# @lssm-tech/integration.authos-better-auth

Better Auth bridge that maps AuthOS contracts to provider configuration, plugins, and redacted events.

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `2.1.4`
- Package path: `packages/integrations/authos-better-auth`
- Manifest path: `packages/integrations/authos-better-auth/package.json`
- Manifest Git blob: `1a1a7bad5eff1becf6390652f6f832c8e04dd34b`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/integration.authos-better-auth](https://lssm.co/docs/packages/integration.authos-better-auth/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.authos-better-auth.txt)

## Package metadata

```json
{
  "layer": "integrations",
  "physicalArea": null,
  "primaryArea": "identity-and-access",
  "classification": {
    "privateDeclared": null,
    "catalogFamily": "integrations",
    "catalogKind": "integration",
    "catalogStatus": "active",
    "adoptionMode": "adoptable",
    "stability": "experimental"
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: not declared; publication is not verified.

Primary area: [Identity, access and subject context](https://lssm.co/docs/areas/identity-and-access/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "packages/integrations/authos-better-auth/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/README.md",
  "blobSha": "d6f6a0e6ef3a3ed51cd8126ab34a7414c8af971b",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# `@lssm-tech/integration.authos-better-auth`

Better Auth bridge for AuthOS Broad V0.

The web bridge preserves legacy `signIn.oauth2({ providerId })` and
`oauth2.link({ providerId })` callers through Better Auth 1.7's supported
`signIn.social`/`linkSocial` endpoints. It no longer imports the removed
`genericOAuthClient`. Provider callback registration/schema migration remains
a separate host rollout requirement.

This package turns AuthOS contracts into Better Auth configuration and maps Better Auth-like user/session/events back to AuthOS contracts. Canonical models stay in `@lssm-tech/lib.authos-spec`; pure projections and security gates stay in `@lssm-tech/lib.authos-runtime`.

`advanced.cookiePrefix` passes the host-selected namespace to Better Auth. Preview
hosts can combine a distinct prefix with secure cookies and disabled cross-subdomain
cookies. This separates cookie names and host scope; data/secret isolation must still
be provisioned and verified independently.

## Maturity

- Core email/password, magic link, email OTP, organization/team, admin, OAuth/OIDC client, MFA, and WebAuthn passkeys are runtime-backed through Better Auth (passkeys live-verified on Managed CompanyOS 2026-08-14).
- The bridge can also wire the `phoneNumber` and `oneTap` plugins, but no LSSM deployment enables them or has live-verified them: Managed CompanyOS does not list them in `companyOsEnabledPlugins`, and the generic `authOsV0Fixture` marks phone OTP/verification and one-tap `fixture-backed`. Phone OTP also needs a host `sendPhoneOtp` delivery callback.
- Connect with LSSM / LSSM-as-IdP (`@better-auth/oauth-provider`) stays `contract-only` for Managed CompanyOS until `enableLssmIdp` and a security review reference are configured.
- Built-in social login is typed for Google, Microsoft, LinkedIn, TikTok, Facebook, and GitHub. Hosts may retain `genericOAuth` for additional providers.
- Generic OIDC hosts can opt into `profileNameFallback: "email"` for legacy
  identities without a display name. The bridge reuses the provider email
  verbatim and never infers a human name.
- Invite-only hosts set `disableSignUp`; verified-email providers may resolve an existing verified identity, while TikTok and missing-email LinkedIn/Facebook identities require an explicit authenticated account link.
- Passkeys use the matching `@better-auth/passkey` server and browser plugins. Hosts must apply the provider's `passkey` table migration before enabling enrollment.
- SSO and SCIM remain declared external plugin capabilities until their production package wiring is separately reviewed.
- LSSM-as-IdP uses the supported `@better-auth/oauth-provider` OAuth 2.1/OIDC
  runtime, with dynamic registration disabled, PKCE/S256 provider defaults,
  pairwise subject derivation, asymmetric JWT/JWKS support, explicit
  login/consent routes, and resource audiences. It remains contract-only unless
  `securityReviewRef` and a server-only pairwise secret are present and
  production enablement is explicitly gated.
- IdP hosts may supply a product-access policy. Without one, post-login always
  redirects to the configured access boundary. Reviewed hosts can publish
  explicit product scopes, bind consent to an entitlement reference, and emit
  only coarse application/tier/entitlement claims after the host confirms
  active access.
- Product membership handoffs expose a bounded, bearer-authenticated internal
  handler. It accepts only an RP-specific pairwise subject and idempotent
  provisioning scope; canonical identity IDs, local role authority, and secret
  material are excluded from its contracts and replay evidence.
- `./relying-party-reconciliation` prepares the exact catalog-owned Better Auth
  OAuth client record for an operator-controlled host reconciliation. It hashes
  the confidential client secret with the provider's SHA-256/base64url format,
  keeps dynamic registration disabled, and exposes only a secret-free
  configuration digest and evidence reference.

## Referral and affiliate handoff

`attribution` configuration composes with an existing Better Auth
`databaseHooks.user.create.after` hook. When a host resolves a valid signed
acquisition token, the bridge calls `onIdentityCreated` after email/password or
OAuth identity creation. The callback receives the opaque token and classified
flow; the bridge does not persist, decode, or emit the token.

## Native bearer sessions

`./native-session-client` exposes a storage-port-driven Better Auth client for
Expo, Tauri, and other trusted native shells. Email/password and TOTP flows
capture `set-auth-token` and the bounded `set-mfa-authority` projection, while
the host-supplied vault keeps both values device-only. Credentials are sent only
in JSON request bodies to the configured AuthOS origin and never enter URLs,
logs, events, or replay evidence.

## Entry points: server and client

- `./server` is the server-only surface: `createBetterAuthInstance`,
  `buildBetterAuthOptions`, database hooks, OAuth provider discovery,
  resource-token policy and the development registration helpers. Its source
  file uses the `.server.ts` suffix, so the package boundary check fails any
  client (`'use client'` / `.client.ts`) graph that reaches it.
- `./client` (`createAuthClient`, `createBetterAuthBridgeClient`) and
  `./native-session-client` are the browser and native clients; `./bridge-plan`
  and `./edge-cookie` are pure and safe in any runtime.
- The root entry stays a compatibility barrel that re-exports `./server` plus
  both clients. Server hosts may keep importing it; client code must use the
  explicit client entries.

## Verification

```bash
bun run lint:check
bun run typecheck
bun run test
bun run build
```


## Pure bridge-plan inspection

Use `@lssm-tech/integration.authos-better-auth/bridge-plan` for browser/native inspection of provider plugin plans. It retains `buildBetterAuthBridgePlan` behavior without importing Better Auth server initialization, database adapters or Next.js cookie integration. The existing root/config exports remain compatible for server consumers. Native preview imports must use this pure entry point; a build-boundary test guards against server code re-entering the graph.

## Better Auth 1.7 client compatibility

The shared bridge no longer imports the removed `genericOAuthClient` plugin.
Existing `signIn.oauth2({ providerId, ...options })` and
`oauth2.link({ providerId, ...options })` bridge calls are retained as adapters to
Better Auth's supported `signIn.social` and `linkSocial` methods. They translate
`providerId` to `provider`, preserve request options and return provider errors.
Other dynamic client methods retain their original behavior.

This client repair does not migrate provider registrations, callback forwarding
routes, native clients built directly on Better Auth, or account identity data.
Review those separately using the
[Better Auth 1.7 upgrade guide](https://better-auth.com/docs/guides/1-7-upgrade-guide)
before qualifying live OAuth. No production identity records were changed.

### Server-side bearer session reads

`createBetterAuthBearerSessionReader` resolves a bearer through the configured
AuthOS `/api/auth/get-session?disableCookieCache=true` endpoint and maps it to the
canonical `AuthOsSession`. It requires HTTPS except loopback development, forbids
redirects, bounds time/body size, and rejects expired, banned or mismatched user
sessions. Tokens, email and role strings are not returned. This is authentication
only: callers must separately resolve current tenant-scoped permissions and must
not infer fleet-management access from the identity or provider role.


## Proposed reviewed development resource authority

Both development registration recipes require the same canonical reviewed-profile verifier as the optional resource-token factory. Missing/non-function verification or any result other than literal true rejects before store, provider, resource-link or secret-manager calls. Actual canonical registry, admin/lifecycle serialization and resumable cleanup adapters remain required and unqualified.

PROPOSED_NOT_ADMITTED private development resource authority: optional canonical AuthOS resource JWT/workload profiles; exact <=300-second TTL and registered resource/claim validation; durable scoped OSINT receipts preserve SAME active decisionRef and terminal expiry/revocation. Existing defaults and production RP catalog remain unchanged. Real adoption, security review, TLS/registration, canonical lifecycle/obligation/evidence adapters, migration admission and runtime qualification are required before enablement. Product entitlement is not an OSINT effect grant. No issuer, key, token, grant or database has been created or verified by this source preparation.

The proposed development composition adds a current canonical reviewed-profile registry verifier and serialized workload registration journal recipe. The recipe resumes persisted safe phases, verifies actual native client/resource configuration and quarantines orphan clients. It requires a genuine privileged provider/store adapter, secret manager, serialized durable journal and atomic canonical registration completion. These source helpers do not approve a security review, create trust or enable the issuer. Adoption and runtime admission remain required.

Pure binding checks for host adapters ship through `./server` (and the root
barrel), still PROPOSED_NOT_ADMITTED and side-effect free:
`assertNativeAccessTokenClaimsBindingV1`/`nativeIssuanceNotBeforeV1` (single
lane resource, scope subset, unchanged identity, exact workload metadata, one
safe DB clock row); the `dev-registration-binding` checks behind
`SerializedDevRegistrationAdminV1` (client_credentials-only creation, resource
and lookup binding, the 4096-client inventory bound, exact native client and
current reviewed resource/link); and `admitApprovedDevSecurityReviewV1` with the
database-system and installer-window assertions (canonical JSON that rejects
rather than omits non-JSON content, approved SHA-256 and profile digest
binding). Hosts keep the SQL, locks, roles and DB clock reads.

The app custody adapter can complete a fresh registration after checking immutable
GCP-version bytes against the genuine one-time native client secret. Persisted
resume currently quarantines: a nonempty version alone cannot prove the native
credential still matches. A genuine provider verification context is required
before enabling recovery. Native policy/key callbacks commit their read
transactions before issuance completes, so actual issuance/revocation concurrency
remains an explicit qualification requirement.

## Proposed local disposable custody

Local disposable custody successor: an additive V2 whole-review arm admits only
the genuine Windows DPAPI CurrentUser provider, exact owner SID/owner-only ACL,
local namespace/root and immutable pairwise/issuer ciphertext digests. V1 review
syntax and generic SecretProvider interface remain unchanged. Only explicit
local-disposable host composition admits the factory-branded provider; native
signing, reserved claims, canonical SQL locks/policies and revocation remain.
This source proposal is unapproved and unqualified. Source/runtime/security
admission, actual DB/TLS/native key installation and mandatory real issuance,
revocation/custody/cleanup acceptance remain required. No cloud backend is
impersonated, production admission introduced, keys generated or review installed.


## Declared capabilities

### Integration Authos Better Auth

Capability ID: `package.lssm.tech.integration.authos.better.auth`

Better Auth bridge that maps AuthOS contracts to provider configuration, plugins, and redacted events.

Use cases:

- Adopt better auth bridge that maps authos contracts to provider configuration, plugins, and redacted events

Constraints:

```json
{
  "platforms": [
    "browser",
    "react-native",
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "avoidWhen": [
    "The @lssm-tech/integration.authos-better-auth package constraints do not match the target runtime or platform."
  ],
  "requires": [
    "TypeScript"
  ]
}
```

Other capability declarations:

```json
{
  "status": "active",
  "aliases": [
    "contractspec",
    "authos",
    "better-auth",
    "identity",
    "integration",
    "better",
    "auth"
  ],
  "pythonEquivalents": [],
  "alternatives": [],
  "relationships": [],
  "resolutionPriority": 50
}
```

Capability imports:

```json
[
  {
    "from": "@lssm-tech/integration.authos-better-auth",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/attribution-hooks",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/canonical-email-adapter",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/client",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/companyos-spec",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/config",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/cookie-options",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/edge-cookie",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/email-callbacks",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/mapper",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/native-session-client",
    "symbols": [
      "createNativeAuthSessionClient"
    ]
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/plugin-metadata",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/product-membership-handler",
    "symbols": []
  },
  {
    "from": "@lssm-tech/integration.authos-better-auth/server",
    "symbols": [
      "createBetterAuthInstance",
      "buildBetterAuthOptions"
    ]
  }
]
```

## Catalogue metadata

```json
{
  "family": "integrations",
  "kind": "integration",
  "status": "active",
  "adoptionMode": "adoptable",
  "stability": "experimental",
  "platforms": [
    "browser",
    "react-native",
    "server"
  ],
  "runtimes": [
    "node"
  ],
  "entrypoints": [
    ".",
    "./attribution-hooks",
    "./canonical-email-adapter",
    "./client",
    "./companyos-spec",
    "./config",
    "./cookie-options",
    "./edge-cookie",
    "./email-callbacks",
    "./mapper",
    "./native-session-client",
    "./plugin-metadata",
    "./product-membership-handler",
    "./pairwise-subject",
    "./provider-metadata",
    "./server",
    "./types"
  ],
  "examples": [],
  "replacements": []
}
```

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/attribution-hooks",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/canonical-email-adapter",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/client",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/companyos-spec",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/config",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/cookie-options",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/edge-cookie",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/email-callbacks",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/mapper",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/native-session-client",
    "symbols": [
      "createNativeAuthSessionClient"
    ]
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/plugin-metadata",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/product-membership-handler",
    "symbols": []
  },
  {
    "capabilityId": "package.lssm.tech.integration.authos.better.auth",
    "from": "@lssm-tech/integration.authos-better-auth/server",
    "symbols": [
      "createBetterAuthInstance",
      "buildBetterAuthOptions"
    ]
  }
]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/integration.authos-better-auth` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/index.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/attribution-hooks` — subpath `./attribution-hooks`
  - `unconditional`: `./src/attribution-hooks.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/attribution-hooks.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/bearer-session-reader` — subpath `./bearer-session-reader`
  - `unconditional`: `./src/bearer-session-reader.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/bearer-session-reader.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/bridge-plan` — subpath `./bridge-plan`
  - `unconditional`: `./src/bridge-plan.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/bridge-plan.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/canonical-email-adapter` — subpath `./canonical-email-adapter`
  - `unconditional`: `./src/canonical-email-adapter.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/canonical-email-adapter.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/client` — subpath `./client`
  - `unconditional`: `./src/client.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/client.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/companyos-spec` — subpath `./companyos-spec`
  - `unconditional`: `./src/companyos-spec.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/companyos-spec.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/config` — subpath `./config`
  - `unconditional`: `./src/config.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/config.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/cookie-options` — subpath `./cookie-options`
  - `unconditional`: `./src/cookie-options.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/cookie-options.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/edge-cookie` — subpath `./edge-cookie`
  - `unconditional`: `./src/edge-cookie.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/edge-cookie.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/email-callbacks` — subpath `./email-callbacks`
  - `unconditional`: `./src/email-callbacks.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/email-callbacks.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/generic-oauth-client-compat` — subpath `./generic-oauth-client-compat`
  - `unconditional`: `./src/generic-oauth-client-compat.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/generic-oauth-client-compat.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/mapper` — subpath `./mapper`
  - `unconditional`: `./src/mapper.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/mapper.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/native-session-client` — subpath `./native-session-client`
  - `unconditional`: `./src/native-session-client.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/native-session-client.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/pairwise-subject` — subpath `./pairwise-subject`
  - `unconditional`: `./src/pairwise-subject.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/pairwise-subject.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/plugin-metadata` — subpath `./plugin-metadata`
  - `unconditional`: `./src/plugin-metadata.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/plugin-metadata.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/product-membership-handler` — subpath `./product-membership-handler`
  - `unconditional`: `./src/product-membership-handler.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/product-membership-handler.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/provider-metadata` — subpath `./provider-metadata`
  - `unconditional`: `./src/provider-metadata.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/provider-metadata.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/relying-party-reconciliation` — subpath `./relying-party-reconciliation`
  - `unconditional`: `./src/relying-party-reconciliation.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/relying-party-reconciliation.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/server` — subpath `./server`
  - `unconditional`: `./src/better-auth.server.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/better-auth.server.ts); verified source file.

- `@lssm-tech/integration.authos-better-auth/types` — subpath `./types`
  - `unconditional`: `./src/types.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/integrations/authos-better-auth/src/types.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": "./dist/index.d.ts",
  "files": [
    "dist",
    "README.md"
  ],
  "publishExports": {
    ".": {
      "types": "./dist/index.d.ts",
      "bun": "./dist/index.js",
      "node": "./dist/node/index.js",
      "default": "./dist/index.js"
    },
    "./attribution-hooks": {
      "types": "./dist/attribution-hooks.d.ts",
      "bun": "./dist/attribution-hooks.js",
      "node": "./dist/node/attribution-hooks.js",
      "default": "./dist/attribution-hooks.js"
    },
    "./bearer-session-reader": {
      "types": "./dist/bearer-session-reader.d.ts",
      "bun": "./dist/bearer-session-reader.js",
      "node": "./dist/node/bearer-session-reader.js",
      "default": "./dist/bearer-session-reader.js"
    },
    "./bridge-plan": {
      "types": "./dist/bridge-plan.d.ts",
      "bun": "./dist/bridge-plan.js",
      "node": "./dist/node/bridge-plan.js",
      "default": "./dist/bridge-plan.js"
    },
    "./canonical-email-adapter": {
      "types": "./dist/canonical-email-adapter.d.ts",
      "bun": "./dist/canonical-email-adapter.js",
      "node": "./dist/node/canonical-email-adapter.js",
      "default": "./dist/canonical-email-adapter.js"
    },
    "./client": {
      "types": "./dist/client.d.ts",
      "bun": "./dist/client.js",
      "node": "./dist/node/client.js",
      "default": "./dist/client.js"
    },
    "./companyos-spec": {
      "types": "./dist/companyos-spec.d.ts",
      "bun": "./dist/companyos-spec.js",
      "node": "./dist/node/companyos-spec.js",
      "default": "./dist/companyos-spec.js"
    },
    "./config": {
      "types": "./dist/config.d.ts",
      "bun": "./dist/config.js",
      "node": "./dist/node/config.js",
      "default": "./dist/config.js"
    },
    "./cookie-options": {
      "types": "./dist/cookie-options.d.ts",
      "bun": "./dist/cookie-options.js",
      "node": "./dist/node/cookie-options.js",
      "default": "./dist/cookie-options.js"
    },
    "./edge-cookie": {
      "types": "./dist/edge-cookie.d.ts",
      "bun": "./dist/edge-cookie.js",
      "node": "./dist/node/edge-cookie.js",
      "default": "./dist/edge-cookie.js"
    },
    "./email-callbacks": {
      "types": "./dist/email-callbacks.d.ts",
      "bun": "./dist/email-callbacks.js",
      "node": "./dist/node/email-callbacks.js",
      "default": "./dist/email-callbacks.js"
    },
    "./generic-oauth-client-compat": {
      "types": "./dist/generic-oauth-client-compat.d.ts",
      "bun": "./dist/generic-oauth-client-compat.js",
      "node": "./dist/node/generic-oauth-client-compat.js",
      "default": "./dist/generic-oauth-client-compat.js"
    },
    "./mapper": {
      "types": "./dist/mapper.d.ts",
      "bun": "./dist/mapper.js",
      "node": "./dist/node/mapper.js",
      "default": "./dist/mapper.js"
    },
    "./native-session-client": {
      "types": "./dist/native-session-client.d.ts",
      "bun": "./dist/native-session-client.js",
      "node": "./dist/node/native-session-client.js",
      "default": "./dist/native-session-client.js"
    },
    "./pairwise-subject": {
      "types": "./dist/pairwise-subject.d.ts",
      "bun": "./dist/pairwise-subject.js",
      "node": "./dist/node/pairwise-subject.js",
      "default": "./dist/pairwise-subject.js"
    },
    "./plugin-metadata": {
      "types": "./dist/plugin-metadata.d.ts",
      "bun": "./dist/plugin-metadata.js",
      "node": "./dist/node/plugin-metadata.js",
      "default": "./dist/plugin-metadata.js"
    },
    "./product-membership-handler": {
      "types": "./dist/product-membership-handler.d.ts",
      "bun": "./dist/product-membership-handler.js",
      "node": "./dist/node/product-membership-handler.js",
      "default": "./dist/product-membership-handler.js"
    },
    "./provider-metadata": {
      "types": "./dist/provider-metadata.d.ts",
      "bun": "./dist/provider-metadata.js",
      "node": "./dist/node/provider-metadata.js",
      "default": "./dist/provider-metadata.js"
    },
    "./relying-party-reconciliation": {
      "types": "./dist/relying-party-reconciliation.d.ts",
      "bun": "./dist/relying-party-reconciliation.js",
      "node": "./dist/node/relying-party-reconciliation.js",
      "default": "./dist/relying-party-reconciliation.js"
    },
    "./server": {
      "types": "./dist/better-auth.server.d.ts",
      "bun": "./dist/better-auth.server.js",
      "node": "./dist/node/better-auth.server.js",
      "default": "./dist/better-auth.server.js"
    },
    "./types": {
      "types": "./dist/types.d.ts",
      "bun": "./dist/types.js",
      "node": "./dist/node/types.js",
      "default": "./dist/types.js"
    }
  }
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- `@better-auth/core`: `1.7.5`
- `@better-auth/oauth-provider`: `1.7.5`
- `@better-auth/passkey`: `1.7.5`
- `@better-auth/sso`: `1.7.5`
- [@lssm-tech/lib.authos-runtime](https://lssm.co/docs/packages/lib.authos-runtime/): `workspace:^`
- [@lssm-tech/lib.authos-spec](https://lssm.co/docs/packages/lib.authos-spec/): `workspace:^`
- `better-auth`: `1.7.5`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.bun](https://lssm.co/docs/packages/tool.bun/): `workspace:*`
- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "publish:pkg": "bun publish --tolerate-republish --ignore-scripts --verbose",
  "publish:pkg:canary": "bun publish:pkg --tag canary",
  "build": "contractspec-bun-build build",
  "build:bundle": "contractspec-bun-build transpile",
  "build:types": "contractspec-bun-build types",
  "dev": "contractspec-bun-build dev",
  "clean": "rimraf dist .turbo",
  "lint": "bun lint:fix",
  "lint:fix": "node ../../../scripts/biome.cjs check --write .",
  "lint:check": "node ../../../scripts/biome.cjs check .",
  "test": "bun test",
  "prebuild": "contractspec-bun-build prebuild",
  "typecheck": "tsgo --noEmit"
}
```

## Declared documentation links

- [Integration Authos Better Auth documentation](https://www.npmjs.com/package/%40lssm-tech%2Fintegration.authos-better-auth) — declared link; destination not verified.

```json
{
  "url": "https://www.npmjs.com/package/%40lssm-tech%2Fintegration.authos-better-auth",
  "kind": "readme"
}
```

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/integration.authos-better-auth.txt",
  "route": "/llms/integration.authos-better-auth",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/integration.authos-better-auth.txt",
  "blobSha": "d6f6a0e6ef3a3ed51cd8126ab34a7414c8af971b",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```