{"id":"@lssm-tech/integration.authos-better-auth","slug":"integration.authos-better-auth","name":"@lssm-tech/integration.authos-better-auth","version":"2.1.4","path":"packages/integrations/authos-better-auth","manifestPath":"packages/integrations/authos-better-auth/package.json","manifestBlobSha":"1a1a7bad5eff1becf6390652f6f832c8e04dd34b","layer":"integrations","physicalArea":null,"primaryArea":"identity-and-access","classification":{"privateDeclared":null,"catalogFamily":"integrations","catalogKind":"integration","catalogStatus":"active","adoptionMode":"adoptable","stability":"experimental"},"description":"Better Auth bridge that maps AuthOS contracts to provider configuration, plugins, and redacted events.","descriptionOrigin":"package.json","catalog":{"family":"integrations","kind":"integration","status":"active","adoptionMode":"adoptable","stability":"experimental","platforms":["browser","react-native","server"],"runtimes":["node"],"entrypoints":[".","./attribution-hooks","./canonical-email-adapter","./client","./companyos-spec","./config","./cookie-options","./edge-cookie","./email-callbacks","./mapper","./native-session-client","./plugin-metadata","./product-membership-handler","./pairwise-subject","./provider-metadata","./server","./types"],"documentation":[{"title":"Integration Authos Better Auth documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fintegration.authos-better-auth","kind":"readme"}],"examples":[],"replacements":[],"capabilities":[{"id":"package.lssm.tech.integration.authos.better.auth","title":"Integration Authos Better Auth","description":"Better Auth bridge that maps AuthOS contracts to provider configuration, plugins, and redacted events.","status":"active","useCases":["Adopt better auth bridge that maps authos contracts to provider configuration, plugins, and redacted events"],"aliases":["contractspec","authos","better-auth","identity","integration","better","auth"],"pythonEquivalents":[],"canonicalImports":[{"from":"@lssm-tech/integration.authos-better-auth","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/attribution-hooks","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/canonical-email-adapter","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/client","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/companyos-spec","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/config","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/cookie-options","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/edge-cookie","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/email-callbacks","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/mapper","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/native-session-client","symbols":["createNativeAuthSessionClient"]},{"from":"@lssm-tech/integration.authos-better-auth/plugin-metadata","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/product-membership-handler","symbols":[]},{"from":"@lssm-tech/integration.authos-better-auth/server","symbols":["createBetterAuthInstance","buildBetterAuthOptions"]}],"constraints":{"platforms":["browser","react-native","server"],"runtimes":["node"],"avoidWhen":["The @lssm-tech/integration.authos-better-auth package constraints do not match the target runtime or platform."],"requires":["TypeScript"]},"alternatives":[],"relationships":[],"resolutionPriority":50}]},"canonicalImports":[{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/attribution-hooks","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/canonical-email-adapter","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/client","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/companyos-spec","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/config","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/cookie-options","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/edge-cookie","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/email-callbacks","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/mapper","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/native-session-client","symbols":["createNativeAuthSessionClient"]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/plugin-metadata","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/product-membership-handler","symbols":[]},{"capabilityId":"package.lssm.tech.integration.authos.better.auth","from":"@lssm-tech/integration.authos-better-auth/server","symbols":["createBetterAuthInstance","buildBetterAuthOptions"]}],"scripts":{"publish:pkg":"bun publish --tolerate-republish --ignore-scripts --verbose","publish:pkg:canary":"bun publish:pkg --tag canary","build":"contractspec-bun-build build","build:bundle":"contractspec-bun-build transpile","build:types":"contractspec-bun-build types","dev":"contractspec-bun-build dev","clean":"rimraf dist .turbo","lint":"bun lint:fix","lint:fix":"node ../../../scripts/biome.cjs check --write .","lint:check":"node ../../../scripts/biome.cjs check .","test":"bun test","prebuild":"contractspec-bun-build prebuild","typecheck":"tsgo --noEmit"},"scriptStatus":"complete pinned manifest","dependencies":{"@better-auth/core":"1.7.5","@better-auth/oauth-provider":"1.7.5","@better-auth/passkey":"1.7.5","@better-auth/sso":"1.7.5","@lssm-tech/lib.authos-runtime":"workspace:^","@lssm-tech/lib.authos-spec":"workspace:^","better-auth":"1.7.5"},"devDependencies":{"@lssm-tech/tool.bun":"workspace:*","@lssm-tech/tool.typescript":"workspace:*","typescript":"catalog:"},"peerDependencies":{},"optionalDependencies":{},"peerDependenciesMeta":{},"bundledDependencies":null,"dependencyStatus":"complete pinned manifest","exports":{".":"./src/index.ts","./attribution-hooks":"./src/attribution-hooks.ts","./bearer-session-reader":"./src/bearer-session-reader.ts","./bridge-plan":"./src/bridge-plan.ts","./canonical-email-adapter":"./src/canonical-email-adapter.ts","./client":"./src/client.ts","./companyos-spec":"./src/companyos-spec.ts","./config":"./src/config.ts","./cookie-options":"./src/cookie-options.ts","./edge-cookie":"./src/edge-cookie.ts","./email-callbacks":"./src/email-callbacks.ts","./generic-oauth-client-compat":"./src/generic-oauth-client-compat.ts","./mapper":"./src/mapper.ts","./native-session-client":"./src/native-session-client.ts","./pairwise-subject":"./src/pairwise-subject.ts","./plugin-metadata":"./src/plugin-metadata.ts","./product-membership-handler":"./src/product-membership-handler.ts","./provider-metadata":"./src/provider-metadata.ts","./relying-party-reconciliation":"./src/relying-party-reconciliation.ts","./server":"./src/better-auth.server.ts","./types":"./src/types.ts"},"publishExports":{".":{"types":"./dist/index.d.ts","bun":"./dist/index.js","node":"./dist/node/index.js","default":"./dist/index.js"},"./attribution-hooks":{"types":"./dist/attribution-hooks.d.ts","bun":"./dist/attribution-hooks.js","node":"./dist/node/attribution-hooks.js","default":"./dist/attribution-hooks.js"},"./bearer-session-reader":{"types":"./dist/bearer-session-reader.d.ts","bun":"./dist/bearer-session-reader.js","node":"./dist/node/bearer-session-reader.js","default":"./dist/bearer-session-reader.js"},"./bridge-plan":{"types":"./dist/bridge-plan.d.ts","bun":"./dist/bridge-plan.js","node":"./dist/node/bridge-plan.js","default":"./dist/bridge-plan.js"},"./canonical-email-adapter":{"types":"./dist/canonical-email-adapter.d.ts","bun":"./dist/canonical-email-adapter.js","node":"./dist/node/canonical-email-adapter.js","default":"./dist/canonical-email-adapter.js"},"./client":{"types":"./dist/client.d.ts","bun":"./dist/client.js","node":"./dist/node/client.js","default":"./dist/client.js"},"./companyos-spec":{"types":"./dist/companyos-spec.d.ts","bun":"./dist/companyos-spec.js","node":"./dist/node/companyos-spec.js","default":"./dist/companyos-spec.js"},"./config":{"types":"./dist/config.d.ts","bun":"./dist/config.js","node":"./dist/node/config.js","default":"./dist/config.js"},"./cookie-options":{"types":"./dist/cookie-options.d.ts","bun":"./dist/cookie-options.js","node":"./dist/node/cookie-options.js","default":"./dist/cookie-options.js"},"./edge-cookie":{"types":"./dist/edge-cookie.d.ts","bun":"./dist/edge-cookie.js","node":"./dist/node/edge-cookie.js","default":"./dist/edge-cookie.js"},"./email-callbacks":{"types":"./dist/email-callbacks.d.ts","bun":"./dist/email-callbacks.js","node":"./dist/node/email-callbacks.js","default":"./dist/email-callbacks.js"},"./generic-oauth-client-compat":{"types":"./dist/generic-oauth-client-compat.d.ts","bun":"./dist/generic-oauth-client-compat.js","node":"./dist/node/generic-oauth-client-compat.js","default":"./dist/generic-oauth-client-compat.js"},"./mapper":{"types":"./dist/mapper.d.ts","bun":"./dist/mapper.js","node":"./dist/node/mapper.js","default":"./dist/mapper.js"},"./native-session-client":{"types":"./dist/native-session-client.d.ts","bun":"./dist/native-session-client.js","node":"./dist/node/native-session-client.js","default":"./dist/native-session-client.js"},"./pairwise-subject":{"types":"./dist/pairwise-subject.d.ts","bun":"./dist/pairwise-subject.js","node":"./dist/node/pairwise-subject.js","default":"./dist/pairwise-subject.js"},"./plugin-metadata":{"types":"./dist/plugin-metadata.d.ts","bun":"./dist/plugin-metadata.js","node":"./dist/node/plugin-metadata.js","default":"./dist/plugin-metadata.js"},"./product-membership-handler":{"types":"./dist/product-membership-handler.d.ts","bun":"./dist/product-membership-handler.js","node":"./dist/node/product-membership-handler.js","default":"./dist/product-membership-handler.js"},"./provider-metadata":{"types":"./dist/provider-metadata.d.ts","bun":"./dist/provider-metadata.js","node":"./dist/node/provider-metadata.js","default":"./dist/provider-metadata.js"},"./relying-party-reconciliation":{"types":"./dist/relying-party-reconciliation.d.ts","bun":"./dist/relying-party-reconciliation.js","node":"./dist/node/relying-party-reconciliation.js","default":"./dist/relying-party-reconciliation.js"},"./server":{"types":"./dist/better-auth.server.d.ts","bun":"./dist/better-auth.server.js","node":"./dist/node/better-auth.server.js","default":"./dist/better-auth.server.js"},"./types":{"types":"./dist/types.d.ts","bun":"./dist/types.js","node":"./dist/node/types.js","default":"./dist/types.js"}},"types":"./dist/index.d.ts","files":["dist","README.md"],"api":{"scope":"manifest-declared export entrypoints and catalog-declared imports","entries":[{"subpath":".","importPath":"@lssm-tech/integration.authos-better-auth","target":"./src/index.ts","targets":[{"conditions":[],"target":"./src/index.ts","sourcePath":"packages/integrations/authos-better-auth/src/index.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/index.ts","sourceStatus":"verified source file"}]},{"subpath":"./attribution-hooks","importPath":"@lssm-tech/integration.authos-better-auth/attribution-hooks","target":"./src/attribution-hooks.ts","targets":[{"conditions":[],"target":"./src/attribution-hooks.ts","sourcePath":"packages/integrations/authos-better-auth/src/attribution-hooks.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/attribution-hooks.ts","sourceStatus":"verified source file"}]},{"subpath":"./bearer-session-reader","importPath":"@lssm-tech/integration.authos-better-auth/bearer-session-reader","target":"./src/bearer-session-reader.ts","targets":[{"conditions":[],"target":"./src/bearer-session-reader.ts","sourcePath":"packages/integrations/authos-better-auth/src/bearer-session-reader.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/bearer-session-reader.ts","sourceStatus":"verified source file"}]},{"subpath":"./bridge-plan","importPath":"@lssm-tech/integration.authos-better-auth/bridge-plan","target":"./src/bridge-plan.ts","targets":[{"conditions":[],"target":"./src/bridge-plan.ts","sourcePath":"packages/integrations/authos-better-auth/src/bridge-plan.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/bridge-plan.ts","sourceStatus":"verified source file"}]},{"subpath":"./canonical-email-adapter","importPath":"@lssm-tech/integration.authos-better-auth/canonical-email-adapter","target":"./src/canonical-email-adapter.ts","targets":[{"conditions":[],"target":"./src/canonical-email-adapter.ts","sourcePath":"packages/integrations/authos-better-auth/src/canonical-email-adapter.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/canonical-email-adapter.ts","sourceStatus":"verified source file"}]},{"subpath":"./client","importPath":"@lssm-tech/integration.authos-better-auth/client","target":"./src/client.ts","targets":[{"conditions":[],"target":"./src/client.ts","sourcePath":"packages/integrations/authos-better-auth/src/client.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/client.ts","sourceStatus":"verified source file"}]},{"subpath":"./companyos-spec","importPath":"@lssm-tech/integration.authos-better-auth/companyos-spec","target":"./src/companyos-spec.ts","targets":[{"conditions":[],"target":"./src/companyos-spec.ts","sourcePath":"packages/integrations/authos-better-auth/src/companyos-spec.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/companyos-spec.ts","sourceStatus":"verified source file"}]},{"subpath":"./config","importPath":"@lssm-tech/integration.authos-better-auth/config","target":"./src/config.ts","targets":[{"conditions":[],"target":"./src/config.ts","sourcePath":"packages/integrations/authos-better-auth/src/config.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/config.ts","sourceStatus":"verified source file"}]},{"subpath":"./cookie-options","importPath":"@lssm-tech/integration.authos-better-auth/cookie-options","target":"./src/cookie-options.ts","targets":[{"conditions":[],"target":"./src/cookie-options.ts","sourcePath":"packages/integrations/authos-better-auth/src/cookie-options.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/cookie-options.ts","sourceStatus":"verified source file"}]},{"subpath":"./edge-cookie","importPath":"@lssm-tech/integration.authos-better-auth/edge-cookie","target":"./src/edge-cookie.ts","targets":[{"conditions":[],"target":"./src/edge-cookie.ts","sourcePath":"packages/integrations/authos-better-auth/src/edge-cookie.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/edge-cookie.ts","sourceStatus":"verified source file"}]},{"subpath":"./email-callbacks","importPath":"@lssm-tech/integration.authos-better-auth/email-callbacks","target":"./src/email-callbacks.ts","targets":[{"conditions":[],"target":"./src/email-callbacks.ts","sourcePath":"packages/integrations/authos-better-auth/src/email-callbacks.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/email-callbacks.ts","sourceStatus":"verified source file"}]},{"subpath":"./generic-oauth-client-compat","importPath":"@lssm-tech/integration.authos-better-auth/generic-oauth-client-compat","target":"./src/generic-oauth-client-compat.ts","targets":[{"conditions":[],"target":"./src/generic-oauth-client-compat.ts","sourcePath":"packages/integrations/authos-better-auth/src/generic-oauth-client-compat.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/generic-oauth-client-compat.ts","sourceStatus":"verified source file"}]},{"subpath":"./mapper","importPath":"@lssm-tech/integration.authos-better-auth/mapper","target":"./src/mapper.ts","targets":[{"conditions":[],"target":"./src/mapper.ts","sourcePath":"packages/integrations/authos-better-auth/src/mapper.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/mapper.ts","sourceStatus":"verified source file"}]},{"subpath":"./native-session-client","importPath":"@lssm-tech/integration.authos-better-auth/native-session-client","target":"./src/native-session-client.ts","targets":[{"conditions":[],"target":"./src/native-session-client.ts","sourcePath":"packages/integrations/authos-better-auth/src/native-session-client.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/native-session-client.ts","sourceStatus":"verified source file"}]},{"subpath":"./pairwise-subject","importPath":"@lssm-tech/integration.authos-better-auth/pairwise-subject","target":"./src/pairwise-subject.ts","targets":[{"conditions":[],"target":"./src/pairwise-subject.ts","sourcePath":"packages/integrations/authos-better-auth/src/pairwise-subject.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/pairwise-subject.ts","sourceStatus":"verified source file"}]},{"subpath":"./plugin-metadata","importPath":"@lssm-tech/integration.authos-better-auth/plugin-metadata","target":"./src/plugin-metadata.ts","targets":[{"conditions":[],"target":"./src/plugin-metadata.ts","sourcePath":"packages/integrations/authos-better-auth/src/plugin-metadata.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/plugin-metadata.ts","sourceStatus":"verified source file"}]},{"subpath":"./product-membership-handler","importPath":"@lssm-tech/integration.authos-better-auth/product-membership-handler","target":"./src/product-membership-handler.ts","targets":[{"conditions":[],"target":"./src/product-membership-handler.ts","sourcePath":"packages/integrations/authos-better-auth/src/product-membership-handler.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/product-membership-handler.ts","sourceStatus":"verified source file"}]},{"subpath":"./provider-metadata","importPath":"@lssm-tech/integration.authos-better-auth/provider-metadata","target":"./src/provider-metadata.ts","targets":[{"conditions":[],"target":"./src/provider-metadata.ts","sourcePath":"packages/integrations/authos-better-auth/src/provider-metadata.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/provider-metadata.ts","sourceStatus":"verified source file"}]},{"subpath":"./relying-party-reconciliation","importPath":"@lssm-tech/integration.authos-better-auth/relying-party-reconciliation","target":"./src/relying-party-reconciliation.ts","targets":[{"conditions":[],"target":"./src/relying-party-reconciliation.ts","sourcePath":"packages/integrations/authos-better-auth/src/relying-party-reconciliation.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/relying-party-reconciliation.ts","sourceStatus":"verified source file"}]},{"subpath":"./server","importPath":"@lssm-tech/integration.authos-better-auth/server","target":"./src/better-auth.server.ts","targets":[{"conditions":[],"target":"./src/better-auth.server.ts","sourcePath":"packages/integrations/authos-better-auth/src/better-auth.server.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/better-auth.server.ts","sourceStatus":"verified source file"}]},{"subpath":"./types","importPath":"@lssm-tech/integration.authos-better-auth/types","target":"./src/types.ts","targets":[{"conditions":[],"target":"./src/types.ts","sourcePath":"packages/integrations/authos-better-auth/src/types.ts","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/types.ts","sourceStatus":"verified source file"}]}],"entryCount":21,"namedSymbolCoverage":"catalog declarations only; exhaustive TypeScript symbols not extracted","installationStatus":"not verified"},"docsLinks":[{"title":"Integration Authos Better Auth documentation","url":"https://www.npmjs.com/package/%40lssm-tech%2Fintegration.authos-better-auth","kind":"readme","pinnedUrl":null,"sourceStatus":"declared link; destination not verified"}],"sourceUrls":{"package":"https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth","manifest":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/package.json","readme":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/README.md","guide":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.authos-better-auth.txt"},"readme":{"status":"available","body":"# `@lssm-tech/integration.authos-better-auth`\n\nBetter Auth bridge for AuthOS Broad V0.\n\nThe web bridge preserves legacy `signIn.oauth2({ providerId })` and\n`oauth2.link({ providerId })` callers through Better Auth 1.7's supported\n`signIn.social`/`linkSocial` endpoints. It no longer imports the removed\n`genericOAuthClient`. Provider callback registration/schema migration remains\na separate host rollout requirement.\n\nThis package turns AuthOS contracts into Better Auth configuration and maps Better Auth-like user/session/events back to AuthOS contracts. Canonical models stay in `@lssm-tech/lib.authos-spec`; pure projections and security gates stay in `@lssm-tech/lib.authos-runtime`.\n\n`advanced.cookiePrefix` passes the host-selected namespace to Better Auth. Preview\nhosts can combine a distinct prefix with secure cookies and disabled cross-subdomain\ncookies. This separates cookie names and host scope; data/secret isolation must still\nbe provisioned and verified independently.\n\n## Maturity\n\n- Core email/password, magic link, email OTP, organization/team, admin, OAuth/OIDC client, MFA, and WebAuthn passkeys are runtime-backed through Better Auth (passkeys live-verified on Managed CompanyOS 2026-08-14).\n- The bridge can also wire the `phoneNumber` and `oneTap` plugins, but no LSSM deployment enables them or has live-verified them: Managed CompanyOS does not list them in `companyOsEnabledPlugins`, and the generic `authOsV0Fixture` marks phone OTP/verification and one-tap `fixture-backed`. Phone OTP also needs a host `sendPhoneOtp` delivery callback.\n- Connect with LSSM / LSSM-as-IdP (`@better-auth/oauth-provider`) stays `contract-only` for Managed CompanyOS until `enableLssmIdp` and a security review reference are configured.\n- Built-in social login is typed for Google, Microsoft, LinkedIn, TikTok, Facebook, and GitHub. Hosts may retain `genericOAuth` for additional providers.\n- Generic OIDC hosts can opt into `profileNameFallback: \"email\"` for legacy\n  identities without a display name. The bridge reuses the provider email\n  verbatim and never infers a human name.\n- Invite-only hosts set `disableSignUp`; verified-email providers may resolve an existing verified identity, while TikTok and missing-email LinkedIn/Facebook identities require an explicit authenticated account link.\n- Passkeys use the matching `@better-auth/passkey` server and browser plugins. Hosts must apply the provider's `passkey` table migration before enabling enrollment.\n- SSO and SCIM remain declared external plugin capabilities until their production package wiring is separately reviewed.\n- LSSM-as-IdP uses the supported `@better-auth/oauth-provider` OAuth 2.1/OIDC\n  runtime, with dynamic registration disabled, PKCE/S256 provider defaults,\n  pairwise subject derivation, asymmetric JWT/JWKS support, explicit\n  login/consent routes, and resource audiences. It remains contract-only unless\n  `securityReviewRef` and a server-only pairwise secret are present and\n  production enablement is explicitly gated.\n- IdP hosts may supply a product-access policy. Without one, post-login always\n  redirects to the configured access boundary. Reviewed hosts can publish\n  explicit product scopes, bind consent to an entitlement reference, and emit\n  only coarse application/tier/entitlement claims after the host confirms\n  active access.\n- Product membership handoffs expose a bounded, bearer-authenticated internal\n  handler. It accepts only an RP-specific pairwise subject and idempotent\n  provisioning scope; canonical identity IDs, local role authority, and secret\n  material are excluded from its contracts and replay evidence.\n- `./relying-party-reconciliation` prepares the exact catalog-owned Better Auth\n  OAuth client record for an operator-controlled host reconciliation. It hashes\n  the confidential client secret with the provider's SHA-256/base64url format,\n  keeps dynamic registration disabled, and exposes only a secret-free\n  configuration digest and evidence reference.\n\n## Referral and affiliate handoff\n\n`attribution` configuration composes with an existing Better Auth\n`databaseHooks.user.create.after` hook. When a host resolves a valid signed\nacquisition token, the bridge calls `onIdentityCreated` after email/password or\nOAuth identity creation. The callback receives the opaque token and classified\nflow; the bridge does not persist, decode, or emit the token.\n\n## Native bearer sessions\n\n`./native-session-client` exposes a storage-port-driven Better Auth client for\nExpo, Tauri, and other trusted native shells. Email/password and TOTP flows\ncapture `set-auth-token` and the bounded `set-mfa-authority` projection, while\nthe host-supplied vault keeps both values device-only. Credentials are sent only\nin JSON request bodies to the configured AuthOS origin and never enter URLs,\nlogs, events, or replay evidence.\n\n## Entry points: server and client\n\n- `./server` is the server-only surface: `createBetterAuthInstance`,\n  `buildBetterAuthOptions`, database hooks, OAuth provider discovery,\n  resource-token policy and the development registration helpers. Its source\n  file uses the `.server.ts` suffix, so the package boundary check fails any\n  client (`'use client'` / `.client.ts`) graph that reaches it.\n- `./client` (`createAuthClient`, `createBetterAuthBridgeClient`) and\n  `./native-session-client` are the browser and native clients; `./bridge-plan`\n  and `./edge-cookie` are pure and safe in any runtime.\n- The root entry stays a compatibility barrel that re-exports `./server` plus\n  both clients. Server hosts may keep importing it; client code must use the\n  explicit client entries.\n\n## Verification\n\n```bash\nbun run lint:check\nbun run typecheck\nbun run test\nbun run build\n```\n\n## Pure bridge-plan inspection\n\nUse `@lssm-tech/integration.authos-better-auth/bridge-plan` for browser/native inspection of provider plugin plans. It retains `buildBetterAuthBridgePlan` behavior without importing Better Auth server initialization, database adapters or Next.js cookie integration. The existing root/config exports remain compatible for server consumers. Native preview imports must use this pure entry point; a build-boundary test guards against server code re-entering the graph.\n\n## Better Auth 1.7 client compatibility\n\nThe shared bridge no longer imports the removed `genericOAuthClient` plugin.\nExisting `signIn.oauth2({ providerId, ...options })` and\n`oauth2.link({ providerId, ...options })` bridge calls are retained as adapters to\nBetter Auth's supported `signIn.social` and `linkSocial` methods. They translate\n`providerId` to `provider`, preserve request options and return provider errors.\nOther dynamic client methods retain their original behavior.\n\nThis client repair does not migrate provider registrations, callback forwarding\nroutes, native clients built directly on Better Auth, or account identity data.\nReview those separately using the\n[Better Auth 1.7 upgrade guide](https://better-auth.com/docs/guides/1-7-upgrade-guide)\nbefore qualifying live OAuth. No production identity records were changed.\n\n### Server-side bearer session reads\n\n`createBetterAuthBearerSessionReader` resolves a bearer through the configured\nAuthOS `/api/auth/get-session?disableCookieCache=true` endpoint and maps it to the\ncanonical `AuthOsSession`. It requires HTTPS except loopback development, forbids\nredirects, bounds time/body size, and rejects expired, banned or mismatched user\nsessions. Tokens, email and role strings are not returned. This is authentication\nonly: callers must separately resolve current tenant-scoped permissions and must\nnot infer fleet-management access from the identity or provider role.\n\n\n## Proposed reviewed development resource authority\n\nBoth development registration recipes require the same canonical reviewed-profile verifier as the optional resource-token factory. Missing/non-function verification or any result other than literal true rejects before store, provider, resource-link or secret-manager calls. Actual canonical registry, admin/lifecycle serialization and resumable cleanup adapters remain required and unqualified.\n\nPROPOSED_NOT_ADMITTED private development resource authority: optional canonical AuthOS resource JWT/workload profiles; exact <=300-second TTL and registered resource/claim validation; durable scoped OSINT receipts preserve SAME active decisionRef and terminal expiry/revocation. Existing defaults and production RP catalog remain unchanged. Real adoption, security review, TLS/registration, canonical lifecycle/obligation/evidence adapters, migration admission and runtime qualification are required before enablement. Product entitlement is not an OSINT effect grant. No issuer, key, token, grant or database has been created or verified by this source preparation.\n\nThe proposed development composition adds a current canonical reviewed-profile registry verifier and serialized workload registration journal recipe. The recipe resumes persisted safe phases, verifies actual native client/resource configuration and quarantines orphan clients. It requires a genuine privileged provider/store adapter, secret manager, serialized durable journal and atomic canonical registration completion. These source helpers do not approve a security review, create trust or enable the issuer. Adoption and runtime admission remain required.\n\nPure binding checks for host adapters ship through `./server` (and the root\nbarrel), still PROPOSED_NOT_ADMITTED and side-effect free:\n`assertNativeAccessTokenClaimsBindingV1`/`nativeIssuanceNotBeforeV1` (single\nlane resource, scope subset, unchanged identity, exact workload metadata, one\nsafe DB clock row); the `dev-registration-binding` checks behind\n`SerializedDevRegistrationAdminV1` (client_credentials-only creation, resource\nand lookup binding, the 4096-client inventory bound, exact native client and\ncurrent reviewed resource/link); and `admitApprovedDevSecurityReviewV1` with the\ndatabase-system and installer-window assertions (canonical JSON that rejects\nrather than omits non-JSON content, approved SHA-256 and profile digest\nbinding). Hosts keep the SQL, locks, roles and DB clock reads.\n\nThe app custody adapter can complete a fresh registration after checking immutable\nGCP-version bytes against the genuine one-time native client secret. Persisted\nresume currently quarantines: a nonempty version alone cannot prove the native\ncredential still matches. A genuine provider verification context is required\nbefore enabling recovery. Native policy/key callbacks commit their read\ntransactions before issuance completes, so actual issuance/revocation concurrency\nremains an explicit qualification requirement.\n\n## Proposed local disposable custody\n\nLocal disposable custody successor: an additive V2 whole-review arm admits only\nthe genuine Windows DPAPI CurrentUser provider, exact owner SID/owner-only ACL,\nlocal namespace/root and immutable pairwise/issuer ciphertext digests. V1 review\nsyntax and generic SecretProvider interface remain unchanged. Only explicit\nlocal-disposable host composition admits the factory-branded provider; native\nsigning, reserved claims, canonical SQL locks/policies and revocation remain.\nThis source proposal is unapproved and unqualified. Source/runtime/security\nadmission, actual DB/TLS/native key installation and mandatory real issuance,\nrevocation/custody/cleanup acceptance remain required. No cloud backend is\nimpersonated, production admission introduced, keys generated or review installed.\n","sourcePath":"packages/integrations/authos-better-auth/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/README.md","blobSha":"d6f6a0e6ef3a3ed51cd8126ab34a7414c8af971b","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"identity-and-access","areaTitle":"Identity, access and subject context","displayName":"integration.authos-better-auth","runtimes":["node"],"platforms":["browser","react-native","server"],"kind":"integration","scope":"Package manifest","canonicalRoute":"/docs/packages/integration.authos-better-auth/","contextUrl":"/docs/packages/integration.authos-better-auth.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}