fix(auth): make self-service "Resend Verification Email" work

[os-zhuang]

Problem

Clicking 重新发送邮件 / Resend Verification Email on a sys_user record (e.g. /_console/apps/com.objectstack.setup/sys_user/record/…) failed with:

[body.email] Invalid input: expected string, received undefined

better-auth's stock POST /send-verification-email requires { email } in the request body. But the sys_user resend_verification_email action fires with an empty body:

• the record-header button and record-section quick action declare params: [], and
• the "email unverified" record alert invokes the action via an action: { actionName } reference that cannot carry params at all.

So the request reached better-auth with no email and bounced — every resend affordance was permanently broken.

Fix

Add a thin wrapper route that shadows the native /send-verification-email (registered before the catch-all in AuthPlugin):

• when the body omits email, default it to the authenticated caller's own session email (resolved via a /get-session re-dispatch), then re-dispatch through the real route via handleRequest (which bypasses the wrapper — no recursion), so token generation, the sendVerificationEmail callback, and rate limiting all still run;
• an explicitly-supplied email (admin / verify-screen path) passes through untouched — no existing caller changes behaviour and no new user-enumeration surface is introduced.

The logic lives in a shared, exported helper runResendVerificationEmail (mirroring runSetInitialPassword / runRegisterSsoProviderFromForm) so the cloud AuthProxyPlugin mount point can adopt it and stay in lockstep.

Changes

• packages/plugins/plugin-auth/src/send-verification-email.ts — new shared helper.
• packages/plugins/plugin-auth/src/send-verification-email.test.ts — 7 unit tests (session default, explicit-email passthrough, callbackURL forwarding, no-session 400, non-JSON body, native-error passthrough, blank-email handling).
• packages/plugins/plugin-auth/src/auth-plugin.ts — register the wrapper route before the wildcard catch-all.
• packages/plugins/plugin-auth/src/index.ts — re-export the helper.
• .changeset/fix-resend-verification-email.md — patch changeset.

Testing

• pnpm vitest run in plugin-auth: 368 passed (incl. the 7 new tests).
• pnpm turbo run build --filter=@objectstack/plugin-auth: build + DTS succeed.
• eslint clean on new/modified files.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BtooAsE7ebn5Tabwijtsg8

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 10, 2026 2:10pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth.

9 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
• content/docs/getting-started/cli.mdx (via @objectstack/plugin-auth)
• content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/authentication.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/index.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/packages.mdx (via @objectstack/plugin-auth)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-auth)
• content/docs/releases/v9.mdx (via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.