feat(auth): add onOrganizationCreated seam for host org-create side effects

better-auth's organization-plugin models (organization/member) do NOT fire
core databaseHooks, so a host stack had no server-side seam to run side
effects when a user creates a 2nd+ organization. Add an optional
onOrganizationCreated config callback, invoked from the org plugin's
afterCreateOrganization hook with { organizationId, userId, name, slug }.
Failure-isolated (org creation is never rolled back).

The cloud control plane uses this to uphold its born-with-environment
invariant: every organization, not just the signup/personal org, is born
with its production environment. Without it a user-created org landed
env-less and unusable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -165,6 +165,21 @@ export interface AuthManagerOptions extends Partial<AuthConfig> {
    */
   dataEngine?: IDataEngine;
 
+  /**
+   * Optional callback invoked AFTER an organization is created via better-auth's
+   * `createOrganization` (the org-plugin `afterCreateOrganization` hook). Lets a
+   * host stack run org-creation side effects that core `databaseHooks` can't —
+   * better-auth's org-plugin models (`organization`/`member`) do NOT fire those.
+   * The cloud control plane uses it to provision an org's born-with production
+   * environment. Failure-isolated: org creation is never rolled back.
+   */
+  onOrganizationCreated?: (data: {
+    organizationId: string;
+    userId?: string;
+    name?: string;
+    slug?: string;
+  }) => void | Promise<void>;
+
   /**
    * Base path for auth routes
    * Forwarded to better-auth's basePath option so it can match incoming
@@ -741,6 +756,25 @@ export class AuthManager {
               });
             }
           },
+          // Run host-provided org-creation side effects (e.g. the cloud control
+          // plane provisions the org's born-with production environment). The
+          // org-plugin's models don't fire core databaseHooks, so this is the
+          // only server-side seam for "every org is born with its prod env".
+          // Failure-isolated: org creation must not roll back on a side-effect miss.
+          afterCreateOrganization: async ({ organization, member, user }: any) => {
+            const cb = this.config.onOrganizationCreated;
+            if (typeof cb !== 'function') return;
+            try {
+              await cb({
+                organizationId: organization?.id,
+                userId: user?.id ?? member?.userId,
+                name: organization?.name,
+                slug: organization?.slug,
+              });
+            } catch (err: any) {
+              console.warn('[auth] onOrganizationCreated callback failed:', err?.message ?? String(err));
+            }
+          },
           beforeUpdateOrganization: async ({ organization, member }: any) => {
             const newSlug = organization?.slug;
             const orgId = member?.organizationId;