@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(plugin-auth): a sign-up answers without waiting for any mail send, whether or not the address already has an account
+
+Clause-②: no
+Metadata-protocol: none
+
+- **The rule.** `POST /api/v1/auth/sign-up/email` answers without waiting for any mail send, whether or not the address already has an account: the verification mail, and the notice to an address that already has an account, are built and sent after the response, as the password-reset mail already is.
+- **A send that fails is logged on the server**, at error (`verification email was not delivered`; the notice keeps its own error line), and never reaches the caller, whose answer is the one a sent mail gets, as before.
+- **Unchanged.** The answer's status and body; the sign-up rate limits; the mails themselves; the `/send-verification-email` resend, which still awaits its send and still reports one that failed; and a server-side `auth.api.signUpEmail` call, which carries no request and still awaits its sends.
@@ -52,6 +52,7 @@
  */
 
 import type { Auth, BetterAuthOptions } from 'better-auth';
+import { tryGetCurrentAuthEndpointContext } from '@better-auth/core/context';
 import { audiencePermitsSelfRegistration } from '@objectstack/spec/system';
 import { readEnvWithDeprecation } from '@objectstack/types';
 import { readAccountInvitation, settleImportResetDelivery } from './account-invitation-marker.js';
@@ -70,6 +71,38 @@ import { PLATFORM_IDP_PROVIDER_ID, refuseImplicitAccountLink } from './implicit-
 import { isPlaceholderEmail } from './placeholder-email.js';
 import { logAfterResponseSendFailure, sendAfterResponseOnPublicDoor } from './run-after-response.js';
 
+/** The path better-auth declares for the email sign-up endpoint. */
+const SIGN_UP_EMAIL_PATH = '/sign-up/email';
+
+/**
+ * `send`, with the one call the sign-up endpoint makes handed to
+ * {@link sendAfterResponseOnPublicDoor}: a sign-up answers without waiting for
+ * any mail send, whether or not the address already has an account. Every
+ * other call is `send` itself, awaited exactly as before — the
+ * `/send-verification-email` resend among them, which reports a send that
+ * failed to its caller.
+ *
+ * The endpoint is the one better-auth runs the call inside, read by its
+ * declared path from the endpoint context (as the hooks read `ctx.path`),
+ * never from the request's URL. Outside any endpoint context the call is
+ * awaited.
+ */
+function sendAfterResponseOnSignUp<D>(
+  send: (data: D, request?: unknown) => Promise<unknown>,
+  onFailure: (error: unknown) => void,
+): (data: D, request?: unknown) => Promise<void> {
+  const afterResponse = sendAfterResponseOnPublicDoor(send, onFailure);
+  return (data, request) => {
+    let path: unknown;
+    try {
+      path = tryGetCurrentAuthEndpointContext()?.path;
+    } catch {
+      path = undefined;
+    }
+    return path === SIGN_UP_EMAIL_PATH ? afterResponse(data, request) : (send(data, request) as Promise<void>);
+  };
+}
+
 /**
  * The `AuthManager` members the function below reads — every one of them, and
  * no other. Each is typed AS the class member (an indexed access on the
@@ -505,16 +538,28 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a
       // address that already has an account answers like a success". The
       // vendor calls this only when the address already has a row AND its
       // anti-enumeration shield is on, after its timing-equalizing password
-      // hash, and awaits it inline (no background-task handler is set);
-      // what it throws is caught and logged by the vendor, and the answer is
-      // its generic success either way (better-auth 1.7.12
+      // hash; what it throws is caught and logged by the vendor, and the
+      // answer is its generic success either way (better-auth 1.7.12
       // `routes/sign-up.mjs`, re-read for #25060). So the DECISION cannot
       // live here: it is made first, in the `/sign-up/email` before-hook,
       // which keeps the explicit refusal wherever this mail could not be
       // promised. This hands over the existing row, which is what the
       // recipient's stored-locale rung needs.
-      onExistingUserSignUp: async ({ user }: { user: { id: string; email: string; name?: string | null } }) =>
-        this.sendExistingAccountSignUpNotice(user),
+      //
+      // A sign-up answers without waiting for any mail send, whether or not
+      // the address already has an account: the vendor hands this callback
+      // the request (`onExistingUserSignUp(data, request)`, the same
+      // routes/sign-up.mjs), so a call that carries one — the public door —
+      // resolves at once and the notice is built and sent after the response
+      // (`sendAfterResponseOnPublicDoor`), as the verification mail of a new
+      // address's sign-up is (`sendVerificationEmail` below). A server-side
+      // call (no request) still awaits it. The notice reports its own failed
+      // send at error level and never throws; `onFailure` logs anything else.
+      onExistingUserSignUp: sendAfterResponseOnPublicDoor(
+        async ({ user }: { user: { id: string; email: string; name?: string | null } }) =>
+          this.sendExistingAccountSignUpNotice(user),
+        (error) => logAfterResponseSendFailure(this.config.logger, 'sign-up notice email', error),
+      ),
       };
     })(),
 
@@ -530,7 +575,15 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a
         ...(this.config.emailVerification?.expiresIn != null
           ? { expiresIn: this.config.emailVerification.expiresIn } : {}),
         // #14319 — better-auth calls this as `sendVerificationEmail(data, ctx.request)`.
-        sendVerificationEmail: async ({ user, url, token }: { user: { id: string; email: string; name?: string }; url: string; token: string }, request?: unknown) => {
+        //
+        // A sign-up answers without waiting for any mail send, whether or not
+        // the address already has an account: the call the sign-up endpoint
+        // makes, carrying its request, resolves at once and the mail is built
+        // and sent after the response, as the notice to an address that
+        // already has an account is (`onExistingUserSignUp` above); its
+        // failure is logged on the server. Every other call is awaited as
+        // before (`sendAfterResponseOnSignUp`) — the resend below among them.
+        sendVerificationEmail: sendAfterResponseOnSignUp(async ({ user, url, token }: { user: { id: string; email: string; name?: string }; url: string; token: string }, request?: unknown) => {
           const email = this.getEmailService();
           if (!email) {
             // Verification is enabled (this callback only exists when it is)
@@ -579,7 +632,7 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a
               `Verification email could not be sent to ${user.email}: ${result.error ?? 'delivery failed'}`,
             );
           }
-        },
+        }, (error) => logAfterResponseSendFailure(this.config.logger, 'verification email', error)),
       },
     } : {}),
 
 
@@ -27,13 +27,23 @@
  *  - ⑤ the mail's language: the recipient's stored locale, then the
  *    deployment default — never the requester's browser language;
  *  - ⑥ a send that fails after the decision still answers the success (the
- *    accepted residual) and says so at error level.
+ *    accepted residual) and says so at error level;
+ *  - ⑦ a sign-up answers without waiting for any mail send, whether or not
+ *    the address already has an account: with `sendOnSignUp` off and on, both
+ *    kinds of address get the same answer while every send is still open, and
+ *    the mails still go out after the response; a verification send that fails
+ *    is logged on the server and answered like one that is sent; the
+ *    server-side sign-up call (no `Request`) still awaits its sends, and the
+ *    `/send-verification-email` resend still reports a send that failed.
+ *
+ * The mail of ①, ⑤ and ⑥ is sent after the response, so those cases wait for
+ * it to arrive before reading it.
  *
  * Real engine for the same reason the sibling file gives: the uniqueness probe
  * and the row the vendor finds both live below any double.
  */
 
-import { describe, it, expect, afterEach } from 'vitest';
+import { describe, it, expect, afterEach, vi } from 'vitest';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { AuthManager } from './auth-manager.js';
@@ -246,7 +256,7 @@ describe('[#25060] ① an existing address gets the success shape plus the mail'
       const fresh = await signUp(manager, 'dave@corp.example');
       expect(fresh.status, `a new registrant was refused: ${await fresh.clone().text()}`).toBeLessThan(300);
       const freshShape = await shapeOf(fresh);
-      expect(email.sent.map((s) => s.template)).toEqual(['auth.verify_email']);
+      await vi.waitFor(() => expect(email.sent.map((s) => s.template)).toEqual(['auth.verify_email']));
       email.sent.length = 0;
       errors.length = 0;
       warnings.length = 0;
@@ -260,6 +270,10 @@ describe('[#25060] ① an existing address gets the success shape plus the mail'
       expect(existingShape.token).toBeNull();
       expect(existingShape.headerNames).not.toContain('set-cookie');
 
+      // The mail goes out after the response; everything below reads the
+      // state once it has.
+      await vi.waitFor(() => expect(email.sent).toHaveLength(1));
+
       // Nothing was written for the existing address: no row, no credential, no session.
       expect(inserts).toEqual([]);
       expect((await readAll(engine, 'sys_user')).filter((u) => u.email === EXISTING).map((u) => u.id)).toEqual(['usr_alice']);
@@ -301,7 +315,8 @@ describe('[#25060] ① an existing address gets the success shape plus the mail'
     const existing = await signUp(manager, EXISTING);
 
     expect(await shapeOf(existing)).toEqual(await shapeOf(fresh));
-    expect(email.sent.filter((s) => s.template === NOTICE).map((s) => s.to.address)).toEqual([EXISTING]);
+    await vi.waitFor(() =>
+      expect(email.sent.filter((s) => s.template === NOTICE).map((s) => s.to.address)).toEqual([EXISTING]));
   });
 });
 
@@ -330,7 +345,7 @@ describe('[#25060] ② no live transport keeps the refusal', () => {
     email.state.live = true;
     const live = await signUp(manager, EXISTING);
     expect(live.status, await live.clone().text()).toBeLessThan(300);
-    expect(email.sent.map((s) => s.template)).toEqual([NOTICE]);
+    await vi.waitFor(() => expect(email.sent.map((s) => s.template)).toEqual([NOTICE]));
     email.state.live = false;
     await expectRefused(await signUp(manager, EXISTING));
     expect(email.sent).toHaveLength(1);
@@ -391,7 +406,7 @@ describe('[#25060] ⑤ the mail is in the recipient\'s language', () => {
 
     await signUp(manager, EXISTING, { 'accept-language': 'es-ES,es;q=0.9' });
 
-    expect(email.sent.map((s) => [s.template, s.locale])).toEqual([[NOTICE, 'ja-JP']]);
+    await vi.waitFor(() => expect(email.sent.map((s) => [s.template, s.locale])).toEqual([[NOTICE, 'ja-JP']]));
   });
 
   it('with no stored locale it is the deployment default — never the requester\'s Accept-Language', async () => {
@@ -402,7 +417,8 @@ describe('[#25060] ⑤ the mail is in the recipient\'s language', () => {
 
     await signUp(manager, 'bob@corp.example', { 'accept-language': 'es-ES,es;q=0.9' });
 
-    expect(email.sent.map((s) => [s.template, s.to.address, s.locale])).toEqual([[NOTICE, 'bob@corp.example', 'zh-CN']]);
+    await vi.waitFor(() =>
+      expect(email.sent.map((s) => [s.template, s.to.address, s.locale])).toEqual([[NOTICE, 'bob@corp.example', 'zh-CN']]));
   });
 });
 
@@ -416,8 +432,139 @@ describe('[#25060] ⑥ a send that fails after the decision', () => {
     const res = await signUp(manager, EXISTING);
 
     expect(res.status, await res.clone().text()).toBeLessThan(300);
+    await vi.waitFor(() => expect(errors.filter((l) => l.includes('could NOT be sent'))).toHaveLength(1));
     expect(email.sent.map((s) => s.template)).toEqual([NOTICE]);
     const named = errors.filter((l) => l.includes('could NOT be sent'));
     expect(named, `logged: ${JSON.stringify(errors)}`).toHaveLength(1);
   });
 });
+
+describe('⑦ a sign-up answers without waiting for any mail send, whether or not the address already has an account', () => {
+  const NEW = 'dave@corp.example';
+  const VERIFY = 'auth.verify_email';
+
+  /** A promise the case settles by hand. */
+  function deferred(): { promise: Promise<void>; resolve: () => void } {
+    let resolve!: () => void;
+    const promise = new Promise<void>((r) => {
+      resolve = r;
+    });
+    return { promise, resolve };
+  }
+
+  /**
+   * A live email service whose every send waits on `gate` and then answers
+   * `status()`; it records each send it settled, as `[template, address]`.
+   */
+  function gatedEmail(gate: () => Promise<void>, status: () => 'sent' | 'failed' = () => 'sent') {
+    const settled: Array<[string, string]> = [];
+    const service = {
+      async send() { return { id: 'e', status: 'sent' }; },
+      async sendTemplate(input: any) {
+        try {
+          await gate();
+          return status() === 'failed'
+            ? { id: 'e', status: 'failed', error: 'smtp refused (simulated)' }
+            : { id: 'e', status: 'sent' };
+        } finally {
+          settled.push([input.template, input.to.address]);
+        }
+      },
+      isConfigured: () => true,
+    };
+    return { settled, service };
+  }
+
+  const sorted = (pairs: ReadonlyArray<readonly [string, string]>) => pairs.map((p) => p.join(' ')).sort();
+
+  for (const [label, sendOnSignUp, mails] of [
+    ['sendOnSignUp off', false, [[NOTICE, EXISTING]]],
+    ['sendOnSignUp on', true, [[VERIFY, NEW], [NOTICE, EXISTING]]],
+  ] as const) {
+    it(`${label}: both kinds of address get the same answer while every send is still open, and the mail still goes out`, async () => {
+      const engine = await bootEngine();
+      const open = deferred();
+      const email = gatedEmail(() => open.promise);
+      const { errors, logger } = recordingLogger();
+      const manager = makeManager(engine, email, { ...OPEN, emailVerification: { sendOnSignUp }, logger });
+
+      const forNew = await signUp(manager, NEW);
+      const forExisting = await signUp(manager, EXISTING);
+
+      expect(forNew.status, await forNew.clone().text()).toBe(200);
+      expect(await shapeOf(forExisting)).toEqual(await shapeOf(forNew));
+      // Both answers arrived while every send was still open.
+      expect(email.settled).toEqual([]);
+
+      // The control: the mail still goes out, after the response.
+      open.resolve();
+      await vi.waitFor(() => expect(sorted(email.settled)).toEqual(sorted(mails)));
+      expect(errors, `logged: ${JSON.stringify(errors)}`).toEqual([]);
+    });
+  }
+
+  it('a verification send that fails is logged on the server at error, and the sign-up answers as one whose mail is sent', async () => {
+    const failingLog = recordingLogger();
+    const failing = makeManager(await bootEngine(), gatedEmail(async () => {}, () => 'failed'), {
+      ...OPEN,
+      emailVerification: { sendOnSignUp: true },
+      logger: failingLog.logger,
+    });
+    const sending = makeManager(await bootEngine(), gatedEmail(async () => {}), {
+      ...OPEN,
+      emailVerification: { sendOnSignUp: true },
+    });
+
+    const throughFailing = await signUp(failing, NEW);
+    const throughSending = await signUp(sending, NEW);
+
+    expect(await shapeOf(throughFailing)).toEqual(await shapeOf(throughSending));
+    await vi.waitFor(() => expect(failingLog.errors).toHaveLength(1));
+    expect(failingLog.errors[0]).toContain('verification email was not delivered');
+    expect(failingLog.errors[0]).toContain('smtp refused (simulated)');
+  });
+
+  it('the server-side sign-up call (no Request) still awaits its sends', async () => {
+    const engine = await bootEngine();
+    const email = gatedEmail(() => new Promise<void>((resolve) => setImmediate(resolve)));
+    const manager = makeManager(engine, email, { ...OPEN, emailVerification: { sendOnSignUp: true } });
+    const api = (await manager.getApi()) as unknown as {
+      signUpEmail(input: { body: { email: string; password: string; name: string } }): Promise<unknown>;
+    };
+
+    await api.signUpEmail({ body: { email: NEW, password: PASSWORD, name: 'Someone' } });
+    await api.signUpEmail({ body: { email: EXISTING, password: PASSWORD, name: 'Someone' } });
+
+    expect(sorted(email.settled)).toEqual(sorted([[VERIFY, NEW], [NOTICE, EXISTING]]));
+  });
+
+  it('the /send-verification-email resend still awaits its send and reports one that failed', async () => {
+    // A deployment where a new sign-up is signed in at once, so the resend
+    // runs for the caller's own session.
+    const engine = await bootEngine();
+    let status: 'sent' | 'failed' = 'sent';
+    const email = gatedEmail(async () => {}, () => status);
+    const manager = makeManager(engine, email, { ...OPEN, emailAndPassword: { requireEmailVerification: false } });
+    const signedUp = await signUp(manager, NEW);
+    expect(signedUp.status, await signedUp.clone().text()).toBe(200);
+    const cookie = signedUp.headers.getSetCookie().map((c) => c.split(';')[0]).join('; ');
+    const resend = () =>
+      manager.handleRequest(
+        new Request(`${AUTH}/send-verification-email`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', origin: BASE, cookie },
+          body: JSON.stringify({ email: NEW }),
+        }),
+      );
+
+    const sent = await resend();
+    expect(sent.status, await sent.clone().text()).toBe(200);
+    expect(await sent.json()).toEqual({ status: true });
+    expect(email.settled).toEqual([[VERIFY, NEW]]);
+
+    status = 'failed';
+    const failed = await resend();
+    expect(failed.status, await failed.clone().text()).toBe(500);
+    expect(email.settled).toEqual([[VERIFY, NEW], [VERIFY, NEW]]);
+  });
+});