@better-auth/core 1.7.0-rc.5 → 1.7.0

package/dist/utils/host.d.mts

@@ -26,33 +26,7 @@
  * The semantic kind of a host, derived from RFC 6890 special-purpose registries
  * plus a few domain-name categories (localhost, cloud metadata FQDNs).
  */
-type HostKind =
-/** IPv4 `127.0.0.0/8` or IPv6 `::1`. */
-"loopback" |
-/** DNS name `localhost` or RFC 6761 `.localhost` TLD. */
-"localhost" |
-/** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */
-"unspecified" |
-/** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */
-"private" |
-/** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */
-"linkLocal" |
-/** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */
-"sharedAddressSpace" |
-/** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */
-"documentation" |
-/** RFC 2544 `198.18.0.0/15`. */
-"benchmarking" |
-/** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */
-"multicast" |
-/** IPv4 limited broadcast `255.255.255.255`. */
-"broadcast" |
-/** Other RFC 6890 special-purpose ranges (0.0.0.0/8, 192.0.0.0/24, 192.88.99.0/24, 240.0.0.0/4, 2001::/32, etc.). */
-"reserved" |
-/** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */
-"cloudMetadata" |
-/** Any host not matching a special-purpose range above. */
-"public";
+type HostKind = /** IPv4 `127.0.0.0/8` or IPv6 `::1`. */"loopback" /** DNS name `localhost` or RFC 6761 `.localhost` TLD. */ | "localhost" /** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */ | "unspecified" /** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */ | "private" /** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */ | "linkLocal" /** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */ | "sharedAddressSpace" /** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */ | "documentation" /** RFC 2544 `198.18.0.0/15`. */ | "benchmarking" /** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */ | "multicast" /** IPv4 limited broadcast `255.255.255.255`. */ | "broadcast" /** Other RFC 6890 special-purpose ranges (0.0.0.0/8, 192.0.0.0/24, 192.88.99.0/24, 240.0.0.0/4, 2001::/32, etc.). */ | "reserved" /** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */ | "cloudMetadata" /** Any host not matching a special-purpose range above. */ | "public";
 /**
  * The syntactic form of the input host: an IPv4 literal, an IPv6 literal, or
  * a domain name. IPv4-mapped IPv6 (`::ffff:192.0.2.1`) is reported as `ipv4`

package/dist/utils/host.mjs

@@ -9,7 +9,7 @@ import { isValidIP, normalizeIP } from "./ip.mjs";
 * only exists for the FQDN form that a naive server-side fetch might resolve
 * via its own resolver.
 */
-const CLOUD_METADATA_HOSTS = /* @__PURE__ */ new Set([
+const CLOUD_METADATA_HOSTS = new Set([
 	"metadata.google.internal",
 	"metadata.goog",
 	"metadata",

package/dist/utils/ip.d.mts

@@ -1,5 +1,4 @@
 import { BetterAuthOptions } from "../types/init-options.mjs";
-import "../types/index.mjs";
 //#region src/utils/ip.d.ts
 /**
  * Normalizes an IP address for consistent rate limiting.

package/dist/utils/ip.mjs

@@ -111,7 +111,7 @@ function ipToBytes(ip) {
 	const mapped = extractIPv4FromMapped(ip);
 	if (mapped) return Uint8Array.from(mapped.split(".").map((octet) => Number(octet)));
 	const groups = expandIPv6(ip);
-	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	const bytes = new Uint8Array(16);
 	for (let i = 0; i < 8; i++) {
 		const group = Number.parseInt(groups[i] ?? "0", 16);
 		bytes[i * 2] = group >> 8 & 255;

package/dist/utils/is-api-error.d.mts

@@ -1,4 +1,5 @@
 import { APIError } from "../error/index.mjs";
+
 //#region src/utils/is-api-error.d.ts
 declare function isAPIError(error: unknown): error is APIError;
 //#endregion

package/dist/utils/redirect-uri.d.mts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+
 //#region src/utils/redirect-uri.d.ts
 /**
  * Returns whether a parsed redirect URI uses an authority-free, reverse-domain

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.7.0-rc.5",
+  "version": "1.7.0",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -170,7 +170,7 @@
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
-    "tsdown": "0.22.7"
+    "tsdown": "0.21.10"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",

package/src/context/endpoint-context.ts

@@ -12,11 +12,13 @@ export type AuthEndpointContext = Partial<
 
 const ensureAsyncStorage = async () => {
 	const betterAuthGlobal = __getBetterAuthGlobal();
-	if (!betterAuthGlobal.context.endpointContextAsyncStorage) {
-		const AsyncLocalStorage = await getAsyncLocalStorage();
-		betterAuthGlobal.context.endpointContextAsyncStorage =
-			new AsyncLocalStorage<AuthEndpointContext>();
+	const existing = betterAuthGlobal.context.endpointContextAsyncStorage;
+	if (existing) {
+		return existing as AsyncLocalStorage<AuthEndpointContext>;
 	}
+	const AsyncLocalStorage = await getAsyncLocalStorage();
+	betterAuthGlobal.context.endpointContextAsyncStorage ??=
+		new AsyncLocalStorage<AuthEndpointContext>();
 	return betterAuthGlobal.context
 		.endpointContextAsyncStorage as AsyncLocalStorage<AuthEndpointContext>;
 };

package/src/context/request-state.ts

@@ -4,35 +4,17 @@ import { __getBetterAuthGlobal } from "./global";
 
 export type RequestStateWeakMap = WeakMap<object, any>;
 
-// Memoizes the in-flight AsyncLocalStorage initialization so concurrent
-// first-callers share a single instance instead of each constructing one.
-let asyncStorageInit: Promise<AsyncLocalStorage<RequestStateWeakMap>> | null =
-	null;
-
 const ensureAsyncStorage = async () => {
 	const betterAuthGlobal = __getBetterAuthGlobal();
 	const existing = betterAuthGlobal.context.requestStateAsyncStorage;
 	if (existing) {
 		return existing as AsyncLocalStorage<RequestStateWeakMap>;
 	}
-	// Without memoizing the init, several concurrent callers can each pass the
-	// check above, each `await getAsyncLocalStorage()`, and each assign a fresh
-	// instance — last write wins. `runWithRequestState().run()` then executes on
-	// one instance while a nested `getCurrentRequestState()` reads the
-	// overwritten one, throwing "No request state found". This shows up
-	// intermittently on serverless cold start (e.g. Cloudflare Workers), where
-	// the first requests hit before the lazy `node:async_hooks` import settles.
-	// The idempotent `??=` keeps the global singleton stable even if multiple
-	// BetterAuth copies (Dual Module Hazard) race here.
-	if (!asyncStorageInit) {
-		asyncStorageInit = getAsyncLocalStorage().then((AsyncLocalStorage) => {
-			betterAuthGlobal.context.requestStateAsyncStorage ??=
-				new AsyncLocalStorage<RequestStateWeakMap>();
-			return betterAuthGlobal.context
-				.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
-		});
-	}
-	return asyncStorageInit;
+	const AsyncLocalStorage = await getAsyncLocalStorage();
+	betterAuthGlobal.context.requestStateAsyncStorage ??=
+		new AsyncLocalStorage<RequestStateWeakMap>();
+	return betterAuthGlobal.context
+		.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
 };
 
 export async function getRequestStateAsyncLocalStorage() {

package/src/context/transaction.ts

@@ -1,4 +1,4 @@
-import type { AsyncLocalStorage } from "node:async_hooks";
+import type { AsyncLocalStorage } from "@better-auth/core/async_hooks";
 import { getAsyncLocalStorage } from "@better-auth/core/async_hooks";
 import type { DBAdapter, DBTransactionAdapter } from "../db/adapter";
 import type { BetterAuthOptions } from "../types";
@@ -14,10 +14,12 @@ type HookContext = {
 
 const ensureAsyncStorage = async () => {
 	const betterAuthGlobal = __getBetterAuthGlobal();
-	if (!betterAuthGlobal.context.adapterAsyncStorage) {
-		const AsyncLocalStorage = await getAsyncLocalStorage();
-		betterAuthGlobal.context.adapterAsyncStorage = new AsyncLocalStorage();
+	const existing = betterAuthGlobal.context.adapterAsyncStorage;
+	if (existing) {
+		return existing as AsyncLocalStorage<HookContext>;
 	}
+	const AsyncLocalStorage = await getAsyncLocalStorage();
+	betterAuthGlobal.context.adapterAsyncStorage ??= new AsyncLocalStorage();
 	return betterAuthGlobal.context
 		.adapterAsyncStorage as AsyncLocalStorage<HookContext>;
 };

package/src/db/type.ts

@@ -251,7 +251,8 @@ export type DBFieldAttributeConfig = {
 	 */
 	bigint?: boolean | undefined;
 	/**
-	 * A zod schema to validate the value.
+	 * A Standard Schema to validate the value. Works with any Standard Schema
+	 * library, such as Zod, Valibot or ArkType.
 	 */
 	validator?:
 		| {

package/src/types/init-options.ts

@@ -146,7 +146,8 @@ export type DynamicBaseURLConfig = {
 	/**
 	 * List of allowed hostnames. Supports wildcard patterns.
 	 *
-	 * The derived host from the request will be validated against this list.
+	 * `x-forwarded-host` is used only when `advanced.trustedProxyHeaders` is
+	 * enabled.
 	 * Uses the same wildcard matching as `trustedOrigins`.
 	 *
 	 * @example
@@ -161,8 +162,9 @@ export type DynamicBaseURLConfig = {
 	allowedHosts: string[];
 
 	/**
-	 * Fallback URL to use if the derived host doesn't match any allowed host.
-	 * If not set, Better Auth will throw an error when the host doesn't match.
+	 * Fallback URL used when no allowed request host can be resolved.
+	 * If omitted, Better Auth throws when the request host is unavailable or not
+	 * allowed.
 	 *
 	 * @example "https://myapp.com"
 	 */
@@ -172,7 +174,7 @@ export type DynamicBaseURLConfig = {
 	 * Protocol to use when constructing the URL.
 	 * - `"https"`: Always use HTTPS (recommended for production)
 	 * - `"http"`: Always use HTTP (for local development)
-	 * - `"auto"`: Derive from `x-forwarded-proto` header or default to HTTPS
+	 * - `"auto"`: Trust `x-forwarded-proto` only when proxy headers are enabled
 	 *
 	 * @default "auto"
 	 */