },\n} satisfies BetterAuthPluginDBSchema;\n\nexport const getSchema = <O extends CookieConsentOptions>(options: O) => {\n  return mergeSchema(cookieConsent, options.schema);\n};\n","import type { BetterAuthOptions, BetterAuthPlugin, DBAdapter } from 'better-auth';\nimport { createAuthMiddleware } from 'better-auth/api';\nimport * as z from 'zod';\n\nimport { COOKIE_CONSENT_ERROR_CODES } from './error-codes';\nimport { getConsent, mergeAnonymousConsentToUser, mergeConsent, setConsent } from './routes';\nimport { getSchema } from './schema';\nimport type {\n  Consent,\n  ConsentSchemaModel,\n  CookieConsentOptions,\n  CookieConsentRecord,\n} from './type';\n\n/**\n * Cookie name used to store the anonymous consent ID.\n * The client sets this cookie so the server-side hook can\n * read it during sign-in to auto-merge anonymous consent.\n */\nexport const ANONYMOUS_ID_COOKIE = 'cookie-consent-anon-id';\n\n/**\n * Parse a single cookie value from a raw `Cookie` header string.\n */\nfunction parseCookieValue(\n  cookieHeader: string | null | undefined,\n  name: string,\n): string | undefined {\n  if (!cookieHeader) return undefined;\n  for (const pair of cookieHeader.split('; ')) {\n    const [key, ...valueParts] = pair.split('=');\n    if (key === name && valueParts.length > 0) {\n      const raw = valueParts.join('=');\n      try {\n        return decodeURIComponent(raw);\n      } catch {\n        return raw;\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Preset validation schema for cookie consent.\n * Validates the standard consent categories: necessary, analytics, marketing, functional.\n * Use this with `consent.validationSchema` in the plugin options.\n *\n * @example\n * ```ts\n * cookieConsentPlugin({\n *   consentVersion: 'v1',\n *   consent: { validationSchema: defaultConsentSchema },\n * })\n * ```\n */\nexport const defaultConsentSchema = z.object({\n  necessary: z.boolean(),\n  analytics: z.boolean(),\n  marketing: z.boolean(),\n  functional: z.boolean(),\n}) satisfies ConsentSchemaModel;\n\nexport const cookieConsentPlugin = <O extends CookieConsentOptions>(options: O = {} as O) => {\n  return {\n    id: 'cookie-consent',\n    schema: getSchema(options),\n    endpoints: {\n      setConsent: setConsent(options),\n      getConsent: getConsent(options),\n      mergeConsent: mergeConsent(options),\n    },\n    hooks: {\n      after: [\n        {\n          // After sign-in or sign-up (any method), merge anonymous consent to user.\n          // Uses prefix matching to cover all auth methods: email, social,\n          // biometrics, passkey, phone, etc.\n          matcher: (context) => {\n            return (\n              !!context.path &&\n              (context.path.startsWith('/sign-in/') || context.path.startsWith('/sign-up/'))\n            );\n          },\n          handler: createAuthMiddleware(async (ctx) => {\n            const userId = ctx.context.newSession?.user?.id;\n            if (!userId) return;\n\n            // Read anonymousId from the cookie set by the client\n            const anonymousId = parseCookieValue(ctx.headers?.get('cookie'), ANONYMOUS_ID_COOKIE);\n            if (!anonymousId) return;\n\n            await mergeAnonymousConsentToUser(ctx.context.adapter, userId, anonymousId);\n          }),\n        },\n      ],\n    },\n    options: options as NoInfer<O>,\n    rateLimit: [\n      {\n        pathMatcher: (path) => ['/cookie-consent/set', '/cookie-consent/merge'].includes(path),\n        window: options.rateLimit?.window ?? 10,\n        max: options.rateLimit?.max ?? 10,\n      },\n    ],\n    $ERROR_CODES: COOKIE_CONSENT_ERROR_CODES,\n  } satisfies BetterAuthPlugin;\n};\n\n// ─── Helper utilities ──────────────────────────────────────────────────\n\n/**\n * Extract the parsed consent object from the endpoint context.\n * Returns `null` if no consent is available.\n */\nexport async function getConsentFromCtx(ctx: {\n  context: {\n    adapter: DBAdapter<BetterAuthOptions>;\n    session?: { user?: { id?: string } } | null;\n  };\n  query?: { anonymousId?: string };\n}): Promise<CookieConsentRecord | null> {\n  const userId = ctx.context.session?.user?.id ?? null;\n  const anonymousId = ctx.query?.anonymousId;\n\n  if (userId) {\n    const byUser = await ctx.context.adapter.findOne<CookieConsentRecord>({\n      model: 'cookieConsent',\n      where: [{ field: 'userId', value: userId }],\n    });\n    if (byUser) return byUser;\n  }\n\n  if (anonymousId) {\n    return ctx.context.adapter.findOne<CookieConsentRecord>({\n      model: 'cookieConsent',\n      where: [{ field: 'anonymousId', value: anonymousId }],\n    });\n  }\n\n  return null;\n}\n\n/**\n * Check if a specific consent category is granted.\n */\nexport async function hasConsent(\n  ctx: Parameters<typeof getConsentFromCtx>[0],\n  category: string,\n): Promise<boolean> {\n  const record = await getConsentFromCtx(ctx);\n  if (!record) return false;\n  const parsed = JSON.parse(record.consent) as Consent;\n  return parsed[category] === true;\n}\n\nexport type * from './type';\n"],"mappings":";;;;;;AAiBA,MAAM,mBAAmB,EAAE,OAAO;CAChC,aAAa,EAAE,QAAQ,CAAC,KAAK,EAC3B,aAAa,kDACd,CAAC;CACF,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,KAAK,EAC9C,aAAa,iDACd,CAAC;CACF,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAC9B,aAAa,iCACd,CAAC;CACH,CAAC;AAEF,MAAM,mBAAmB,EAAE,OAAO,EAChC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,EACtC,aAAa,wDACd,CAAC,EACH,CAAC;AAEF,MAAM,qBAAqB,EAAE,OAAO,EAClC,aAAa,EAAE,QAAQ,CAAC,KAAK,EAC3B,aAAa,8CACd,CAAC,EACH,CAAC;AAEF,MAAa,cAA8C,YACzD,mBACE,uBACA;CACE,QAAQ;CACR,MAAM;CACP,EACD,OAAO,QAAQ;CACb,MAAM,EAAE,aAAa,SAAS,mBAAmB,IAAI;AAErD,KAAI,CAAC,YACH,OAAM,SAAS,KAAK,eAAe,2BAA2B,qBAAqB;AAGrF,KAAI,CAAC,WAAW,OAAO,KAAK,QAAQ,CAAC,WAAW,EAC9C,OAAM,SAAS,KAAK,eAAe,2BAA2B,gBAAgB;CAGhF,MAAM,mBAAmB,gBAAgB,SAAS,SAAS,IAAI,QAAQ,OAAO;CAG9E,MAAM,UADU,MAAM,kBAAkB,IAAI,GACpB,MAAM,MAAM;CAGpC,MAAM,WAAW,MAAM,kBAAkB,KAAK,QAAQ,YAAY;CAElE,MAAM,cAAc,KAAK,UAAU,iBAAiB;CACpD,MAAM,sBAAM,IAAI,MAAM;AAEtB,KAAI,SACF,OAAM,IAAI,QAAQ,QAAQ,OAA4B;EACpD,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAM,OAAO,SAAS;GAAI,CAAC;EAC5C,QAAQ;GACN;GACA,SAAS;GACT;GACA,WAAW;GACZ;EACF,CAAC;KAEF,OAAM,IAAI,QAAQ,QAAQ,OAAkD;EAC1E,OAAO;EACP,MAAM;GACJ;GACA;GACA,SAAS;GACT;GACA,WAAW;GACZ;EACF,CAAC;AAGJ,KAAI,QAAQ,iBAAiB;EAC3B,MAAM,SACH,MAAM,kBAAkB,KAAK,QAAQ,YAAY,IACjD;GACC,IAAI;GACJ;GACA;GACA,SAAS;GACT;GACA,WAAW;GACZ;AAEH,QAAM,IAAI,QAAQ,uBAChB,QAAQ,gBAAgB,EAAE,SAAS,QAAQ,EAAE,IAAI,QAAQ,CAC1D;;AAGH,QAAO,IAAI,KAAK,EAAE,QAAQ,MAAM,CAAC;EAEpC;AAEH,MAAa,cAA8C,YACzD,mBACE,uBACA;CACE,QAAQ;CACR,OAAO;CACR,EACD,OAAO,QAAQ;CAEb,MAAM,UADU,MAAM,kBAAkB,IAAI,GACpB,MAAM,MAAM;CACpC,MAAM,cAAc,IAAI,OAAO;AAE/B,KAAI,CAAC,UAAU,CAAC,YACd,OAAM,SAAS,KAAK,eAAe,2BAA2B,qBAAqB;CAGrF,MAAM,SAAS,MAAM,kBAAkB,KAAK,QAAQ,YAAY;AAEhE,KAAI,CAAC,OACH,QAAO,IAAI,KAAK;EAAE,SAAS;EAAM,cAAc;EAAO,CAAC;CAGzD,MAAM,iBAAiB,QAAQ,kBAAkB;CACjD,MAAM,eAAe,OAAO,mBAAmB;AAE/C,QAAO,IAAI,KAAK;EACd,SAAS;GACP,IAAI,OAAO;GACX,QAAQ,OAAO;GACf,aAAa,OAAO;GACpB,SAAS,KAAK,MAAM,OAAO,QAAQ;GACnC,gBAAgB,OAAO;GACvB,WAAW,OAAO;GACnB;EACD;EACD,CAAC;EAEL;AAEH,MAAa,gBAAgD,aAC3D,mBACE,yBACA;CACE,QAAQ;CACR,MAAM;CACP,EACD,OAAO,QAAQ;CAEb,MAAM,UADU,MAAM,kBAAkB,IAAI,GACpB,MAAM;AAE9B,KAAI,CAAC,OACH,OAAM,SAAS,KAAK,gBAAgB,2BAA2B,wBAAwB;CAGzF,MAAM,SAAS,MAAM,4BACnB,IAAI,QAAQ,SACZ,QACA,IAAI,KAAK,YACV;AACD,QAAO,IAAI,KAAK;EAAE,QAAQ;EAAM;EAAQ,CAAC;EAE5C;;;;;;;AAQH,eAAsB,4BACpB,SACA,QACA,aACkB;CAClB,MAAM,kBAAkB,MAAM,QAAQ,QAA6B;EACjE,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAe,OAAO;GAAa,CAAC;EACtD,CAAC;AAEF,KAAI,CAAC,mBAAmB,gBAAgB,OAAQ,QAAO;CAGvD,MAAM,aAAa,MAAM,QAAQ,QAA6B;EAC5D,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAU,OAAO;GAAQ,CAAC;EAC5C,CAAC;AAEF,KAAI,YAAY;AAEd,QAAM,QAAQ,OAA4B;GACxC,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAM,OAAO,WAAW;IAAI,CAAC;GAC9C,QAAQ;IACN,SAAS,gBAAgB;IACzB,gBAAgB,gBAAgB;IAChC;IACA,2BAAW,IAAI,MAAM;IACtB;GACF,CAAC;AACF,QAAM,QAAQ,OAAO;GACnB,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAM,OAAO,gBAAgB;IAAI,CAAC;GACpD,CAAC;OAGF,OAAM,QAAQ,OAA4B;EACxC,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAM,OAAO,gBAAgB;GAAI,CAAC;EACnD,QAAQ,EAAE,QAAQ;EACnB,CAAC;AAGJ,QAAO;;;;;AAMT,eAAe,kBACb,KAKA,QACA,aACqC;AACrC,KAAI,QAAQ;EACV,MAAM,SAAS,MAAM,IAAI,QAAQ,QAAQ,QAA6B;GACpE,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAU,OAAO;IAAQ,CAAC;GAC5C,CAAC;AACF,MAAI,OAAQ,QAAO;;AAGrB,KAAI,YACF,QAAO,IAAI,QAAQ,QAAQ,QAA6B;EACtD,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAe,OAAO;GAAa,CAAC;EACtD,CAAC;AAGJ,QAAO;;;;;;AAOT,SAAS,gBACP,SACA,SACA,QACS;AACT,KAAI,CAAC,QAAQ,SAAS,iBACpB,QAAO;CAET,MAAM,mBAAmB,QAAQ,QAAQ,iBAAiB,aAAa,SAAS,QAAQ;AAExF,KAAI,4BAA4B,QAC9B,OAAM,SAAS,KAAK,yBAAyB,iBAAiB,+BAA+B;AAG/F,KAAI,iBAAiB,QAAQ;AAC3B,SAAO,MAAM,mBAAmB,iBAAiB,OAAO;AACxD,QAAM,SAAS,KAAK,eAAe,2BAA2B,gBAAgB;;AAGhF,QAAO,iBAAiB;;;;ACtR1B,MAAa,gBAAgB,EAC3B,eAAe,EACb,QAAQ;CACN,QAAQ;EACN,MAAM;EACN,UAAU;EACV,YAAY;GACV,OAAO;GACP,OAAO;GACR;EACF;CACD,aAAa;EACX,MAAM;EACN,UAAU;EACX;CACD,SAAS;EACP,MAAM;EACN,UAAU;EACX;CACD,gBAAgB;EACd,MAAM;EACN,UAAU;EACX;CACD,WAAW;EACT,MAAM;EACN,oCAAoB,IAAI,MAAM;EAC9B,UAAU;EACX;CACF,EACF,EACF;AAED,MAAa,aAA6C,YAAe;AACvE,QAAO,YAAY,eAAe,QAAQ,OAAO;;;;;;;;;ACnBnD,MAAa,sBAAsB;;;;AAKnC,SAAS,iBACP,cACA,MACoB;AACpB,KAAI,CAAC,aAAc,QAAO,KAAA;AAC1B,MAAK,MAAM,QAAQ,aAAa,MAAM,KAAK,EAAE;EAC3C,MAAM,CAAC,KAAK,GAAG,cAAc,KAAK,MAAM,IAAI;AAC5C,MAAI,QAAQ,QAAQ,WAAW,SAAS,GAAG;GACzC,MAAM,MAAM,WAAW,KAAK,IAAI;AAChC,OAAI;AACF,WAAO,mBAAmB,IAAI;WACxB;AACN,WAAO;;;;;;;;;;;;;;;;;;AAoBf,MAAa,uBAAuB,EAAE,OAAO;CAC3C,WAAW,EAAE,SAAS;CACtB,WAAW,EAAE,SAAS;CACtB,WAAW,EAAE,SAAS;CACtB,YAAY,EAAE,SAAS;CACxB,CAAC;AAEF,MAAa,uBAAuD,UAAa,EAAE,KAAU;AAC3F,QAAO;EACL,IAAI;EACJ,QAAQ,UAAU,QAAQ;EAC1B,WAAW;GACT,YAAY,WAAW,QAAQ;GAC/B,YAAY,WAAW,QAAQ;GAC/B,cAAc,aAAa,QAAQ;GACpC;EACD,OAAO,EACL,OAAO,CACL;GAIE,UAAU,YAAY;AACpB,WACE,CAAC,CAAC,QAAQ,SACT,QAAQ,KAAK,WAAW,YAAY,IAAI,QAAQ,KAAK,WAAW,YAAY;;GAGjF,SAAS,qBAAqB,OAAO,QAAQ;IAC3C,MAAM,SAAS,IAAI,QAAQ,YAAY,MAAM;AAC7C,QAAI,CAAC,OAAQ;IAGb,MAAM,cAAc,iBAAiB,IAAI,SAAS,IAAI,SAAS,EAAE,oBAAoB;AACrF,QAAI,CAAC,YAAa;AAElB,UAAM,4BAA4B,IAAI,QAAQ,SAAS,QAAQ,YAAY;KAC3E;GACH,CACF,EACF;EACQ;EACT,WAAW,CACT;GACE,cAAc,SAAS,CAAC,uBAAuB,wBAAwB,CAAC,SAAS,KAAK;GACtF,QAAQ,QAAQ,WAAW,UAAU;GACrC,KAAK,QAAQ,WAAW,OAAO;GAChC,CACF;EACD,cAAc;EACf;;;;;;AASH,eAAsB,kBAAkB,KAMA;CACtC,MAAM,SAAS,IAAI,QAAQ,SAAS,MAAM,MAAM;CAChD,MAAM,cAAc,IAAI,OAAO;AAE/B,KAAI,QAAQ;EACV,MAAM,SAAS,MAAM,IAAI,QAAQ,QAAQ,QAA6B;GACpE,OAAO;GACP,OAAO,CAAC;IAAE,OAAO;IAAU,OAAO;IAAQ,CAAC;GAC5C,CAAC;AACF,MAAI,OAAQ,QAAO;;AAGrB,KAAI,YACF,QAAO,IAAI,QAAQ,QAAQ,QAA6B;EACtD,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAe,OAAO;GAAa,CAAC;EACtD,CAAC;AAGJ,QAAO;;;;;AAMT,eAAsB,WACpB,KACA,UACkB;CAClB,MAAM,SAAS,MAAM,kBAAkB,IAAI;AAC3C,KAAI,CAAC,OAAQ,QAAO;AAEpB,QADe,KAAK,MAAM,OAAO,QAAQ,CAC3B,cAAc"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "better-auth-cookie-consent",
+  "version": "0.1.0",
+  "description": "Better Auth Cookie Consent plugin for GDPR-compliant consent management",
+  "homepage": "https://github.com/marcjulian/better-auth-plugins#readme",
+  "bugs": {
+    "url": "https://github.com/marcjulian/better-auth-plugins/issues"
+  },
+  "license": "MIT",
+  "author": "Gary Großgarten <info@gary.dev>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/marcjulian/better-auth-plugins.git"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": "./dist/index.mjs",
+    "./client": "./dist/client.mjs",
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "nanostores": "^1.1.1",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.5",
+    "bumpp": "^10.4.1",
+    "tsdown": "^0.21.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
+  },
+  "peerDependencies": {
+    "better-auth": "^1.5.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "test": "vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}