@better-auth/core 1.7.1 → 1.7.2

package/dist/context/endpoint-context.d.mts

@@ -6,13 +6,27 @@ import { AsyncLocalStorage } from "@better-auth/core/async_hooks";
 type AuthEndpointContext = Partial<InputContext<string, any> & EndpointContext<string, any>> & {
   context: AuthContext;
 };
+type AuthEndpointContextStorage = AsyncLocalStorage<AuthEndpointContext>;
 /**
- * This is for internal use only. Most users should use `getCurrentAuthContext` instead.
+ * @deprecated Use `getCurrentAuthEndpointContext`,
+ * `tryGetCurrentAuthEndpointContext`, or `runWithEndpointContext` instead.
+ */
+declare function getCurrentAuthContextAsyncLocalStorage(): Promise<AuthEndpointContextStorage>;
+/**
+ * Returns the current auth endpoint context, or `undefined` when called outside
+ * of `runWithEndpointContext`.
+ */
+declare function tryGetCurrentAuthEndpointContext(): AuthEndpointContext | undefined;
+/**
+ * Returns the current auth endpoint context.
  *
- * It is exposed for advanced use cases where you need direct access to the AsyncLocalStorage instance.
+ * @throws When called outside of `runWithEndpointContext`.
+ */
+declare function getCurrentAuthEndpointContext(): AuthEndpointContext;
+/**
+ * @deprecated Use `getCurrentAuthEndpointContext` instead.
  */
-declare function getCurrentAuthContextAsyncLocalStorage(): Promise<AsyncLocalStorage<AuthEndpointContext>>;
 declare function getCurrentAuthContext(): Promise<AuthEndpointContext>;
-declare function runWithEndpointContext<T>(context: AuthEndpointContext, fn: () => T): Promise<T>;
+declare function runWithEndpointContext<T>(authEndpointContext: AuthEndpointContext, fn: () => T): Promise<T>;
 //#endregion
-export { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext };
+export { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext };

package/dist/context/endpoint-context.mjs

@@ -1,29 +1,48 @@
-import { __getBetterAuthGlobal } from "./global.mjs";
+import { __getBetterAuthGlobal, __getCurrentEndpointContext } from "./global.mjs";
 import { getAsyncLocalStorage } from "@better-auth/core/async_hooks";
 //#region src/context/endpoint-context.ts
-const ensureAsyncStorage = async () => {
-	const betterAuthGlobal = __getBetterAuthGlobal();
-	const existing = betterAuthGlobal.context.endpointContextAsyncStorage;
+const getExistingEndpointContextStorage = () => {
+	return __getBetterAuthGlobal().context.endpointContextAsyncStorage;
+};
+const getOrCreateEndpointContextStorage = async () => {
+	const existing = getExistingEndpointContextStorage();
 	if (existing) return existing;
 	const AsyncLocalStorage = await getAsyncLocalStorage();
-	betterAuthGlobal.context.endpointContextAsyncStorage ??= new AsyncLocalStorage();
-	return betterAuthGlobal.context.endpointContextAsyncStorage;
+	const globalContext = __getBetterAuthGlobal().context;
+	return globalContext.endpointContextAsyncStorage ??= new AsyncLocalStorage();
 };
 /**
-* This is for internal use only. Most users should use `getCurrentAuthContext` instead.
-*
-* It is exposed for advanced use cases where you need direct access to the AsyncLocalStorage instance.
+* @deprecated Use `getCurrentAuthEndpointContext`,
+* `tryGetCurrentAuthEndpointContext`, or `runWithEndpointContext` instead.
 */
 async function getCurrentAuthContextAsyncLocalStorage() {
-	return ensureAsyncStorage();
+	return getOrCreateEndpointContextStorage();
+}
+/**
+* Returns the current auth endpoint context, or `undefined` when called outside
+* of `runWithEndpointContext`.
+*/
+function tryGetCurrentAuthEndpointContext() {
+	return __getCurrentEndpointContext();
 }
+/**
+* Returns the current auth endpoint context.
+*
+* @throws When called outside of `runWithEndpointContext`.
+*/
+function getCurrentAuthEndpointContext() {
+	const authEndpointContext = tryGetCurrentAuthEndpointContext();
+	if (!authEndpointContext) throw new Error("No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.");
+	return authEndpointContext;
+}
+/**
+* @deprecated Use `getCurrentAuthEndpointContext` instead.
+*/
 async function getCurrentAuthContext() {
-	const context = (await ensureAsyncStorage()).getStore();
-	if (!context) throw new Error("No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.");
-	return context;
+	return getCurrentAuthEndpointContext();
 }
-async function runWithEndpointContext(context, fn) {
-	return (await ensureAsyncStorage()).run(context, fn);
+async function runWithEndpointContext(authEndpointContext, fn) {
+	return (await getOrCreateEndpointContextStorage()).run(authEndpointContext, fn);
 }
 //#endregion
-export { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext };
+export { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext };

package/dist/context/global.mjs

@@ -2,7 +2,7 @@
 const symbol = Symbol.for("better-auth:global");
 let bind = null;
 const __context = {};
-const __betterAuthVersion = "1.7.1";
+const __betterAuthVersion = "1.7.2";
 /**
 * We store context instance in the globalThis.
 *
@@ -29,8 +29,11 @@ function __getBetterAuthGlobal() {
 	}
 	return globalThis[symbol];
 }
+function __getCurrentEndpointContext() {
+	return __getBetterAuthGlobal().context.endpointContextAsyncStorage?.getStore();
+}
 function getBetterAuthVersion() {
 	return __getBetterAuthGlobal().version;
 }
 //#endregion
-export { __getBetterAuthGlobal, getBetterAuthVersion };
+export { __getBetterAuthGlobal, __getCurrentEndpointContext, getBetterAuthVersion };

package/dist/context/index.d.mts

@@ -1,5 +1,5 @@
-import { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext } from "./endpoint-context.mjs";
+import { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext } from "./endpoint-context.mjs";
 import { getBetterAuthVersion } from "./global.mjs";
 import { RequestState, RequestStateWeakMap, defineRequestState, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, runWithRequestState } from "./request-state.mjs";
 import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, queueAfterTransactionHook, runWithAdapter, runWithTransaction } from "./transaction.mjs";
-export { type AuthEndpointContext, type RequestState, type RequestStateWeakMap, defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction };
+export { type AuthEndpointContext, type RequestState, type RequestStateWeakMap, defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction, tryGetCurrentAuthEndpointContext };

package/dist/context/index.mjs

@@ -1,5 +1,5 @@
 import { getBetterAuthVersion } from "./global.mjs";
-import { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext } from "./endpoint-context.mjs";
+import { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext } from "./endpoint-context.mjs";
 import { defineRequestState, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, runWithRequestState } from "./request-state.mjs";
 import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, queueAfterTransactionHook, runWithAdapter, runWithTransaction } from "./transaction.mjs";
-export { defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction };
+export { defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction, tryGetCurrentAuthEndpointContext };

package/dist/env/logger.mjs

@@ -1,3 +1,4 @@
+import { __getCurrentEndpointContext } from "../context/global.mjs";
 import { getColorDepth } from "./color-depth.mjs";
 //#region src/env/logger.ts
 const TTY_COLORS = {
@@ -74,6 +75,20 @@ const createLogger = (options) => {
 		}
 	};
 };
-const logger = createLogger();
+const defaultLogger = createLogger();
+const getCurrentLogger = () => {
+	const currentLogger = __getCurrentEndpointContext()?.context.logger;
+	return currentLogger && currentLogger !== logger ? currentLogger : defaultLogger;
+};
+const logger = {
+	debug: (...params) => getCurrentLogger().debug(...params),
+	info: (...params) => getCurrentLogger().info(...params),
+	success: (...params) => getCurrentLogger().success(...params),
+	warn: (...params) => getCurrentLogger().warn(...params),
+	error: (...params) => getCurrentLogger().error(...params),
+	get level() {
+		return getCurrentLogger().level;
+	}
+};
 //#endregion
 export { TTY_COLORS, createLogger, levels, logger, shouldPublishLog };

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.1";
+const INSTRUMENTATION_VERSION = "1.7.2";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/social-providers/reddit.mjs

@@ -1,6 +1,7 @@
 import { getOAuth2Tokens } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+import { createPlaceholderEmail } from "../utils/email.mjs";
 import { base64 } from "@better-auth/utils/base64";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/reddit.ts
@@ -63,7 +64,10 @@ const reddit = (options) => {
 			} });
 			if (error) return null;
 			const userMap = await options.mapProfileToUser?.(profile);
-			const email = userMap?.email || `${profile.id}@reddit.invalid`;
+			const email = userMap?.email || createPlaceholderEmail({
+				identifier: profile.id,
+				namespace: "reddit"
+			});
 			return {
 				user: {
 					name: profile.name,

package/dist/social-providers/roblox.mjs

@@ -1,6 +1,7 @@
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
+import { createPlaceholderEmail } from "../utils/email.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/roblox.ts
 const roblox = (options) => {
@@ -53,7 +54,10 @@ const roblox = (options) => {
 				user: {
 					name: profile.nickname || profile.preferred_username || "",
 					image: profile.picture,
-					email: profile.preferred_username || null,
+					email: createPlaceholderEmail({
+						identifier: profile.sub,
+						namespace: "roblox"
+					}),
 					emailVerified: false,
 					...userMap
 				},

package/dist/social-providers/tiktok.mjs

@@ -1,6 +1,7 @@
 import { RESERVED_AUTHORIZATION_PARAMS_SET } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
+import { createPlaceholderEmail } from "../utils/email.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/tiktok.ts
 const tiktok = (options) => {
@@ -57,7 +58,10 @@ const tiktok = (options) => {
 			if (error) return null;
 			return {
 				user: {
-					email: profile.data.user.email || profile.data.user.username,
+					email: profile.data.user.email || createPlaceholderEmail({
+						identifier: profile.data.user.open_id,
+						namespace: "tiktok"
+					}),
 					name: profile.data.user.display_name || profile.data.user.username || "",
 					image: profile.data.user.avatar_large_url,
 					emailVerified: false

package/dist/social-providers/twitter.mjs

@@ -1,6 +1,7 @@
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
+import { createPlaceholderEmail } from "../utils/email.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/twitter.ts
 const twitter = (options) => {
@@ -71,7 +72,10 @@ const twitter = (options) => {
 			return {
 				user: {
 					name: profile.data.name,
-					email: profile.data.email || profile.data.username || null,
+					email: profile.data.email || createPlaceholderEmail({
+						identifier: profile.data.id,
+						namespace: "twitter"
+					}),
 					image: profile.data.profile_image_url,
 					emailVerified,
 					...userMap

package/dist/social-providers/wechat.mjs

@@ -1,4 +1,5 @@
 import { RESERVED_AUTHORIZATION_PARAMS_SET } from "../oauth2/create-authorization-url.mjs";
+import { createPlaceholderEmail } from "../utils/email.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/wechat.ts
 const wechat = (options) => {
@@ -69,10 +70,14 @@ const wechat = (options) => {
 			}).toString(), { method: "GET" });
 			if (error || !profile || profile.errcode) return null;
 			const userMap = await options.mapProfileToUser?.(profile);
+			const userId = profile.unionid || profile.openid || openid;
 			return {
 				user: {
 					name: profile.nickname,
-					email: profile.email || `${profile.unionid || profile.openid || openid}@wechat.invalid`,
+					email: profile.email || createPlaceholderEmail({
+						identifier: userId,
+						namespace: "wechat"
+					}),
 					image: profile.headimgurl,
 					emailVerified: false,
 					...userMap

package/dist/utils/url.d.mts

@@ -16,6 +16,15 @@
  * // Returns: "/sso/saml2/callback/provider1"
  */
 declare function normalizePathname(requestUrl: string, basePath: string): string;
+/**
+ * Appends query parameters before the fragment of an absolute or root-relative URL.
+ * Existing query text is retained without parsing it into name-value pairs.
+ *
+ * This function only composes URLs. Callers must validate untrusted input.
+ *
+ * @throws TypeError if parsing fails or a relative input changes authority.
+ */
+declare function appendQueryParams(input: string, params: URLSearchParams): string;
 /**
  * Schemes that execute or embed code when navigated to or accepted as a
  * redirect target. These are never safe as an OAuth `redirect_uri` or as a
@@ -34,4 +43,4 @@ declare const DANGEROUS_URL_SCHEMES: string[];
  */
 declare function isSafeUrlScheme(value: string): boolean;
 //#endregion
-export { DANGEROUS_URL_SCHEMES, isSafeUrlScheme, normalizePathname };
+export { DANGEROUS_URL_SCHEMES, appendQueryParams, isSafeUrlScheme, normalizePathname };

package/dist/utils/url.mjs

@@ -28,6 +28,26 @@ function normalizePathname(requestUrl, basePath) {
 	if (pathname.startsWith(normalizedBasePath + "/")) return pathname.slice(normalizedBasePath.length).replace(/\/+$/, "") || "/";
 	return pathname;
 }
+const URL_REFERENCE_ORIGIN = "https://better-auth.invalid";
+/**
+* Appends query parameters before the fragment of an absolute or root-relative URL.
+* Existing query text is retained without parsing it into name-value pairs.
+*
+* This function only composes URLs. Callers must validate untrusted input.
+*
+* @throws TypeError if parsing fails or a relative input changes authority.
+*/
+function appendQueryParams(input, params) {
+	const relative = input.startsWith("/");
+	if (input.startsWith("//") || input.startsWith("/\\")) throw new TypeError("Expected an absolute or root-relative URL");
+	const parsedURL = relative ? new URL(input, URL_REFERENCE_ORIGIN) : new URL(input);
+	if (relative && parsedURL.origin !== URL_REFERENCE_ORIGIN) throw new TypeError("Expected an absolute or root-relative URL");
+	const query = params.toString();
+	if (!query) return input;
+	const separator = parsedURL.search.endsWith("&") ? "" : "&";
+	parsedURL.search = parsedURL.search ? `${parsedURL.search}${separator}${query}` : query;
+	return relative ? parsedURL.href.slice(parsedURL.origin.length) : parsedURL.href;
+}
 /**
 * Schemes that execute or embed code when navigated to or accepted as a
 * redirect target. These are never safe as an OAuth `redirect_uri` or as a
@@ -58,4 +78,4 @@ function isSafeUrlScheme(value) {
 	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
 }
 //#endregion
-export { DANGEROUS_URL_SCHEMES, isSafeUrlScheme, normalizePathname };
+export { DANGEROUS_URL_SCHEMES, appendQueryParams, isSafeUrlScheme, normalizePathname };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -45,8 +45,8 @@
       "node": "./dist/async_hooks/index.mjs",
       "deno": "./dist/async_hooks/index.mjs",
       "bun": "./dist/async_hooks/index.mjs",
-      "edge": "./dist/async_hooks/pure.index.mjs",
       "workerd": "./dist/async_hooks/index.mjs",
+      "edge": "./dist/async_hooks/pure.index.mjs",
       "browser": "./dist/async_hooks/pure.index.mjs",
       "default": "./dist/async_hooks/index.mjs"
     },

package/src/context/endpoint-context.ts

@@ -2,7 +2,7 @@ import type { AsyncLocalStorage } from "@better-auth/core/async_hooks";
 import { getAsyncLocalStorage } from "@better-auth/core/async_hooks";
 import type { EndpointContext, InputContext } from "better-call";
 import type { AuthContext } from "../types";
-import { __getBetterAuthGlobal } from "./global";
+import { __getBetterAuthGlobal, __getCurrentEndpointContext } from "./global";
 
 export type AuthEndpointContext = Partial<
 	InputContext<string, any> & EndpointContext<string, any>
@@ -10,43 +10,68 @@ export type AuthEndpointContext = Partial<
 	context: AuthContext;
 };
 
-const ensureAsyncStorage = async () => {
-	const betterAuthGlobal = __getBetterAuthGlobal();
-	const existing = betterAuthGlobal.context.endpointContextAsyncStorage;
+type AuthEndpointContextStorage = AsyncLocalStorage<AuthEndpointContext>;
+
+const getExistingEndpointContextStorage = () => {
+	return __getBetterAuthGlobal().context.endpointContextAsyncStorage as
+		| AuthEndpointContextStorage
+		| undefined;
+};
+
+const getOrCreateEndpointContextStorage = async () => {
+	const existing = getExistingEndpointContextStorage();
 	if (existing) {
-		return existing as AsyncLocalStorage<AuthEndpointContext>;
+		return existing;
 	}
 	const AsyncLocalStorage = await getAsyncLocalStorage();
-	betterAuthGlobal.context.endpointContextAsyncStorage ??=
-		new AsyncLocalStorage<AuthEndpointContext>();
-	return betterAuthGlobal.context
-		.endpointContextAsyncStorage as AsyncLocalStorage<AuthEndpointContext>;
+	const globalContext = __getBetterAuthGlobal().context;
+	const storage = (globalContext.endpointContextAsyncStorage ??=
+		new AsyncLocalStorage<AuthEndpointContext>()) as AuthEndpointContextStorage;
+	return storage;
 };
 
 /**
- * This is for internal use only. Most users should use `getCurrentAuthContext` instead.
- *
- * It is exposed for advanced use cases where you need direct access to the AsyncLocalStorage instance.
+ * @deprecated Use `getCurrentAuthEndpointContext`,
+ * `tryGetCurrentAuthEndpointContext`, or `runWithEndpointContext` instead.
  */
 export async function getCurrentAuthContextAsyncLocalStorage() {
-	return ensureAsyncStorage();
+	return getOrCreateEndpointContextStorage();
+}
+
+/**
+ * Returns the current auth endpoint context, or `undefined` when called outside
+ * of `runWithEndpointContext`.
+ */
+export function tryGetCurrentAuthEndpointContext() {
+	return __getCurrentEndpointContext<AuthEndpointContext>();
 }
 
-export async function getCurrentAuthContext(): Promise<AuthEndpointContext> {
-	const als = await ensureAsyncStorage();
-	const context = als.getStore();
-	if (!context) {
+/**
+ * Returns the current auth endpoint context.
+ *
+ * @throws When called outside of `runWithEndpointContext`.
+ */
+export function getCurrentAuthEndpointContext() {
+	const authEndpointContext = tryGetCurrentAuthEndpointContext();
+	if (!authEndpointContext) {
 		throw new Error(
 			"No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.",
 		);
 	}
-	return context;
+	return authEndpointContext;
+}
+
+/**
+ * @deprecated Use `getCurrentAuthEndpointContext` instead.
+ */
+export async function getCurrentAuthContext() {
+	return getCurrentAuthEndpointContext();
 }
 
 export async function runWithEndpointContext<T>(
-	context: AuthEndpointContext,
+	authEndpointContext: AuthEndpointContext,
 	fn: () => T,
 ): Promise<T> {
-	const als = await ensureAsyncStorage();
-	return als.run(context, fn);
+	const storage = await getOrCreateEndpointContextStorage();
+	return storage.run(authEndpointContext, fn);
 }

package/src/context/global.ts

@@ -52,6 +52,13 @@ export function __getBetterAuthGlobal(): BetterAuthGlobal {
 	return (globalThis as any)[symbol] as BetterAuthGlobal;
 }
 
+export function __getCurrentEndpointContext<T>(): T | undefined {
+	const storage = __getBetterAuthGlobal().context.endpointContextAsyncStorage as
+		| AsyncLocalStorage<T>
+		| undefined;
+	return storage?.getStore();
+}
+
 export function getBetterAuthVersion(): string {
 	return __getBetterAuthGlobal().version;
 }

package/src/context/index.ts

@@ -2,7 +2,9 @@ export {
 	type AuthEndpointContext,
 	getCurrentAuthContext,
 	getCurrentAuthContextAsyncLocalStorage,
+	getCurrentAuthEndpointContext,
 	runWithEndpointContext,
+	tryGetCurrentAuthEndpointContext,
 } from "./endpoint-context";
 export { getBetterAuthVersion } from "./global";
 export {

package/src/env/logger.ts

@@ -1,3 +1,5 @@
+import type { AuthEndpointContext } from "../context/endpoint-context";
+import { __getCurrentEndpointContext } from "../context/global";
 import { getColorDepth } from "./color-depth";
 
 export const TTY_COLORS = {
@@ -142,4 +144,23 @@ export const createLogger = (options?: Logger | undefined): InternalLogger => {
 	};
 };
 
-export const logger = createLogger();
+const defaultLogger = createLogger();
+
+const getCurrentLogger = (): InternalLogger => {
+	const currentLogger =
+		__getCurrentEndpointContext<AuthEndpointContext>()?.context.logger;
+	return currentLogger && currentLogger !== logger
+		? currentLogger
+		: defaultLogger;
+};
+
+export const logger: InternalLogger = {
+	debug: (...params) => getCurrentLogger().debug(...params),
+	info: (...params) => getCurrentLogger().info(...params),
+	success: (...params) => getCurrentLogger().success(...params),
+	warn: (...params) => getCurrentLogger().warn(...params),
+	error: (...params) => getCurrentLogger().error(...params),
+	get level() {
+		return getCurrentLogger().level;
+	},
+};

package/src/social-providers/reddit.ts

@@ -6,6 +6,7 @@ import {
 	getOAuth2Tokens,
 	refreshAccessToken,
 } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 export interface RedditProfile {
 	id: string;
@@ -110,7 +111,12 @@ export const reddit = (options: RedditOptions) => {
 			// non-routable placeholder (RFC 2606 `.invalid`) keyed to the user's
 			// Reddit id rather than the routable `reddit.com`, which could collide
 			// with a real address. Left unverified; `mapProfileToUser` can override.
-			const email = userMap?.email || `${profile.id}@reddit.invalid`;
+			const email =
+				userMap?.email ||
+				createPlaceholderEmail({
+					identifier: profile.id,
+					namespace: "reddit",
+				});
 			return {
 				user: {
 					name: profile.name,

package/src/social-providers/roblox.ts

@@ -5,6 +5,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 export interface RobloxProfile extends Record<string, any> {
 	/** the user's id */
@@ -97,13 +98,14 @@ export const roblox = (options: RobloxOptions) => {
 			}
 
 			const userMap = await options.mapProfileToUser?.(profile);
-			// Roblox does not provide email or email_verified claim.
-			// We default to false for security consistency.
 			return {
 				user: {
 					name: profile.nickname || profile.preferred_username || "",
 					image: profile.picture,
-					email: profile.preferred_username || null, // Roblox does not provide email
+					email: createPlaceholderEmail({
+						identifier: profile.sub,
+						namespace: "roblox",
+					}),
 					emailVerified: false,
 					...userMap,
 				},

package/src/social-providers/tiktok.ts

@@ -5,6 +5,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 /**
  * [More info](https://developers.tiktok.com/doc/tiktok-api-v2-get-user-info/)
@@ -210,7 +211,12 @@ export const tiktok = (options: TiktokOptions) => {
 
 			return {
 				user: {
-					email: profile.data.user.email || profile.data.user.username,
+					email:
+						profile.data.user.email ||
+						createPlaceholderEmail({
+							identifier: profile.data.user.open_id,
+							namespace: "tiktok",
+						}),
 					name:
 						profile.data.user.display_name || profile.data.user.username || "",
 					image: profile.data.user.avatar_large_url,

package/src/social-providers/twitter.ts

@@ -5,6 +5,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 export interface TwitterProfile {
 	data: {
@@ -187,9 +188,14 @@ export const twitter = (options: TwitterOption) => {
 			return {
 				user: {
 					name: profile.data.name,
-					email: profile.data.email || profile.data.username || null,
+					email:
+						profile.data.email ||
+						createPlaceholderEmail({
+							identifier: profile.data.id,
+							namespace: "twitter",
+						}),
 					image: profile.data.profile_image_url,
-					emailVerified: emailVerified,
+					emailVerified,
 					...userMap,
 				},
 				data: profile,

package/src/social-providers/wechat.ts

@@ -1,6 +1,7 @@
 import { betterFetch } from "@better-fetch/fetch";
 import type { OAuth2Tokens, OAuthProvider, ProviderOptions } from "../oauth2";
 import { RESERVED_AUTHORIZATION_PARAMS_SET } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 /**
  * WeChat user profile information
@@ -205,17 +206,16 @@ export const wechat = (options: WeChatOptions) => {
 			}
 
 			const userMap = await options.mapProfileToUser?.(profile);
+			const userId = profile.unionid || profile.openid || openid;
 			return {
 				user: {
 					name: profile.nickname,
-					// WeChat does not return an email, and the OAuth callback rejects a
-					// missing one, so the default sign-in would always fail. Synthesize a
-					// stable, non-routable placeholder (RFC 2606 `.invalid`) keyed to the
-					// user's WeChat id, left unverified. Applications that collect a real
-					// email override it via `mapProfileToUser`.
 					email:
 						profile.email ||
-						`${profile.unionid || profile.openid || openid}@wechat.invalid`,
+						createPlaceholderEmail({
+							identifier: userId,
+							namespace: "wechat",
+						}),
 					image: profile.headimgurl,
 					emailVerified: false,
 					...userMap,

package/src/utils/url.ts

@@ -48,6 +48,49 @@ export function normalizePathname(
 	return pathname;
 }
 
+const URL_REFERENCE_ORIGIN = "https://better-auth.invalid";
+
+/**
+ * Appends query parameters before the fragment of an absolute or root-relative URL.
+ * Existing query text is retained without parsing it into name-value pairs.
+ *
+ * This function only composes URLs. Callers must validate untrusted input.
+ *
+ * @throws TypeError if parsing fails or a relative input changes authority.
+ */
+export function appendQueryParams(
+	input: string,
+	params: URLSearchParams,
+): string {
+	const relative = input.startsWith("/");
+	const hasAuthorityPrefix = input.startsWith("//") || input.startsWith("/\\");
+	if (hasAuthorityPrefix) {
+		throw new TypeError("Expected an absolute or root-relative URL");
+	}
+
+	const parsedURL = relative
+		? new URL(input, URL_REFERENCE_ORIGIN)
+		: new URL(input);
+
+	if (relative && parsedURL.origin !== URL_REFERENCE_ORIGIN) {
+		throw new TypeError("Expected an absolute or root-relative URL");
+	}
+
+	const query = params.toString();
+	if (!query) {
+		return input;
+	}
+
+	const separator = parsedURL.search.endsWith("&") ? "" : "&";
+	parsedURL.search = parsedURL.search
+		? `${parsedURL.search}${separator}${query}`
+		: query;
+
+	return relative
+		? parsedURL.href.slice(parsedURL.origin.length)
+		: parsedURL.href;
+}
+
 /**
  * Schemes that execute or embed code when navigated to or accepted as a
  * redirect target. These are never safe as an OAuth `redirect_uri` or as a