@better-auth/core 1.7.0-rc.4 → 1.7.0-rc.6

package/dist/utils/host.d.mts

@@ -26,33 +26,7 @@
  * The semantic kind of a host, derived from RFC 6890 special-purpose registries
  * plus a few domain-name categories (localhost, cloud metadata FQDNs).
  */
-type HostKind =
-/** IPv4 `127.0.0.0/8` or IPv6 `::1`. */
-"loopback" |
-/** DNS name `localhost` or RFC 6761 `.localhost` TLD. */
-"localhost" |
-/** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */
-"unspecified" |
-/** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */
-"private" |
-/** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */
-"linkLocal" |
-/** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */
-"sharedAddressSpace" |
-/** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */
-"documentation" |
-/** RFC 2544 `198.18.0.0/15`. */
-"benchmarking" |
-/** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */
-"multicast" |
-/** IPv4 limited broadcast `255.255.255.255`. */
-"broadcast" |
-/** Other RFC 6890 special-purpose ranges (0.0.0.0/8, 192.0.0.0/24, 192.88.99.0/24, 240.0.0.0/4, 2001::/32, etc.). */
-"reserved" |
-/** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */
-"cloudMetadata" |
-/** Any host not matching a special-purpose range above. */
-"public";
+type HostKind = /** IPv4 `127.0.0.0/8` or IPv6 `::1`. */"loopback" /** DNS name `localhost` or RFC 6761 `.localhost` TLD. */ | "localhost" /** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */ | "unspecified" /** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */ | "private" /** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */ | "linkLocal" /** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */ | "sharedAddressSpace" /** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */ | "documentation" /** RFC 2544 `198.18.0.0/15`. */ | "benchmarking" /** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */ | "multicast" /** IPv4 limited broadcast `255.255.255.255`. */ | "broadcast" /** Other RFC 6890 special-purpose ranges (0.0.0.0/8, 192.0.0.0/24, 192.88.99.0/24, 240.0.0.0/4, 2001::/32, etc.). */ | "reserved" /** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */ | "cloudMetadata" /** Any host not matching a special-purpose range above. */ | "public";
 /**
  * The syntactic form of the input host: an IPv4 literal, an IPv6 literal, or
  * a domain name. IPv4-mapped IPv6 (`::ffff:192.0.2.1`) is reported as `ipv4`

package/dist/utils/host.mjs

@@ -9,7 +9,7 @@ import { isValidIP, normalizeIP } from "./ip.mjs";
 * only exists for the FQDN form that a naive server-side fetch might resolve
 * via its own resolver.
 */
-const CLOUD_METADATA_HOSTS = /* @__PURE__ */ new Set([
+const CLOUD_METADATA_HOSTS = new Set([
 	"metadata.google.internal",
 	"metadata.goog",
 	"metadata",

package/dist/utils/ip.d.mts

@@ -1,5 +1,4 @@
 import { BetterAuthOptions } from "../types/init-options.mjs";
-import "../types/index.mjs";
 //#region src/utils/ip.d.ts
 /**
  * Normalizes an IP address for consistent rate limiting.

package/dist/utils/ip.mjs

@@ -111,7 +111,7 @@ function ipToBytes(ip) {
 	const mapped = extractIPv4FromMapped(ip);
 	if (mapped) return Uint8Array.from(mapped.split(".").map((octet) => Number(octet)));
 	const groups = expandIPv6(ip);
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	const bytes = new Uint8Array(16);
 	for (let i = 0; i < 8; i++) {
 		const group = Number.parseInt(groups[i] ?? "0", 16);
 		bytes[i * 2] = group >> 8 & 255;

package/dist/utils/is-api-error.d.mts

@@ -1,4 +1,5 @@
 import { APIError } from "../error/index.mjs";
+
 //#region src/utils/is-api-error.d.ts
 declare function isAPIError(error: unknown): error is APIError;
 //#endregion

package/dist/utils/redirect-uri.d.mts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+
 //#region src/utils/redirect-uri.d.ts
 /**
  * Returns whether a parsed redirect URI uses an authority-free, reverse-domain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.7.0-rc.4",
+  "version": "1.7.0-rc.6",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -166,18 +166,18 @@
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/sdk-trace-base": "^2.10.0",
     "@opentelemetry/sdk-trace-node": "^2.10.0",
-    "better-call": "1.3.7",
+    "better-call": "1.4.0",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
-    "tsdown": "0.22.7"
+    "tsdown": "0.21.10"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "@cloudflare/workers-types": ">=4",
     "@opentelemetry/api": "^1.9.0",
-    "better-call": "1.3.7",
+    "better-call": "1.4.0",
     "jose": "^6.1.0",
     "kysely": "^0.28.5 || ^0.29.0",
     "nanostores": "^1.0.1"

package/src/api/index.ts

@@ -1,6 +1,7 @@
 import type {
-	EndpointContext,
+	EndpointHandler,
 	EndpointOptions,
+	MiddlewareHandler,
 	StrictEndpoint,
 } from "better-call";
 import {
@@ -75,94 +76,93 @@ export const createAuthMiddleware = createMiddleware.create({
 	],
 });
 
-const use = [optionsMiddleware];
+const createEndpointWithAuthContext = createEndpoint.create({
+	use: [optionsMiddleware],
+});
 
-type EndpointHandler<
+type AuthEndpointHandler<
 	Path extends string,
 	Options extends EndpointOptions,
 	R,
-> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;
+> = EndpointHandler<Path, Options, R, AuthContext>;
 
-export function createAuthEndpoint<
-	Path extends string,
+type PathlessAuthEndpointHandler<
 	Options extends EndpointOptions,
 	R,
->(
-	path: Path,
-	options: Options,
-	handler: EndpointHandler<Path, Options, R>,
-): StrictEndpoint<Path, Options, R>;
+> = AuthEndpointHandler<string, Options, R>;
 
-export function createAuthEndpoint<
+function wrapEndpointHandler<
 	Path extends string,
 	Options extends EndpointOptions,
 	R,
 >(
+	handler: AuthEndpointHandler<Path, Options, R>,
 	options: Options,
-	handler: EndpointHandler<Path, Options, R>,
-): StrictEndpoint<Path, Options, R>;
-
-export function createAuthEndpoint<
-	Path extends string,
-	Opts extends EndpointOptions,
-	R,
->(
-	pathOrOptions: Path | Opts,
-	handlerOrOptions: EndpointHandler<Path, Opts, R> | Opts,
-	handlerOrNever?: any,
-) {
-	const path: Path | undefined =
-		typeof pathOrOptions === "string" ? pathOrOptions : undefined;
-	const options: Opts =
-		typeof handlerOrOptions === "object"
-			? handlerOrOptions
-			: (pathOrOptions as Opts);
-	const handler: EndpointHandler<Path, Opts, R> =
-		typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
-
-	// Endpoints that return credentials declare `metadata: { noStore: true }`.
-	// Emit the no-store headers at the boundary, before the handler runs, so they
-	// land on every response the handler produces: a success harvests
-	// `responseHeaders`, and a thrown error carries the same headers through
-	// `attachResponseHeadersToAPIError`. Validation that rejects the request
-	// before the handler runs is not covered (and returns no credentials).
+): AuthEndpointHandler<Path, Options, R> {
 	const noStore =
 		(options as { metadata?: { noStore?: boolean } }).metadata?.noStore ===
 		true;
 
-	// todo: prettify the code, we want to call `runWithEndpointContext` to top level
-	const wrapped: EndpointHandler<Path, Opts, R> = async (ctx) => {
+	return async (context) => {
 		if (noStore) {
 			for (const [name, value] of Object.entries(NO_STORE_HEADERS)) {
-				ctx.setHeader(name, value);
+				context.setHeader(name, value);
 			}
 		}
-		const runtimeCtx = ctx as unknown as { responseHeaders?: Headers };
 		try {
-			return await runWithEndpointContext(ctx as any, () => handler(ctx));
-		} catch (e) {
-			attachResponseHeadersToAPIError(runtimeCtx.responseHeaders, e);
-			throw e;
+			return await runWithEndpointContext(context, () => handler(context));
+		} catch (error) {
+			attachResponseHeadersToAPIError(context.responseHeaders, error);
+			throw error;
 		}
 	};
+}
 
-	if (path) {
-		return createEndpoint(
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	path: Path,
+	options: Options,
+	handler: AuthEndpointHandler<Path, Options, R>,
+): StrictEndpoint<Path, Options, R>;
+
+export function createAuthEndpoint<
+	InferredPath extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: PathlessAuthEndpointHandler<Options, R>,
+): StrictEndpoint<InferredPath, Options, R>;
+
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	...args:
+		| [
+				path: Path,
+				options: Options,
+				handler: AuthEndpointHandler<Path, Options, R>,
+		  ]
+		| [options: Options, handler: PathlessAuthEndpointHandler<Options, R>]
+) {
+	if (args.length === 3) {
+		const [path, options, handler] = args;
+		return createEndpointWithAuthContext(
 			path,
-			{
-				...options,
-				use: [...(options?.use || []), ...use],
-			},
-			wrapped,
+			options,
+			wrapEndpointHandler(handler, options),
 		);
 	}
 
-	return createEndpoint(
-		{
-			...options,
-			use: [...(options?.use || []), ...use],
-		},
-		wrapped,
+	const [options, handler] = args;
+	return createEndpointWithAuthContext(
+		options,
+		wrapEndpointHandler(handler, options),
 	);
 }
 
@@ -179,44 +179,45 @@ function withServerOnly<Options extends EndpointOptions>(
 	} as Options;
 }
 
-export namespace createAuthEndpoint {
-	/**
-	 * Declare a **server-only** endpoint.
-	 *
-	 * The endpoint is callable through `auth.api.*` from trusted server code but is
-	 * never registered on the HTTP router and never emitted into the OpenAPI
-	 * schema. It takes no path because it has no URL to be reached at.
-	 *
-	 * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
-	 * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
-	 * keeps the endpoint off the HTTP surface even if a path is later added by
-	 * mistake: better-call's router skips an endpoint when its path is missing *or*
-	 * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
-	 * on path omission alone is invisible and one keystroke away from exposure.
-	 *
-	 * @example
-	 * ```ts
-	 * viewBackupCodes: createAuthEndpoint.serverOnly(
-	 * 	{ method: "POST", body: schema },
-	 * 	async (ctx) => { ... },
-	 * )
-	 * ```
-	 */
-	export function serverOnly<
-		Path extends string,
-		Options extends EndpointOptions,
-		R,
-	>(
-		options: Options,
-		handler: EndpointHandler<Path, Options, R>,
-	): StrictEndpoint<Path, Options, R> {
-		return createAuthEndpoint(withServerOnly(options), handler);
-	}
-}
+/**
+ * Declare a **server-only** endpoint.
+ *
+ * The endpoint is callable through `auth.api.*` from trusted server code but is
+ * never registered on the HTTP router and never emitted into the OpenAPI
+ * schema. It takes no path because it has no URL to be reached at.
+ *
+ * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
+ * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
+ * keeps the endpoint off the HTTP surface even if a path is later added by
+ * mistake: better-call's router skips an endpoint when its path is missing *or*
+ * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
+ * on path omission alone is invisible and one keystroke away from exposure.
+ *
+ * @example
+ * ```ts
+ * viewBackupCodes: createAuthEndpoint.serverOnly(
+ * 	{ method: "POST", body: schema },
+ * 	async (ctx) => { ... },
+ * )
+ * ```
+ */
+createAuthEndpoint.serverOnly = <
+	InferredPath extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: PathlessAuthEndpointHandler<Options, R>,
+): StrictEndpoint<InferredPath, Options, R> =>
+	createAuthEndpoint<InferredPath, Options, R>(
+		withServerOnly(options),
+		handler,
+	);
 
 export type AuthEndpoint<
 	Path extends string,
 	Opts extends EndpointOptions,
 	R,
 > = ReturnType<typeof createAuthEndpoint<Path, Opts, R>>;
-export type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
+
+export type AuthMiddleware = MiddlewareHandler;

package/src/db/type.ts

@@ -251,7 +251,8 @@ export type DBFieldAttributeConfig = {
 	 */
 	bigint?: boolean | undefined;
 	/**
-	 * A zod schema to validate the value.
+	 * A Standard Schema to validate the value. Works with any Standard Schema
+	 * library, such as Zod, Valibot or ArkType.
 	 */
 	validator?:
 		| {

package/src/types/init-options.ts

@@ -146,7 +146,8 @@ export type DynamicBaseURLConfig = {
 	/**
 	 * List of allowed hostnames. Supports wildcard patterns.
 	 *
-	 * The derived host from the request will be validated against this list.
+	 * `x-forwarded-host` is used only when `advanced.trustedProxyHeaders` is
+	 * enabled.
 	 * Uses the same wildcard matching as `trustedOrigins`.
 	 *
 	 * @example
@@ -161,8 +162,9 @@ export type DynamicBaseURLConfig = {
 	allowedHosts: string[];
 
 	/**
-	 * Fallback URL to use if the derived host doesn't match any allowed host.
-	 * If not set, Better Auth will throw an error when the host doesn't match.
+	 * Fallback URL used when no allowed request host can be resolved.
+	 * If omitted, Better Auth throws when the request host is unavailable or not
+	 * allowed.
 	 *
 	 * @example "https://myapp.com"
 	 */
@@ -172,7 +174,7 @@ export type DynamicBaseURLConfig = {
 	 * Protocol to use when constructing the URL.
 	 * - `"https"`: Always use HTTPS (recommended for production)
 	 * - `"http"`: Always use HTTP (for local development)
-	 * - `"auto"`: Derive from `x-forwarded-proto` header or default to HTTPS
+	 * - `"auto"`: Trust `x-forwarded-proto` only when proxy headers are enabled
 	 *
 	 * @default "auto"
 	 */