@better-auth/core 1.6.23 → 1.6.25

package/dist/social-providers/tiktok.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/tiktok.d.ts
 /**
  * [More info](https://developers.tiktok.com/doc/tiktok-api-v2-get-user-info/)
@@ -51,7 +52,8 @@ interface TiktokProfile extends Record<string, any> {
        *
        * To return this field, add `fields=username` in the user profile request's query parameter.
        */
-      username: string; /** @note Email is currently unsupported by TikTok  */
+      username: string;
+      /** @note Email is currently unsupported by TikTok  */
       email?: string | undefined;
       /**
        * User's bio description if there is a valid one.
@@ -121,11 +123,7 @@ interface TiktokOptions extends ProviderOptions {
 declare const tiktok: (options: TiktokOptions) => {
   id: "tiktok";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -133,10 +131,7 @@ declare const tiktok: (options: TiktokOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): URL;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;

package/dist/social-providers/twitch.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/twitch.d.ts
 /**
  * @see https://dev.twitch.tv/docs/authentication/getting-tokens-oidc/#requesting-claims
@@ -32,11 +33,7 @@ interface TwitchOptions extends ProviderOptions<TwitchProfile> {
 declare const twitch: (options: TwitchOptions) => {
   id: "twitch";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -44,10 +41,7 @@ declare const twitch: (options: TwitchOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;

package/dist/social-providers/twitter.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/twitter.d.ts
 interface TwitterProfile {
   data: {
@@ -6,9 +7,12 @@ interface TwitterProfile {
      * Unique identifier of this user. This is returned as a string in order to avoid complications with languages and tools
      * that cannot handle large integers.
      */
-    id: string; /** The friendly name of this user, as shown on their profile. */
-    name: string; /** The email address of this user. */
-    email?: string | undefined; /** The Twitter handle (screen name) of this user. */
+    id: string;
+    /** The friendly name of this user, as shown on their profile. */
+    name: string;
+    /** The email address of this user. */
+    email?: string | undefined;
+    /** The Twitter handle (screen name) of this user. */
     username: string;
     /**
      * The location specified in the user's profile, if the user provided one.
@@ -23,15 +27,23 @@ interface TwitterProfile {
      *To return this field, add `user.fields=entities` in the authorization request's query parameter.
      */
     entities?: {
-      /** Contains details about the user's profile website. */url: {
-        /** Contains details about the user's profile website. */urls: Array<{
-          /** The start position (zero-based) of the recognized user's profile website. All start indices are inclusive. */start: number; /** The end position (zero-based) of the recognized user's profile website. This end index is exclusive. */
-          end: number; /** The URL in the format entered by the user. */
-          url: string; /** The fully resolved URL. */
-          expanded_url: string; /** The URL as displayed in the user's profile. */
+      /** Contains details about the user's profile website. */
+      url: {
+        /** Contains details about the user's profile website. */
+        urls: Array<{
+          /** The start position (zero-based) of the recognized user's profile website. All start indices are inclusive. */
+          start: number;
+          /** The end position (zero-based) of the recognized user's profile website. This end index is exclusive. */
+          end: number;
+          /** The URL in the format entered by the user. */
+          url: string;
+          /** The fully resolved URL. */
+          expanded_url: string;
+          /** The URL as displayed in the user's profile. */
           display_url: string;
         }>;
-      }; /** Contains details about URLs, Hashtags, Cashtags, or mentions located within a user's description. */
+      };
+      /** Contains details about URLs, Hashtags, Cashtags, or mentions located within a user's description. */
       description: {
         hashtags: Array<{
           start: number;
@@ -57,7 +69,8 @@ interface TwitterProfile {
      *
      * To return this field, add `user.fields=url` in the authorization request's query parameter.
      */
-    url?: string | undefined; /** The URL to the profile image for this user, as shown on the user's profile. */
+    url?: string | undefined;
+    /** The URL to the profile image for this user, as shown on the user's profile. */
     profile_image_url?: string | undefined;
     protected?: boolean | undefined;
     /**
@@ -90,11 +103,7 @@ declare const twitter: (options: TwitterOption) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -103,7 +112,7 @@ declare const twitter: (options: TwitterOption) => {
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
     user?: {
-      name? /** The start position (zero-based) of the recognized user's profile website. All start indices are inclusive. */: {
+      name?: {
         firstName?: string;
         lastName?: string;
       };

package/dist/social-providers/vercel.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/vercel.d.ts
 interface VercelProfile {
   sub: string;
@@ -14,12 +15,7 @@ interface VercelOptions extends ProviderOptions<VercelProfile> {
 declare const vercel: (options: VercelOptions) => {
   id: "vercel";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -27,11 +23,7 @@ declare const vercel: (options: VercelOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;

package/dist/social-providers/vk.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/vk.d.ts
 interface VkProfile {
   user: {
@@ -20,12 +21,7 @@ interface VkOption extends ProviderOptions {
 declare const vk: (options: VkOption) => {
   id: "vk";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -33,12 +29,7 @@ declare const vk: (options: VkOption) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI,
-    deviceId
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI, deviceId }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;

package/dist/social-providers/vk.mjs

@@ -46,14 +46,13 @@ const vk = (options) => {
 		async getUserInfo(data) {
 			if (options.getUserInfo) return options.getUserInfo(data);
 			if (!data.accessToken) return null;
-			const formBody = new URLSearchParams({
-				access_token: data.accessToken,
-				client_id: options.clientId
-			}).toString();
 			const { data: profile, error } = await betterFetch("https://id.vk.com/oauth2/user_info", {
 				method: "POST",
 				headers: { "Content-Type": "application/x-www-form-urlencoded" },
-				body: formBody
+				body: new URLSearchParams({
+					access_token: data.accessToken,
+					client_id: options.clientId
+				}).toString()
 			});
 			if (error) return null;
 			const userMap = await options.mapProfileToUser?.(profile);

package/dist/social-providers/wechat.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/wechat.d.ts
 /**
  * WeChat user profile information
@@ -53,11 +54,7 @@ interface WeChatOptions extends ProviderOptions<WeChatProfile> {
 declare const wechat: (options: WeChatOptions) => {
   id: "wechat";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -65,9 +62,7 @@ declare const wechat: (options: WeChatOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): URL;
-  validateAuthorizationCode: ({
-    code
-  }: {
+  validateAuthorizationCode: ({ code }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;

package/dist/social-providers/zoom.d.mts

@@ -1,10 +1,9 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/zoom.d.ts
-type LoginType = 0 /** Facebook OAuth */ | 1 /** Google OAuth */ | 24 /** Apple OAuth */ | 27 /** Microsoft OAuth */ | 97 /** Mobile device */ | 98 /** RingCentral OAuth */ | 99 /** API user */ | 100 /** Zoom Work email */ | 101;
-/** Single Sign-On (SSO) */
+type LoginType = 0 | /** Facebook OAuth */ 1 | /** Google OAuth */ 24 | /** Apple OAuth */ 27 | /** Microsoft OAuth */ 97 | /** Mobile device */ 98 | /** RingCentral OAuth */ 99 | /** API user */ 100 | /** Zoom Work email */ 101; /** Single Sign-On (SSO) */
 type AccountStatus = "pending" | "active" | "inactive";
-type PronounOption = 1 /** Ask the user every time */ | 2 /** Always display */ | 3;
-/** Do not display */
+type PronounOption = 1 | /** Ask the user every time */ 2 | /** Always display */ 3; /** Do not display */
 interface PhoneNumber {
   /** The country code of the phone number (Example: "+1") */
   code: string;
@@ -116,11 +115,7 @@ interface ZoomOptions extends ProviderOptions<ZoomProfile> {
 declare const zoom: (userOptions: ZoomOptions) => {
   id: "zoom";
   name: string;
-  createAuthorizationURL: ({
-    state,
-    redirectURI,
-    codeVerifier
-  }: {
+  createAuthorizationURL: ({ state, redirectURI, codeVerifier }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -128,11 +123,7 @@ declare const zoom: (userOptions: ZoomOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }) => Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI,
-    codeVerifier
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI, codeVerifier }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;

package/dist/types/context.d.mts

@@ -8,11 +8,12 @@ import { Awaitable, LiteralString } from "./helper.mjs";
 import { BetterAuthPlugin } from "./plugin.mjs";
 import { BetterAuthOptions, BetterAuthRateLimitOptions } from "./init-options.mjs";
 import { Account } from "../db/schema/account.mjs";
+import "../db/index.mjs";
 import { BetterAuthCookie, BetterAuthCookies } from "./cookie.mjs";
 import { SecretConfig } from "./secret.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 import { CookieOptions, EndpointContext } from "better-call";
-
 //#region src/types/context.d.ts
 /**
  * @internal

package/dist/types/cookie.d.mts

@@ -1,5 +1,4 @@
 import { CookieOptions } from "better-call";
-
 //#region src/types/cookie.d.ts
 type BetterAuthCookie = {
   name: string;

package/dist/types/helper.d.mts

@@ -4,7 +4,7 @@ type Awaitable<T> = T | Promise<T>;
 type AwaitableFunction<T> = T | (() => Awaitable<T>);
 type LiteralString = "" | (string & Record<never, never>);
 type LiteralUnion<LiteralType, BaseType extends Primitive> = LiteralType | (BaseType & Record<never, never>);
-type Prettify<T> = { [K in keyof T]: T[K] } & {};
+type Prettify<T> = { [K in keyof T]: T[K]; } & {};
 type UnionToIntersection<U> = (U extends any ? (k: U) => void : never) extends ((k: infer I) => void) ? I : never;
 //#endregion
 export { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection };

package/dist/types/index.d.mts

@@ -6,4 +6,4 @@ import { SecretConfig } from "./secret.mjs";
 import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./plugin-client.mjs";
 import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
-export { type StandardSchemaV1$1 as StandardSchemaV1 };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1$1 as StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };

package/dist/types/init-options.d.mts

@@ -9,6 +9,7 @@ import { SocialProviderList, SocialProviders } from "../social-providers/index.m
 import { Awaitable, LiteralString, LiteralUnion } from "./helper.mjs";
 import { BetterAuthPlugin } from "./plugin.mjs";
 import { Account, BaseAccount } from "../db/schema/account.mjs";
+import "../db/index.mjs";
 import { AuthContext, GenericEndpointContext } from "./context.mjs";
 import { AuthMiddleware } from "../api/index.mjs";
 import { CookieOptions } from "better-call";
@@ -16,10 +17,9 @@ import { Database } from "bun:sqlite";
 import { DatabaseSync } from "node:sqlite";
 import { D1Database } from "@cloudflare/workers-types";
 import { Dialect, Kysely, MysqlPool, PostgresPool, SqliteDatabase } from "kysely";
-
 //#region src/types/init-options.d.ts
 type KyselyDatabaseType = "postgres" | "mysql" | "sqlite" | "mssql";
-type Optional<T> = { [P in keyof T]?: T[P] | undefined };
+type Optional<T> = { [P in keyof T]?: T[P] | undefined; };
 type StoreIdentifierOption = "plain" | "hashed" | {
   hash: (identifier: string) => Promise<string>;
 };
@@ -130,7 +130,7 @@ type BetterAuthDBOptions<ModelName extends string, Keys extends string = string>
   /**
    * Additional fields for the model
    */
-  additionalFields?: { [Key in Exclude<string, Keys | "id">]: DBFieldAttribute };
+  additionalFields?: { [Key in Exclude<string, Keys | "id">]: DBFieldAttribute; };
 };
 type BetterAuthRateLimitOptions = Optional<BetterAuthRateLimitRule> & Omit<BetterAuthDBOptions<"rateLimit", keyof BaseRateLimit>, "additionalFields"> & {
   /**
@@ -314,7 +314,7 @@ type BetterAuthAdvancedOptions = {
   /**
    * Trusted proxy headers
    *
-    * - `x-forwarded-host`
+   * - `x-forwarded-host`
    * - `x-forwarded-proto`
    *
    * If set to `true` and no `baseURL` option is provided, we will use the headers to infer the
@@ -704,15 +704,18 @@ type BetterAuthOptions = {
      * ```
      */
     customSyntheticUser?: (params: {
-      /** Core user fields: name, email, emailVerified, image, createdAt, updatedAt */coreFields: {
+      /** Core user fields: name, email, emailVerified, image, createdAt, updatedAt */
+      coreFields: {
         name: string;
         email: string;
         emailVerified: boolean;
         image: string | null;
         createdAt: Date;
         updatedAt: Date;
-      }; /** Processed additional fields from options.user.additionalFields (with defaults applied) */
-      additionalFields: Record<string, unknown>; /** Generated user ID */
+      };
+      /** Processed additional fields from options.user.additionalFields (with defaults applied) */
+      additionalFields: Record<string, unknown>;
+      /** Generated user ID */
       id: string;
     }) => Record<string, unknown>;
   } | undefined;

package/dist/types/plugin-client.d.mts

@@ -2,7 +2,6 @@ import { LiteralString } from "./helper.mjs";
 import { BetterAuthOptions } from "./init-options.mjs";
 import { BetterFetch, BetterFetchOption, BetterFetchPlugin } from "@better-fetch/fetch";
 import { Atom, WritableAtom } from "nanostores";
-
 //#region src/types/plugin-client.d.ts
 type InferableServerPlugin = {
   id?: LiteralString | undefined;
@@ -89,7 +88,6 @@ interface BetterAuthClientPlugin {
   /**
    * better-auth client options
    */
-
   options: BetterAuthClientOptions | undefined) => Record<string, any>;
   /**
    * State atoms that'll be resolved by each framework
@@ -120,4 +118,4 @@ interface BetterAuthClientPlugin {
   }>;
 }
 //#endregion
-export { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore };
+export { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore, RevalidateOptions };

package/dist/types/plugin.d.mts

@@ -2,13 +2,13 @@ import { BetterAuthPluginDBSchema } from "../db/plugin.mjs";
 import { Awaitable, LiteralString } from "./helper.mjs";
 import { RawError } from "../utils/error-codes.mjs";
 import { BetterAuthOptions } from "./init-options.mjs";
+import "../db/index.mjs";
 import { AuthContext } from "./context.mjs";
 import { AuthMiddleware } from "../api/index.mjs";
 import { Endpoint, EndpointContext, InputContext, Middleware } from "better-call";
 import { Migration } from "kysely";
-
 //#region src/types/plugin.d.ts
-type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;
+type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]>; } : T;
 type HookEndpointContext = Partial<EndpointContext<string, any> & Omit<InputContext<string, any>, "method">> & {
   path?: string;
   context: AuthContext & {

package/dist/utils/async.d.mts

@@ -1,5 +1,4 @@
 import { Awaitable } from "../types/helper.mjs";
-
 //#region src/utils/async.d.ts
 interface MapConcurrentOptions {
   /**

package/dist/utils/db.d.mts

@@ -1,4 +1,5 @@
 import { DBFieldAttribute } from "../db/type.mjs";
+import "../db/index.mjs";
 //#region src/utils/db.d.ts
 /**
  * Filters output data by removing fields with the `returned: false` attribute.

package/dist/utils/deprecate.d.mts

@@ -1,5 +1,4 @@
 import { InternalLogger } from "../env/logger.mjs";
-
 //#region src/utils/deprecate.d.ts
 /**
  * Wraps a function to log a deprecation warning at once.

package/dist/utils/error-codes.d.mts

@@ -3,11 +3,11 @@ type UpperLetter = "A" | "B" | "C" | "D" | "E" | "F" | "G" | "H" | "I" | "J" | "
 type SpecialCharacter = "_";
 type IsValidUpperSnakeCase<S extends string> = S extends `${infer F}${infer R}` ? F extends UpperLetter | SpecialCharacter ? IsValidUpperSnakeCase<R> : false : true;
 type InvalidKeyError<K extends string> = `Invalid error code key: "${K}" - must only contain uppercase letters (A-Z) and underscores (_)`;
-type ValidateErrorCodes<T> = { [K in keyof T]: K extends string ? IsValidUpperSnakeCase<K> extends false ? InvalidKeyError<K> : T[K] : T[K] };
+type ValidateErrorCodes<T> = { [K in keyof T]: K extends string ? IsValidUpperSnakeCase<K> extends false ? InvalidKeyError<K> : T[K] : T[K]; };
 type RawError<K extends string = string> = {
   readonly code: K;
   message: string;
 };
-declare function defineErrorCodes<const T extends Record<string, string>, R extends { [K in keyof T & string]: RawError<K> }>(codes: ValidateErrorCodes<T>): R;
+declare function defineErrorCodes<const T extends Record<string, string>, R extends { [K in keyof T & string]: RawError<K>; }>(codes: ValidateErrorCodes<T>): R;
 //#endregion
 export { RawError, defineErrorCodes };

package/dist/utils/host.d.mts

@@ -26,7 +26,33 @@
  * The semantic kind of a host, derived from RFC 6890 special-purpose registries
  * plus a few domain-name categories (localhost, cloud metadata FQDNs).
  */
-type HostKind = /** IPv4 `127.0.0.0/8` or IPv6 `::1`. */"loopback" /** DNS name `localhost` or RFC 6761 `.localhost` TLD. */ | "localhost" /** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */ | "unspecified" /** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */ | "private" /** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */ | "linkLocal" /** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */ | "sharedAddressSpace" /** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */ | "documentation" /** RFC 2544 `198.18.0.0/15`. */ | "benchmarking" /** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */ | "multicast" /** IPv4 limited broadcast `255.255.255.255`. */ | "broadcast" /** Other RFC 6890 special-purpose ranges (0/8, 192.0.0/24, 240/4, 2001::/32, etc.). */ | "reserved" /** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */ | "cloudMetadata" /** Any host not matching a special-purpose range above. */ | "public";
+type HostKind =
+/** IPv4 `127.0.0.0/8` or IPv6 `::1`. */
+"loopback" |
+/** DNS name `localhost` or RFC 6761 `.localhost` TLD. */
+"localhost" |
+/** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */
+"unspecified" |
+/** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */
+"private" |
+/** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */
+"linkLocal" |
+/** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */
+"sharedAddressSpace" |
+/** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */
+"documentation" |
+/** RFC 2544 `198.18.0.0/15`. */
+"benchmarking" |
+/** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */
+"multicast" |
+/** IPv4 limited broadcast `255.255.255.255`. */
+"broadcast" |
+/** Other RFC 6890 special-purpose ranges (0/8, 192.0.0/24, 240/4, 2001::/32, etc.). */
+"reserved" |
+/** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */
+"cloudMetadata" |
+/** Any host not matching a special-purpose range above. */
+"public";
 /**
  * The syntactic form of the input host: an IPv4 literal, an IPv6 literal, or
  * a domain name. IPv4-mapped IPv6 (`::ffff:192.0.2.1`) is reported as `ipv4`

package/dist/utils/host.mjs

@@ -9,7 +9,7 @@ import { isValidIP, normalizeIP } from "./ip.mjs";
 * only exists for the FQDN form that a naive server-side fetch might resolve
 * via its own resolver.
 */
-const CLOUD_METADATA_HOSTS = new Set([
+const CLOUD_METADATA_HOSTS = /* @__PURE__ */ new Set([
 	"metadata.google.internal",
 	"metadata.goog",
 	"metadata",

package/dist/utils/ip.d.mts

@@ -1,4 +1,5 @@
 import { BetterAuthOptions } from "../types/init-options.mjs";
+import "../types/index.mjs";
 //#region src/utils/ip.d.ts
 /**
  * Normalizes an IP address for consistent rate limiting.

package/dist/utils/ip.mjs

@@ -111,7 +111,7 @@ function ipToBytes(ip) {
 	const mapped = extractIPv4FromMapped(ip);
 	if (mapped) return Uint8Array.from(mapped.split(".").map((octet) => Number(octet)));
 	const groups = expandIPv6(ip);
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	for (let i = 0; i < 8; i++) {
 		const group = Number.parseInt(groups[i] ?? "0", 16);
 		bytes[i * 2] = group >> 8 & 255;

package/dist/utils/is-api-error.d.mts

@@ -1,5 +1,4 @@
 import { APIError } from "../error/index.mjs";
-
 //#region src/utils/is-api-error.d.ts
 declare function isAPIError(error: unknown): error is APIError;
 //#endregion

package/dist/utils/redirect-uri.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-
 //#region src/utils/redirect-uri.d.ts
 /**
  * Zod schema for OAuth redirect URIs and other developer-supplied URLs that the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.6.23",
+  "version": "1.6.25",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -162,7 +162,7 @@
     "jose": "^6.1.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.1.1",
-    "tsdown": "0.21.1"
+    "tsdown": "0.22.7"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",

package/src/context/request-state.ts

@@ -4,15 +4,35 @@ import { __getBetterAuthGlobal } from "./global";
 
 export type RequestStateWeakMap = WeakMap<object, any>;
 
+// Memoizes the in-flight AsyncLocalStorage initialization so concurrent
+// first-callers share a single instance instead of each constructing one.
+let asyncStorageInit: Promise<AsyncLocalStorage<RequestStateWeakMap>> | null =
+	null;
+
 const ensureAsyncStorage = async () => {
 	const betterAuthGlobal = __getBetterAuthGlobal();
-	if (!betterAuthGlobal.context.requestStateAsyncStorage) {
-		const AsyncLocalStorage = await getAsyncLocalStorage();
-		betterAuthGlobal.context.requestStateAsyncStorage =
-			new AsyncLocalStorage<RequestStateWeakMap>();
+	const existing = betterAuthGlobal.context.requestStateAsyncStorage;
+	if (existing) {
+		return existing as AsyncLocalStorage<RequestStateWeakMap>;
+	}
+	// Without memoizing the init, several concurrent callers can each pass the
+	// check above, each `await getAsyncLocalStorage()`, and each assign a fresh
+	// instance — last write wins. `runWithRequestState().run()` then executes on
+	// one instance while a nested `getCurrentRequestState()` reads the
+	// overwritten one, throwing "No request state found". This shows up
+	// intermittently on serverless cold start (e.g. Cloudflare Workers), where
+	// the first requests hit before the lazy `node:async_hooks` import settles.
+	// The idempotent `??=` keeps the global singleton stable even if multiple
+	// BetterAuth copies (Dual Module Hazard) race here.
+	if (!asyncStorageInit) {
+		asyncStorageInit = getAsyncLocalStorage().then((AsyncLocalStorage) => {
+			betterAuthGlobal.context.requestStateAsyncStorage ??=
+				new AsyncLocalStorage<RequestStateWeakMap>();
+			return betterAuthGlobal.context
+				.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
+		});
 	}
-	return betterAuthGlobal.context
-		.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
+	return asyncStorageInit;
 };
 
 export async function getRequestStateAsyncLocalStorage() {