@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/api/to-auth-endpoints.mjs

@@ -0,0 +1,60 @@
+import { isDynamicBaseURLConfig, isRequestLike } from "../utils/url.mjs";
+import { pickSource, resolveDynamicTrustedProxyHeaders, resolveRequestContext } from "../context/helpers.mjs";
+import { dispatchAuthEndpoint, getOperationId } from "./dispatch.mjs";
+import { hasRequestState, runWithRequestState } from "@better-auth/core/context";
+import { APIError, BetterAuthError } from "@better-auth/core/error";
+//#region src/api/to-auth-endpoints.ts
+/**
+* Resolves the per-call `AuthContext` for endpoints with a dynamic `baseURL`.
+*
+* - `rawCtx.baseURL` already set: HTTP handler rehydrated upstream; return as-is.
+* - Direct `auth.api` call with a source or a configured `fallback`: resolve here.
+* - Neither: throw `APIError` with a helpful message. Leaving `baseURL = ""`
+*   would let plugins build `new URL("")` and crash cryptically downstream.
+*/
+async function resolveDynamicContext(rawCtx, input) {
+	if (rawCtx.baseURL) return rawCtx;
+	const source = pickSource(input);
+	const config = rawCtx.options.baseURL;
+	const hasFallback = isDynamicBaseURLConfig(config) && Boolean(config.fallback);
+	if (source === void 0 && !hasFallback) throw new APIError("INTERNAL_SERVER_ERROR", { message: "Dynamic baseURL could not be resolved for this direct auth.api call. Pass `headers: request.headers` (or `request`) to the call, or add `fallback` to your baseURL config." });
+	try {
+		return await resolveRequestContext(rawCtx, source, resolveDynamicTrustedProxyHeaders(rawCtx.options));
+	} catch (err) {
+		if (err instanceof BetterAuthError) throw new APIError("INTERNAL_SERVER_ERROR", { message: err.message });
+		throw err;
+	}
+}
+/**
+* Wraps each raw endpoint so a router or `auth.api.*` call runs it through the
+* configured hook pipeline. Per-call work that is specific to this entry point
+* (dynamic `baseURL` resolution, request-state initialization) happens here;
+* the hook pipeline itself lives in {@link dispatchAuthEndpoint}.
+*/
+function toAuthEndpoints(endpoints, ctx) {
+	const api = {};
+	for (const [key, endpoint] of Object.entries(endpoints)) {
+		api[key] = async (context) => {
+			const operationId = getOperationId(endpoint, key);
+			const run = async () => {
+				const rawContext = await ctx;
+				const pendingSchemaCheck = rawContext.checkSchema?.();
+				if (pendingSchemaCheck) await pendingSchemaCheck;
+				const authContext = isDynamicBaseURLConfig(rawContext.options.baseURL) ? await resolveDynamicContext(rawContext, context) : rawContext;
+				return dispatchAuthEndpoint(endpoint, {
+					...context,
+					context: authContext,
+					operationId,
+					asResponse: context?.asResponse ?? isRequestLike(context?.request)
+				});
+			};
+			if (await hasRequestState()) return run();
+			return runWithRequestState(/* @__PURE__ */ new WeakMap(), run);
+		};
+		api[key].path = endpoint.path;
+		api[key].options = endpoint.options;
+	}
+	return api;
+}
+//#endregion
+export { toAuthEndpoints };

package/dist/auth/base.mjs

@@ -0,0 +1,66 @@
+import { getBaseURL, getOrigin, isDynamicBaseURLConfig } from "../utils/url.mjs";
+import { getTrustedOrigins, getTrustedProviders, resolveDynamicTrustedProxyHeaders, resolveRequestContext } from "../context/helpers.mjs";
+import { getEndpoints, router } from "../api/index.mjs";
+import { runWithAdapter } from "@better-auth/core/context";
+import { BASE_ERROR_CODES, BetterAuthError } from "@better-auth/core/error";
+import { SchemaMismatchError } from "@better-auth/core/db/internal";
+//#region src/auth/base.ts
+const createBetterAuth = (options, initFn) => {
+	const authContext = initFn(options).then((ctx) => {
+		const validateSchema = ctx.options.advanced?.database?.validateSchema;
+		if (!ctx.checkSchema && validateSchema !== false) {
+			const level = validateSchema === true ? "warn" : "debug";
+			ctx.logger[level](`Schema validation is not available for adapter "${ctx.adapter.id}". Skipping schema validation. Database operations will proceed normally.`);
+		}
+		const pendingSchemaCheck = ctx.checkSchema?.();
+		if (pendingSchemaCheck) pendingSchemaCheck.catch((error) => {
+			ctx.logger.error(error instanceof SchemaMismatchError ? error.message : "Could not validate the database schema. Check your database connection.");
+		});
+		return ctx;
+	});
+	const { api } = getEndpoints(authContext, options);
+	const errorCodes = options.plugins?.reduce((acc, plugin) => {
+		if (plugin.$ERROR_CODES) return {
+			...acc,
+			...plugin.$ERROR_CODES
+		};
+		return acc;
+	}, {});
+	const handler = async (request) => {
+		const ctx = await authContext;
+		const basePath = ctx.options.basePath || "/api/auth";
+		let handlerCtx;
+		if (isDynamicBaseURLConfig(options.baseURL)) handlerCtx = await resolveRequestContext(ctx, request, resolveDynamicTrustedProxyHeaders(ctx.options));
+		else {
+			handlerCtx = Object.create(Object.getPrototypeOf(ctx), Object.getOwnPropertyDescriptors(ctx));
+			let trustOptions = ctx.options;
+			if (!ctx.options.baseURL) {
+				const baseURL = getBaseURL(void 0, basePath, request, void 0, ctx.options.advanced?.trustedProxyHeaders);
+				if (!baseURL) throw new BetterAuthError("Could not get base URL from request. Please provide a valid base URL.");
+				handlerCtx.baseURL = baseURL;
+				handlerCtx.options = {
+					...ctx.options,
+					baseURL: getOrigin(baseURL) || void 0
+				};
+				trustOptions = handlerCtx.options;
+			}
+			handlerCtx.trustedOrigins = await getTrustedOrigins(trustOptions, request);
+			handlerCtx.trustedProviders = await getTrustedProviders(trustOptions, request);
+		}
+		const { handler } = router(handlerCtx, options);
+		return runWithAdapter(handlerCtx.adapter, () => handler(request));
+	};
+	return {
+		handler,
+		fetch: handler,
+		api,
+		options,
+		$context: authContext,
+		$ERROR_CODES: {
+			...errorCodes,
+			...BASE_ERROR_CODES
+		}
+	};
+};
+//#endregion
+export { createBetterAuth };

package/dist/auth/full.d.mts

@@ -0,0 +1,28 @@
+import { Auth } from "../types/auth.mjs";
+import { BetterAuthOptions } from "@better-auth/core";
+
+//#region src/auth/full.d.ts
+/**
+ * Better Auth initializer for full mode (with Kysely)
+ *
+ * @example
+ * ```ts
+ * import { betterAuth } from "better-auth";
+ *
+ * const auth = betterAuth({
+ * 	database: new PostgresDialect({ connection: process.env.DATABASE_URL }),
+ * });
+ * ```
+ *
+ * For minimal mode (without Kysely), import from `better-auth/minimal` instead
+ * @example
+ * ```ts
+ * import { betterAuth } from "better-auth/minimal";
+ *
+ * const auth = betterAuth({
+ *	  database: drizzleAdapter(db, { provider: "pg" }),
+ * });
+ */
+declare const betterAuth: <Options extends BetterAuthOptions>(options: Options & {}) => Auth<Options>;
+//#endregion
+export { betterAuth };

package/dist/auth/full.mjs

@@ -0,0 +1,29 @@
+import { init } from "../context/init.mjs";
+import { createBetterAuth } from "./base.mjs";
+//#region src/auth/full.ts
+/**
+* Better Auth initializer for full mode (with Kysely)
+*
+* @example
+* ```ts
+* import { betterAuth } from "better-auth";
+*
+* const auth = betterAuth({
+* 	database: new PostgresDialect({ connection: process.env.DATABASE_URL }),
+* });
+* ```
+*
+* For minimal mode (without Kysely), import from `better-auth/minimal` instead
+* @example
+* ```ts
+* import { betterAuth } from "better-auth/minimal";
+*
+* const auth = betterAuth({
+*	  database: drizzleAdapter(db, { provider: "pg" }),
+* });
+*/
+const betterAuth = (options) => {
+	return createBetterAuth(options, init);
+};
+//#endregion
+export { betterAuth };

package/dist/auth/minimal.d.mts

@@ -0,0 +1,10 @@
+import { Auth } from "../types/auth.mjs";
+import { BetterAuthOptions } from "@better-auth/core";
+
+//#region src/auth/minimal.d.ts
+/**
+ * Better Auth initializer for minimal mode (without Kysely)
+ */
+declare const betterAuth: <Options extends BetterAuthOptions>(options: Options & {}) => Auth<Options>;
+//#endregion
+export { type BetterAuthOptions, betterAuth };

package/dist/auth/minimal.mjs

@@ -0,0 +1,11 @@
+import { createBetterAuth } from "./base.mjs";
+import { initMinimal } from "../context/init-minimal.mjs";
+//#region src/auth/minimal.ts
+/**
+* Better Auth initializer for minimal mode (without Kysely)
+*/
+const betterAuth = (options) => {
+	return createBetterAuth(options, initMinimal);
+};
+//#endregion
+export { betterAuth };

package/dist/auth/trusted-origins.mjs

@@ -0,0 +1,106 @@
+import { wildcardMatch } from "../utils/wildcard.mjs";
+import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
+//#region src/auth/trusted-origins.ts
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
+const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
+const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+/**
+* Resolves `.` and `..` segments in a path after percent-decoding so a
+* path-pinned pattern cannot be bypassed with traversal: e.g.
+* `myapp://host/cb/../evil` must not satisfy pattern `myapp://host/cb`.
+* Returns "" for an empty or root path.
+*/
+const normalizePath = (path) => {
+	let decoded = path;
+	try {
+		decoded = decodeURIComponent(path);
+	} catch {}
+	const segments = [];
+	for (const segment of decoded.split("/")) if (segment === "..") segments.pop();
+	else if (segment !== "." && segment !== "") segments.push(segment);
+	return segments.length > 0 ? `/${segments.join("/")}` : "";
+};
+/**
+* Splits a custom-scheme origin into its scheme, authority and path using
+* plain string operations.
+*
+* `new URL()` is deliberately avoided here: its parsing of non-special schemes
+* (e.g. `myapp://`, `exp://`) is not consistent across the runtimes Better Auth
+* targets (Node, Bun, Deno, Cloudflare Workers), and the result of an origin
+* check must not depend on which engine extracts the authority.
+*
+* Scheme and authority are lower-cased (matching how a URL canonicalizes its
+* host); the path is percent-decoded and resolved so traversal cannot bypass
+* a path-pinned pattern.
+*/
+const parseCustomSchemeOrigin = (value) => {
+	if (CONTROL_CHARACTER_PATTERN.test(value)) return null;
+	const schemeEnd = value.indexOf(":");
+	if (schemeEnd <= 0) return null;
+	const scheme = value.slice(0, schemeEnd).toLowerCase();
+	let rest = value.slice(schemeEnd + 1);
+	let authority = "";
+	if (rest.startsWith("//")) {
+		rest = rest.slice(2);
+		const authorityEnd = rest.search(/[/?#]/);
+		if (authorityEnd === -1) {
+			authority = rest;
+			rest = "";
+		} else {
+			authority = rest.slice(0, authorityEnd);
+			rest = rest.slice(authorityEnd);
+		}
+	}
+	const pathEnd = rest.search(/[?#]/);
+	const path = normalizePath(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
+	return {
+		scheme,
+		authority: authority.toLowerCase(),
+		path
+	};
+};
+/**
+* Validates root-relative redirects against ambiguous browser and router parsing.
+*
+* @see https://www.rfc-editor.org/rfc/rfc3986.html#section-4.2
+* @see https://url.spec.whatwg.org/#concept-basic-url-parser
+*/
+const isSafeRelativeURL = (value) => {
+	if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\") || CONTROL_CHARACTER_PATTERN.test(value)) return false;
+	const pathEnd = value.search(/[?#]/);
+	const path = pathEnd === -1 ? value : value.slice(0, pathEnd);
+	if (ENCODED_PATH_SEPARATOR_PATTERN.test(path)) return false;
+	try {
+		return new URL(value, RELATIVE_URL_PARSER_ORIGIN).origin === RELATIVE_URL_PARSER_ORIGIN;
+	} catch {
+		return false;
+	}
+};
+/**
+* Matches the given url against an origin or origin pattern
+* See "options.trustedOrigins" for details of supported patterns
+*
+* @param url The url to test
+* @param pattern The origin pattern
+* @param [settings] Specify supported pattern matching settings
+* @returns {boolean} true if the URL matches the origin pattern, false otherwise.
+*/
+const matchesOriginPattern = (url, pattern, settings) => {
+	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
+	if (pattern.includes("*") || pattern.includes("?")) {
+		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
+		const host = getHost(url);
+		if (!host) return false;
+		return wildcardMatch(pattern)(host);
+	}
+	const protocol = getProtocol(url);
+	if (protocol === "http:" || protocol === "https:" || !protocol) return pattern === getOrigin(url);
+	const parsed = parseCustomSchemeOrigin(url);
+	const parsedPattern = parseCustomSchemeOrigin(pattern);
+	if (!parsed || !parsedPattern || parsed.scheme !== parsedPattern.scheme) return false;
+	if (parsedPattern.authority && parsed.authority !== parsedPattern.authority) return false;
+	if (!parsedPattern.path) return true;
+	return parsed.path === parsedPattern.path || parsed.path.startsWith(`${parsedPattern.path}/`);
+};
+//#endregion
+export { matchesOriginPattern };

package/dist/client/broadcast-channel.d.mts

@@ -0,0 +1,19 @@
+//#region src/client/broadcast-channel.d.ts
+interface BroadcastMessage {
+  event?: "session" | undefined;
+  data?: {
+    trigger?: "signout" | "getSession" | "updateUser";
+  } | undefined;
+  clientId: string;
+  timestamp: number;
+}
+type BroadcastListener = (message: BroadcastMessage) => void;
+declare const kBroadcastChannel: unique symbol;
+interface BroadcastChannel {
+  post(message: Record<string, unknown>): void;
+  subscribe(listener: BroadcastListener): () => void;
+  setup(): () => void;
+}
+declare function getGlobalBroadcastChannel(name?: string): BroadcastChannel;
+//#endregion
+export { BroadcastChannel, BroadcastListener, BroadcastMessage, getGlobalBroadcastChannel, kBroadcastChannel };

package/dist/client/broadcast-channel.mjs

@@ -0,0 +1,44 @@
+//#region src/client/broadcast-channel.ts
+const kBroadcastChannel = Symbol.for("better-auth:broadcast-channel");
+const now = () => Math.floor(Date.now() / 1e3);
+var WindowBroadcastChannel = class {
+	listeners = /* @__PURE__ */ new Set();
+	name;
+	constructor(name = "better-auth.message") {
+		this.name = name;
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	post(message) {
+		if (typeof window === "undefined") return;
+		try {
+			localStorage.setItem(this.name, JSON.stringify({
+				...message,
+				timestamp: now()
+			}));
+		} catch {}
+	}
+	setup() {
+		if (typeof window === "undefined" || typeof window.addEventListener === "undefined") return () => {};
+		const handler = (event) => {
+			if (event.key !== this.name) return;
+			const message = JSON.parse(event.newValue ?? "{}");
+			if (message?.event !== "session" || !message?.data) return;
+			this.listeners.forEach((listener) => listener(message));
+		};
+		window.addEventListener("storage", handler);
+		return () => {
+			window.removeEventListener("storage", handler);
+		};
+	}
+};
+function getGlobalBroadcastChannel(name = "better-auth.message") {
+	if (!globalThis[kBroadcastChannel]) globalThis[kBroadcastChannel] = new WindowBroadcastChannel(name);
+	return globalThis[kBroadcastChannel];
+}
+//#endregion
+export { getGlobalBroadcastChannel, kBroadcastChannel };

package/dist/client/config.d.mts

@@ -0,0 +1,90 @@
+import { SessionData } from "./session-atom.mjs";
+import { BetterAuthClientOptions, ClientAtomListener } from "@better-auth/core";
+import * as _$nanostores from "nanostores";
+import { WritableAtom } from "nanostores";
+import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
+
+//#region src/client/config.d.ts
+declare const getClientConfig: (options?: BetterAuthClientOptions | undefined, loadEnv?: boolean | undefined) => {
+  readonly baseURL: string;
+  pluginsActions: Record<string, any>;
+  pluginsAtoms: Record<string, WritableAtom<any>>;
+  pluginPathMethods: Record<string, "GET" | "POST">;
+  atomListeners: ClientAtomListener[];
+  hydrateSession: (sessionData: SessionData | null) => void;
+  $sessionSignal: _$nanostores.PreinitializedWritableAtom<boolean> & object;
+  $fetch: _$_better_fetch_fetch0.BetterFetch<{
+    plugins: (_$_better_fetch_fetch0.BetterFetchPlugin<Record<string, any>> | {
+      id: string;
+      name: string;
+      hooks: {
+        onSuccess(context: _$_better_fetch_fetch0.SuccessContext<any>): void;
+      };
+    } | {
+      id: string;
+      name: string;
+      hooks: {
+        onSuccess: ((context: _$_better_fetch_fetch0.SuccessContext<any>) => Promise<void> | void) | undefined;
+        onError: ((context: _$_better_fetch_fetch0.ErrorContext) => Promise<void> | void) | undefined;
+        onRequest: (<T extends Record<string, any>>(context: _$_better_fetch_fetch0.RequestContext<T>) => Promise<_$_better_fetch_fetch0.RequestContext | void> | _$_better_fetch_fetch0.RequestContext | void) | undefined;
+        onResponse: ((context: _$_better_fetch_fetch0.ResponseContext) => Promise<Response | void | _$_better_fetch_fetch0.ResponseContext> | Response | _$_better_fetch_fetch0.ResponseContext | void) | undefined;
+      };
+    })[];
+    cache?: RequestCache | undefined;
+    credentials?: RequestCredentials;
+    integrity?: string | undefined;
+    keepalive?: boolean | undefined;
+    method: string;
+    mode?: RequestMode | undefined;
+    priority?: RequestPriority | undefined;
+    redirect?: RequestRedirect | undefined;
+    referrer?: string | undefined;
+    referrerPolicy?: ReferrerPolicy | undefined;
+    signal?: AbortSignal | null;
+    window?: null | undefined;
+    onRetry?: ((response: _$_better_fetch_fetch0.ResponseContext) => Promise<void> | void) | undefined;
+    hookOptions?: {
+      cloneResponse?: boolean;
+    } | undefined;
+    timeout?: number | undefined;
+    customFetchImpl: _$_better_fetch_fetch0.FetchEsque;
+    baseURL: string;
+    throw?: boolean | undefined;
+    auth?: ({
+      type: "Bearer";
+      token: string | Promise<string | undefined> | (() => string | Promise<string | undefined> | undefined) | undefined;
+    } | {
+      type: "Basic";
+      username: string | (() => string | undefined) | undefined;
+      password: string | (() => string | undefined) | undefined;
+    } | {
+      type: "Custom";
+      prefix: string | (() => string | undefined) | undefined;
+      value: string | (() => string | undefined) | undefined;
+    }) | undefined;
+    headers?: {} | {
+      [x: string]: string | undefined;
+      accept?: ((string & {}) | "application/json" | "text/plain" | "application/octet-stream") | undefined;
+      "content-type"?: ((string & {}) | "application/x-www-form-urlencoded" | "application/json" | "text/plain" | "application/octet-stream" | "multipart/form-data") | undefined;
+      authorization?: ((string & {}) | `Bearer ${string}` | `Basic ${string}`) | undefined;
+    } | undefined;
+    body?: any;
+    query?: any;
+    params?: any;
+    duplex?: "full" | "half" | undefined;
+    jsonParser: (text: string) => Promise<any> | any;
+    retry?: _$_better_fetch_fetch0.RetryOptions | undefined;
+    retryAttempt?: number | undefined;
+    output?: (_$_better_fetch_fetch0.StandardSchemaV1 | typeof Blob | typeof File) | undefined;
+    errorSchema?: _$_better_fetch_fetch0.StandardSchemaV1 | undefined;
+    disableValidation?: boolean | undefined;
+    disableSignal?: boolean | undefined;
+  }, unknown, unknown, {}>;
+  $store: {
+    notify: (signal?: (Omit<string, "$sessionSignal"> | "$sessionSignal") | undefined) => void;
+    listen: (signal: Omit<string, "$sessionSignal"> | "$sessionSignal", listener: (value: boolean, oldValue?: boolean | undefined) => void) => void;
+    atoms: Record<string, WritableAtom<any>>;
+  };
+};
+//#endregion
+export { getClientConfig };

package/dist/client/config.mjs

@@ -0,0 +1,113 @@
+import { getBaseURL } from "../utils/url.mjs";
+import { parseJSON } from "./parser.mjs";
+import { redirectPlugin } from "./fetch-plugins.mjs";
+import { getSessionAtom, hydrateSessionAtom } from "./session-atom.mjs";
+import { defu } from "defu";
+import { createFetch } from "@better-fetch/fetch";
+//#region src/client/config.ts
+const resolvePublicAuthUrl = (basePath) => {
+	if (typeof process === "undefined") return void 0;
+	const path = basePath ?? "/api/auth";
+	if (process.env.NEXT_PUBLIC_AUTH_URL) return process.env.NEXT_PUBLIC_AUTH_URL;
+	if (typeof window === "undefined") {
+		if (process.env.NEXTAUTH_URL) try {
+			return process.env.NEXTAUTH_URL;
+		} catch {}
+		if (process.env.VERCEL_URL) try {
+			const protocol = process.env.VERCEL_URL.startsWith("http") ? "" : "https://";
+			return `${new URL(`${protocol}${process.env.VERCEL_URL}`).origin}${path}`;
+		} catch {}
+	}
+};
+const getClientConfig = (options, loadEnv) => {
+	const isCredentialsSupported = "credentials" in Request.prototype;
+	const baseURL = getBaseURL(options?.baseURL, options?.basePath, void 0, loadEnv) ?? resolvePublicAuthUrl(options?.basePath) ?? "/api/auth";
+	const pluginsFetchPlugins = options?.plugins?.flatMap((plugin) => plugin.fetchPlugins).filter((pl) => pl !== void 0) || [];
+	const lifeCyclePlugin = {
+		id: "lifecycle-hooks",
+		name: "lifecycle-hooks",
+		hooks: {
+			onSuccess: options?.fetchOptions?.onSuccess,
+			onError: options?.fetchOptions?.onError,
+			onRequest: options?.fetchOptions?.onRequest,
+			onResponse: options?.fetchOptions?.onResponse
+		}
+	};
+	const { onSuccess: _onSuccess, onError: _onError, onRequest: _onRequest, onResponse: _onResponse, ...restOfFetchOptions } = options?.fetchOptions || {};
+	const $fetch = createFetch({
+		baseURL,
+		...isCredentialsSupported ? { credentials: "include" } : {},
+		method: "GET",
+		jsonParser(text) {
+			if (!text) return null;
+			return parseJSON(text, { strict: false });
+		},
+		customFetchImpl: fetch,
+		...restOfFetchOptions,
+		plugins: [
+			lifeCyclePlugin,
+			...restOfFetchOptions.plugins || [],
+			...options?.disableDefaultFetchPlugins ? [] : [redirectPlugin],
+			...pluginsFetchPlugins
+		]
+	});
+	const { $sessionSignal, session, broadcastSessionUpdate } = getSessionAtom($fetch, options);
+	let hasHydrated = false;
+	const hydrateSession = (sessionData) => {
+		if (hasHydrated || sessionData === null) return;
+		hasHydrated = true;
+		hydrateSessionAtom(session, sessionData);
+	};
+	const plugins = options?.plugins || [];
+	let pluginsActions = {};
+	const pluginsAtoms = {
+		$sessionSignal,
+		session
+	};
+	const pluginPathMethods = {
+		"/sign-out": "POST",
+		"/revoke-sessions": "POST",
+		"/revoke-other-sessions": "POST",
+		"/delete-user": "POST"
+	};
+	const atomListeners = [{
+		signal: "$sessionSignal",
+		matcher(path) {
+			return path === "/sign-out" || path === "/update-user" || path === "/update-session" || path === "/sign-up/email" || path === "/sign-in/email" || path === "/delete-user" || path === "/verify-email" || path === "/revoke-sessions" || path === "/revoke-session" || path === "/revoke-other-sessions" || path === "/change-email" || path === "/change-password";
+		},
+		callback(path) {
+			if (path === "/sign-out") broadcastSessionUpdate("signout");
+			else if (path === "/update-user" || path === "/update-session") broadcastSessionUpdate("updateUser");
+		}
+	}];
+	for (const plugin of plugins) {
+		if (plugin.getAtoms) Object.assign(pluginsAtoms, plugin.getAtoms?.($fetch));
+		if (plugin.pathMethods) Object.assign(pluginPathMethods, plugin.pathMethods);
+		if (plugin.atomListeners) atomListeners.push(...plugin.atomListeners);
+	}
+	const $store = {
+		notify: (signal) => {
+			pluginsAtoms[signal].set(!pluginsAtoms[signal].get());
+		},
+		listen: (signal, listener) => {
+			pluginsAtoms[signal].subscribe(listener);
+		},
+		atoms: pluginsAtoms
+	};
+	for (const plugin of plugins) if (plugin.getActions) pluginsActions = defu(plugin.getActions?.($fetch, $store, options) ?? {}, pluginsActions);
+	return {
+		get baseURL() {
+			return baseURL;
+		},
+		pluginsActions,
+		pluginsAtoms,
+		pluginPathMethods,
+		atomListeners,
+		hydrateSession,
+		$sessionSignal,
+		$fetch,
+		$store
+	};
+};
+//#endregion
+export { getClientConfig };

package/dist/client/equality.d.mts

@@ -0,0 +1,19 @@
+import { Store, StoreValue } from "nanostores";
+
+//#region src/client/equality.d.ts
+/**
+ * Deep structural equality for JSON-serializable values.
+ * Handles: primitives, null, arrays, and plain objects.
+ * Short-circuits on referential equality at every recursion level.
+ */
+declare function isJsonEqual(a: unknown, b: unknown): boolean;
+/**
+ * Attach an equality gate to a nanostores atom via `onSet`.
+ * When `isEqual(currentValue, newValue)` returns true, the `set()` call
+ * is aborted: no listeners fire, no framework re-renders occur.
+ *
+ * Returns the unsubscribe function from `onSet`.
+ */
+declare function withEquality<S extends Store>(store: S, isEqual: (a: StoreValue<S>, b: StoreValue<S>) => boolean): () => void;
+//#endregion
+export { isJsonEqual, withEquality };

package/dist/client/equality.mjs

@@ -0,0 +1,42 @@
+import { onSet } from "nanostores";
+//#region src/client/equality.ts
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/**
+* Deep structural equality for JSON-serializable values.
+* Handles: primitives, null, arrays, and plain objects.
+* Short-circuits on referential equality at every recursion level.
+*/
+function isJsonEqual(a, b) {
+	if (a === b) return true;
+	if (Array.isArray(a) && Array.isArray(b)) {
+		if (a.length !== b.length) return false;
+		for (let i = 0; i < a.length; i++) if (!isJsonEqual(a[i], b[i])) return false;
+		return true;
+	}
+	if (isPlainObject(a) && isPlainObject(b)) {
+		const keysA = Object.keys(a);
+		const keysB = Object.keys(b);
+		if (keysA.length !== keysB.length) return false;
+		for (const key of keysA) if (!(key in b) || !isJsonEqual(a[key], b[key])) return false;
+		return true;
+	}
+	return false;
+}
+/**
+* Attach an equality gate to a nanostores atom via `onSet`.
+* When `isEqual(currentValue, newValue)` returns true, the `set()` call
+* is aborted: no listeners fire, no framework re-renders occur.
+*
+* Returns the unsubscribe function from `onSet`.
+*/
+function withEquality(store, isEqual) {
+	return onSet(store, ({ newValue, abort }) => {
+		if (isEqual(store.value, newValue)) abort();
+	});
+}
+//#endregion
+export { isJsonEqual, withEquality };

package/dist/client/fetch-plugins.mjs

@@ -0,0 +1,17 @@
+import { isSafeUrlScheme } from "@better-auth/core/utils/url";
+//#region src/client/fetch-plugins.ts
+const redirectPlugin = {
+	id: "redirect",
+	name: "Redirect",
+	hooks: { onSuccess(context) {
+		if (context.data?.url && context.data?.redirect && isSafeUrlScheme(context.data.url)) {
+			if (typeof window !== "undefined" && window.location) {
+				if (window.location) try {
+					window.location.href = context.data.url;
+				} catch {}
+			}
+		}
+	} }
+};
+//#endregion
+export { redirectPlugin };