@depup/better-auth__core 1.6.23-depup.2

package/dist/utils/redirect-uri.d.mts

@@ -0,0 +1,20 @@
+import * as z from "zod";
+
+//#region src/utils/redirect-uri.d.ts
+/**
+ * Zod schema for OAuth redirect URIs and other developer-supplied URLs that the
+ * server stores and later hands back to a browser.
+ *
+ * - Rejects dangerous schemes (`javascript:`, `data:`, `vbscript:`).
+ * - Rejects URIs with a fragment component (`#...`) per RFC 6749 §3.1.2.
+ * - Requires HTTPS, except for loopback hosts (`127.0.0.0/8`, `[::1]`,
+ *   `*.localhost` per RFC 6761), where HTTP is allowed for local development.
+ * - Allows custom schemes for mobile apps (e.g. `myapp://callback`).
+ *
+ * This is the single source of truth for redirect-URI validation across the
+ * OAuth provider plugins. Consume it from `@better-auth/core/utils/redirect-uri`
+ * rather than re-implementing the scheme policy per plugin.
+ */
+declare const SafeUrlSchema: z.ZodURL;
+//#endregion
+export { SafeUrlSchema };

package/dist/utils/redirect-uri.mjs

@@ -0,0 +1,48 @@
+import { isLoopbackHost } from "./host.mjs";
+import { DANGEROUS_URL_SCHEMES } from "./url.mjs";
+import * as z from "zod";
+//#region src/utils/redirect-uri.ts
+/**
+* Zod schema for OAuth redirect URIs and other developer-supplied URLs that the
+* server stores and later hands back to a browser.
+*
+* - Rejects dangerous schemes (`javascript:`, `data:`, `vbscript:`).
+* - Rejects URIs with a fragment component (`#...`) per RFC 6749 §3.1.2.
+* - Requires HTTPS, except for loopback hosts (`127.0.0.0/8`, `[::1]`,
+*   `*.localhost` per RFC 6761), where HTTP is allowed for local development.
+* - Allows custom schemes for mobile apps (e.g. `myapp://callback`).
+*
+* This is the single source of truth for redirect-URI validation across the
+* OAuth provider plugins. Consume it from `@better-auth/core/utils/redirect-uri`
+* rather than re-implementing the scheme policy per plugin.
+*/
+const SafeUrlSchema = z.url().superRefine((val, ctx) => {
+	let u;
+	try {
+		u = new URL(val);
+	} catch {
+		ctx.addIssue({
+			code: "custom",
+			message: "URL must be parseable",
+			fatal: true
+		});
+		return z.NEVER;
+	}
+	if (DANGEROUS_URL_SCHEMES.includes(u.protocol)) {
+		ctx.addIssue({
+			code: "custom",
+			message: "URL cannot use javascript:, data:, or vbscript: scheme"
+		});
+		return;
+	}
+	if (val.includes("#")) ctx.addIssue({
+		code: "custom",
+		message: "Redirect URI must not contain a fragment component"
+	});
+	if (u.protocol === "http:" && !isLoopbackHost(u.host)) ctx.addIssue({
+		code: "custom",
+		message: "Redirect URI must use HTTPS (HTTP allowed only for loopback hosts)"
+	});
+});
+//#endregion
+export { SafeUrlSchema };

package/dist/utils/string.d.mts

@@ -0,0 +1,8 @@
+//#region src/utils/string.d.ts
+declare function capitalizeFirstLetter(str: string): string;
+declare function toSnakeCase(input: string): string;
+declare function toKebabCase(input: string): string;
+declare function toCamelCase(input: string): string;
+declare function toPascalCase(input: string): string;
+//#endregion
+export { capitalizeFirstLetter, toCamelCase, toKebabCase, toPascalCase, toSnakeCase };

package/dist/utils/string.mjs

@@ -0,0 +1,25 @@
+//#region src/utils/string.ts
+function capitalizeFirstLetter(str) {
+	return str.charAt(0).toUpperCase() + str.slice(1);
+}
+const WORD_PATTERN = /[\p{Ll}\d]+|\p{Lu}+(?!\p{Ll})|\p{Lu}[\p{Ll}\d]+|\p{Lo}+/gu;
+const APOSTROPHE_PATTERN = /['\u2019]/g;
+function splitWords(input) {
+	return input.replace(APOSTROPHE_PATTERN, "").match(WORD_PATTERN) ?? [];
+}
+function toSnakeCase(input) {
+	return splitWords(input).map((word) => word.toLowerCase()).join("_");
+}
+function toKebabCase(input) {
+	return splitWords(input).map((word) => word.toLowerCase()).join("-");
+}
+function toCamelCase(input) {
+	return splitWords(input).reduce((acc, word, i) => {
+		return acc + (i === 0 ? word.toLowerCase() : `${word[0].toUpperCase()}${word.slice(1)}`);
+	}, "");
+}
+function toPascalCase(input) {
+	return splitWords(input).map((word) => `${word[0].toUpperCase()}${word.slice(1).toLowerCase()}`).join("");
+}
+//#endregion
+export { capitalizeFirstLetter, toCamelCase, toKebabCase, toPascalCase, toSnakeCase };

package/dist/utils/url.d.mts

@@ -0,0 +1,37 @@
+//#region src/utils/url.d.ts
+/**
+ * Normalizes a request pathname by removing the basePath prefix and trailing slashes.
+ * This is useful for matching paths against configured path lists.
+ *
+ * @param requestUrl - The full request URL
+ * @param basePath - The base path of the auth API (e.g., "/api/auth")
+ * @returns The normalized path without basePath prefix or trailing slashes,
+ *          or "/" if URL parsing fails
+ *
+ * @example
+ * normalizePathname("http://localhost:3000/api/auth/sso/saml2/callback/provider1", "/api/auth")
+ * // Returns: "/sso/saml2/callback/provider1"
+ *
+ * normalizePathname("http://localhost:3000/sso/saml2/callback/provider1/", "/")
+ * // Returns: "/sso/saml2/callback/provider1"
+ */
+declare function normalizePathname(requestUrl: string, basePath: string): string;
+/**
+ * Schemes that execute or embed code when navigated to or accepted as a
+ * redirect target. These are never safe as an OAuth `redirect_uri` or as a
+ * client-side navigation target (`window.location.href`, `location.assign`, ...).
+ */
+declare const DANGEROUS_URL_SCHEMES: string[];
+/**
+ * Returns `false` only when `value` is an absolute URL using a dangerous scheme
+ * (`javascript:`, `data:`, `vbscript:`). Relative URLs (e.g. `/dashboard`) and
+ * safe absolute schemes (`http`, `https`, custom app schemes such as
+ * `myapp://`) return `true`.
+ *
+ * Use this to guard browser navigation sinks and any redirect target that may
+ * originate from untrusted input. It is intentionally narrow: it blocks code
+ * execution schemes without rejecting relative paths or mobile deep links.
+ */
+declare function isSafeUrlScheme(value: string): boolean;
+//#endregion
+export { DANGEROUS_URL_SCHEMES, isSafeUrlScheme, normalizePathname };

package/dist/utils/url.mjs

@@ -0,0 +1,61 @@
+//#region src/utils/url.ts
+/**
+* Normalizes a request pathname by removing the basePath prefix and trailing slashes.
+* This is useful for matching paths against configured path lists.
+*
+* @param requestUrl - The full request URL
+* @param basePath - The base path of the auth API (e.g., "/api/auth")
+* @returns The normalized path without basePath prefix or trailing slashes,
+*          or "/" if URL parsing fails
+*
+* @example
+* normalizePathname("http://localhost:3000/api/auth/sso/saml2/callback/provider1", "/api/auth")
+* // Returns: "/sso/saml2/callback/provider1"
+*
+* normalizePathname("http://localhost:3000/sso/saml2/callback/provider1/", "/")
+* // Returns: "/sso/saml2/callback/provider1"
+*/
+function normalizePathname(requestUrl, basePath) {
+	let pathname;
+	try {
+		pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
+	} catch {
+		return "/";
+	}
+	const normalizedBasePath = basePath.replace(/\/+$/, "");
+	if (normalizedBasePath === "") return pathname;
+	if (pathname === normalizedBasePath) return "/";
+	if (pathname.startsWith(normalizedBasePath + "/")) return pathname.slice(normalizedBasePath.length).replace(/\/+$/, "") || "/";
+	return pathname;
+}
+/**
+* Schemes that execute or embed code when navigated to or accepted as a
+* redirect target. These are never safe as an OAuth `redirect_uri` or as a
+* client-side navigation target (`window.location.href`, `location.assign`, ...).
+*/
+const DANGEROUS_URL_SCHEMES = [
+	"javascript:",
+	"data:",
+	"vbscript:"
+];
+/**
+* Returns `false` only when `value` is an absolute URL using a dangerous scheme
+* (`javascript:`, `data:`, `vbscript:`). Relative URLs (e.g. `/dashboard`) and
+* safe absolute schemes (`http`, `https`, custom app schemes such as
+* `myapp://`) return `true`.
+*
+* Use this to guard browser navigation sinks and any redirect target that may
+* originate from untrusted input. It is intentionally narrow: it blocks code
+* execution schemes without rejecting relative paths or mobile deep links.
+*/
+function isSafeUrlScheme(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return true;
+	}
+	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
+}
+//#endregion
+export { DANGEROUS_URL_SCHEMES, isSafeUrlScheme, normalizePathname };

package/package.json

@@ -0,0 +1,216 @@
+{
+  "name": "@depup/better-auth__core",
+  "version": "1.6.23-depup.2",
+  "description": "The most comprehensive authentication framework for TypeScript. (with updated dependencies)",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://www.better-auth.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/better-auth/better-auth.git",
+    "directory": "packages/core"
+  },
+  "keywords": [
+    "@better-auth/core",
+    "depup",
+    "updated-dependencies",
+    "security",
+    "latest",
+    "patched",
+    "auth",
+    "core",
+    "typescript",
+    "better-auth"
+  ],
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "changes.json",
+    "README.md"
+  ],
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "dev-source": "./src/index.ts",
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    },
+    "./api": {
+      "dev-source": "./src/api/index.ts",
+      "types": "./dist/api/index.d.mts",
+      "default": "./dist/api/index.mjs"
+    },
+    "./async_hooks": {
+      "dev-source": "./src/async_hooks/index.ts",
+      "types": "./dist/async_hooks/index.d.mts",
+      "node": "./dist/async_hooks/index.mjs",
+      "deno": "./dist/async_hooks/index.mjs",
+      "bun": "./dist/async_hooks/index.mjs",
+      "edge": "./dist/async_hooks/pure.index.mjs",
+      "workerd": "./dist/async_hooks/index.mjs",
+      "browser": "./dist/async_hooks/pure.index.mjs",
+      "default": "./dist/async_hooks/index.mjs"
+    },
+    "./context": {
+      "dev-source": "./src/context/index.ts",
+      "types": "./dist/context/index.d.mts",
+      "default": "./dist/context/index.mjs"
+    },
+    "./env": {
+      "dev-source": "./src/env/index.ts",
+      "types": "./dist/env/index.d.mts",
+      "default": "./dist/env/index.mjs"
+    },
+    "./error": {
+      "dev-source": "./src/error/index.ts",
+      "types": "./dist/error/index.d.mts",
+      "default": "./dist/error/index.mjs"
+    },
+    "./utils/*": {
+      "dev-source": "./src/utils/*.ts",
+      "types": "./dist/utils/*.d.mts",
+      "default": "./dist/utils/*.mjs"
+    },
+    "./social-providers": {
+      "dev-source": "./src/social-providers/index.ts",
+      "types": "./dist/social-providers/index.d.mts",
+      "default": "./dist/social-providers/index.mjs"
+    },
+    "./db": {
+      "dev-source": "./src/db/index.ts",
+      "types": "./dist/db/index.d.mts",
+      "default": "./dist/db/index.mjs"
+    },
+    "./db/adapter": {
+      "dev-source": "./src/db/adapter/index.ts",
+      "types": "./dist/db/adapter/index.d.mts",
+      "default": "./dist/db/adapter/index.mjs"
+    },
+    "./oauth2": {
+      "dev-source": "./src/oauth2/index.ts",
+      "types": "./dist/oauth2/index.d.mts",
+      "default": "./dist/oauth2/index.mjs"
+    },
+    "./instrumentation": {
+      "dev-source": "./src/instrumentation/index.ts",
+      "types": "./dist/instrumentation/index.d.mts",
+      "workerd": "./dist/instrumentation/pure.index.mjs",
+      "edge": "./dist/instrumentation/pure.index.mjs",
+      "browser": "./dist/instrumentation/pure.index.mjs",
+      "node": "./dist/instrumentation/index.mjs",
+      "deno": "./dist/instrumentation/index.mjs",
+      "bun": "./dist/instrumentation/index.mjs",
+      "import": "./dist/instrumentation/index.mjs",
+      "default": "./dist/instrumentation/index.mjs"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      ".": [
+        "dist/index.d.mts"
+      ],
+      "api": [
+        "dist/api/index.d.mts"
+      ],
+      "async_hooks": [
+        "dist/async_hooks/index.d.mts"
+      ],
+      "context": [
+        "dist/context/index.d.mts"
+      ],
+      "env": [
+        "dist/env/index.d.mts"
+      ],
+      "error": [
+        "dist/error/index.d.mts"
+      ],
+      "utils": [
+        "dist/utils/index.d.mts"
+      ],
+      "utils/*": [
+        "dist/utils/*.d.mts"
+      ],
+      "social-providers": [
+        "dist/social-providers/index.d.mts"
+      ],
+      "db": [
+        "dist/db/index.d.mts"
+      ],
+      "db/adapter": [
+        "dist/db/adapter/index.d.mts"
+      ],
+      "oauth2": [
+        "dist/oauth2/index.d.mts"
+      ],
+      "instrumentation": [
+        "dist/instrumentation/index.d.mts"
+      ]
+    }
+  },
+  "dependencies": {
+    "@opentelemetry/semantic-conventions": "^1.43.0",
+    "@standard-schema/spec": "^1.1.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@better-auth/utils": "0.4.2",
+    "@better-fetch/fetch": "1.3.1",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/sdk-trace-base": "^1.30.0",
+    "@opentelemetry/sdk-trace-node": "^1.30.0",
+    "better-call": "1.3.7",
+    "@cloudflare/workers-types": "^4.20250121.0",
+    "jose": "^6.1.3",
+    "kysely": "^0.28.17 || ^0.29.0",
+    "nanostores": "^1.1.1",
+    "tsdown": "0.21.1"
+  },
+  "peerDependencies": {
+    "@better-auth/utils": "0.4.2",
+    "@better-fetch/fetch": "1.3.1",
+    "@opentelemetry/api": "^1.9.0",
+    "better-call": "1.3.7",
+    "@cloudflare/workers-types": ">=4",
+    "jose": "^6.1.0",
+    "kysely": "^0.28.5 || ^0.29.0",
+    "nanostores": "^1.0.1"
+  },
+  "peerDependenciesMeta": {
+    "@cloudflare/workers-types": {
+      "optional": true
+    },
+    "@opentelemetry/api": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "lint:package": "publint run --strict --pack false",
+    "lint:types": "attw --profile esm-only --pack .",
+    "typecheck": "tsc --project tsconfig.json",
+    "test": "vitest",
+    "coverage": "vitest run --coverage --coverage.provider=istanbul"
+  },
+  "depup": {
+    "changes": {
+      "@opentelemetry/semantic-conventions": {
+        "from": "^1.39.0",
+        "to": "^1.43.0"
+      },
+      "zod": {
+        "from": "^4.3.6",
+        "to": "^4.4.3"
+      }
+    },
+    "depsUpdated": 2,
+    "originalPackage": "@better-auth/core",
+    "originalVersion": "1.6.23",
+    "processedAt": "2026-07-21T16:15:02.120Z",
+    "smokeTest": "passed"
+  }
+}

package/src/api/index.ts

@@ -0,0 +1,185 @@
+import type {
+	EndpointContext,
+	EndpointOptions,
+	StrictEndpoint,
+} from "better-call";
+import {
+	createEndpoint,
+	createMiddleware,
+	kAPIErrorHeaderSymbol,
+} from "better-call";
+import { runWithEndpointContext } from "../context";
+import type { AuthContext } from "../types";
+import { isAPIError } from "../utils/is-api-error";
+
+/**
+ * Better-call's createEndpoint re-throws APIError without exposing the headers
+ * accumulated on ctx.responseHeaders (e.g. Set-Cookie from deleteSessionCookie
+ * before throw). Attach them to the error via kAPIErrorHeaderSymbol — matching
+ * better-call's createMiddleware contract so the outer pipeline can merge them
+ * into the response.
+ */
+function attachResponseHeadersToAPIError(
+	responseHeaders: Headers | undefined,
+	e: unknown,
+): void {
+	if (!isAPIError(e) || !responseHeaders) return;
+	Object.defineProperty(e, kAPIErrorHeaderSymbol, {
+		enumerable: false,
+		configurable: true,
+		value: responseHeaders,
+		writable: false,
+	});
+}
+
+export const optionsMiddleware = createMiddleware(async () => {
+	/**
+	 * This will be passed on the instance of
+	 * the context. Used to infer the type
+	 * here.
+	 */
+	return {} as AuthContext;
+});
+
+export const createAuthMiddleware = createMiddleware.create({
+	use: [
+		optionsMiddleware,
+		/**
+		 * Only use for post hooks
+		 */
+		createMiddleware(async () => {
+			return {} as {
+				returned?: unknown | undefined;
+				responseHeaders?: Headers | undefined;
+			};
+		}),
+	],
+});
+
+const use = [optionsMiddleware];
+
+type EndpointHandler<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;
+
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	path: Path,
+	options: Options,
+	handler: EndpointHandler<Path, Options, R>,
+): StrictEndpoint<Path, Options, R>;
+
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: EndpointHandler<Path, Options, R>,
+): StrictEndpoint<Path, Options, R>;
+
+export function createAuthEndpoint<
+	Path extends string,
+	Opts extends EndpointOptions,
+	R,
+>(
+	pathOrOptions: Path | Opts,
+	handlerOrOptions: EndpointHandler<Path, Opts, R> | Opts,
+	handlerOrNever?: any,
+) {
+	const path: Path | undefined =
+		typeof pathOrOptions === "string" ? pathOrOptions : undefined;
+	const options: Opts =
+		typeof handlerOrOptions === "object"
+			? handlerOrOptions
+			: (pathOrOptions as Opts);
+	const handler: EndpointHandler<Path, Opts, R> =
+		typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
+
+	// todo: prettify the code, we want to call `runWithEndpointContext` to top level
+	const wrapped: EndpointHandler<Path, Opts, R> = async (ctx) => {
+		const runtimeCtx = ctx as unknown as { responseHeaders?: Headers };
+		try {
+			return await runWithEndpointContext(ctx as any, () => handler(ctx));
+		} catch (e) {
+			attachResponseHeadersToAPIError(runtimeCtx.responseHeaders, e);
+			throw e;
+		}
+	};
+
+	if (path) {
+		return createEndpoint(
+			path,
+			{
+				...options,
+				use: [...(options?.use || []), ...use],
+			},
+			wrapped,
+		);
+	}
+
+	return createEndpoint(
+		{
+			...options,
+			use: [...(options?.use || []), ...use],
+		},
+		wrapped,
+	);
+}
+
+/**
+ * Set `metadata.SERVER_ONLY` while preserving any existing metadata
+ * (`$Infer`, `openapi`, ...).
+ */
+function withServerOnly<Options extends EndpointOptions>(
+	options: Options,
+): Options {
+	return {
+		...options,
+		metadata: { ...options.metadata, SERVER_ONLY: true },
+	} as Options;
+}
+
+/**
+ * Declare a **server-only** endpoint.
+ *
+ * The endpoint is callable through `auth.api.*` from trusted server code but is
+ * never registered on the HTTP router and never emitted into the OpenAPI
+ * schema. It takes no path because it has no URL to be reached at.
+ *
+ * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
+ * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
+ * keeps the endpoint off the HTTP surface even if a path is later added by
+ * mistake: better-call's router skips an endpoint when its path is missing *or*
+ * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
+ * on path omission alone is invisible and one keystroke away from exposure.
+ *
+ * @example
+ * ```ts
+ * viewBackupCodes: createAuthEndpoint.serverOnly(
+ * 	{ method: "POST", body: schema },
+ * 	async (ctx) => { ... },
+ * )
+ * ```
+ */
+createAuthEndpoint.serverOnly = <
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: EndpointHandler<Path, Options, R>,
+): StrictEndpoint<Path, Options, R> =>
+	createAuthEndpoint(withServerOnly(options), handler);
+
+export type AuthEndpoint<
+	Path extends string,
+	Opts extends EndpointOptions,
+	R,
+> = ReturnType<typeof createAuthEndpoint<Path, Opts, R>>;
+export type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;

package/src/async_hooks/index.ts

@@ -0,0 +1,40 @@
+import type { AsyncLocalStorage } from "node:async_hooks";
+
+export type { AsyncLocalStorage };
+
+const AsyncLocalStoragePromise: Promise<typeof AsyncLocalStorage | null> =
+	import(
+		/* @vite-ignore */
+		/* webpackIgnore: true */
+		"node:async_hooks"
+	)
+		.then((mod) => mod.AsyncLocalStorage)
+		.catch((err) => {
+			if ("AsyncLocalStorage" in globalThis) {
+				return (globalThis as any).AsyncLocalStorage;
+			}
+			if (typeof window !== "undefined") {
+				return null;
+			}
+			console.warn(
+				"[better-auth] Warning: AsyncLocalStorage is not available in this environment. Some features may not work as expected.",
+			);
+			console.warn(
+				"[better-auth] Please read more about this warning at https://better-auth.com/docs/installation#mount-handler",
+			);
+			console.warn(
+				"[better-auth] If you are using Cloudflare Workers, please see: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#nodejs-compatibility-flag",
+			);
+			throw err;
+		});
+
+export async function getAsyncLocalStorage(): Promise<
+	typeof AsyncLocalStorage
+> {
+	const mod = await AsyncLocalStoragePromise;
+	if (mod === null) {
+		throw new Error("getAsyncLocalStorage is only available in server code");
+	} else {
+		return mod;
+	}
+}