@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/context/create-context.mjs

@@ -0,0 +1,235 @@
+import { getBaseURL, isDynamicBaseURLConfig } from "../utils/url.mjs";
+import { matchesOriginPattern } from "../auth/trusted-origins.mjs";
+import { hasServerSessionStore } from "./store-capabilities.mjs";
+import { isPromise } from "../utils/is-promise.mjs";
+import { hashPassword, verifyPassword } from "../crypto/password.mjs";
+import { createCookieGetter, getCookies } from "../cookies/index.mjs";
+import { createInternalAdapter } from "../db/internal-adapter.mjs";
+import { getInternalPlugins, getTrustedOrigins, getTrustedProviders, runPluginInit } from "./helpers.mjs";
+import { checkPassword } from "../utils/password.mjs";
+import { checkEndpointConflicts } from "../api/index.mjs";
+import { DEFAULT_SECRET } from "../utils/constants.mjs";
+import { buildSecretConfig, parseSecretsEnv, validateSecretsArray } from "./secret-utils.mjs";
+import { getBetterAuthVersion } from "@better-auth/core/context";
+import { getAuthTables } from "@better-auth/core/db";
+import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
+import { BetterAuthError } from "@better-auth/core/error";
+import { generateId } from "@better-auth/core/utils/id";
+import { schemaCheckFor } from "@better-auth/core/db/internal";
+import { socialProviders } from "@better-auth/core/social-providers";
+import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
+import { createTelemetry } from "@better-auth/telemetry";
+import defu$1 from "defu";
+//#region src/context/create-context.ts
+/**
+* Estimates the entropy of a string in bits.
+* This is a simple approximation that helps detect low-entropy secrets.
+*/
+function estimateEntropy(str) {
+	const unique = new Set(str).size;
+	if (unique === 0) return 0;
+	return Math.log2(Math.pow(unique, str.length));
+}
+/**
+* Validates that the secret meets minimum security requirements.
+* Throws BetterAuthError if the secret is invalid.
+* Skips validation for DEFAULT_SECRET in test environments only.
+* Only throws for DEFAULT_SECRET in production environment.
+*/
+function validateSecret(secret, logger) {
+	const isDefaultSecret = secret === DEFAULT_SECRET;
+	if (isTest()) return;
+	if (isDefaultSecret && isProduction) throw new BetterAuthError("You are using the default secret. Please set `BETTER_AUTH_SECRET` in your environment variables or pass `secret` in your auth config.");
+	if (!secret) throw new BetterAuthError("BETTER_AUTH_SECRET is missing. Set it in your environment or pass `secret` to betterAuth({ secret }).");
+	if (secret.length < 32) logger.warn(`[better-auth] Warning: your BETTER_AUTH_SECRET should be at least 32 characters long for adequate security. Generate one with \`npx auth secret\` or \`openssl rand -base64 32\`.`);
+	if (estimateEntropy(secret) < 120) logger.warn("[better-auth] Warning: your BETTER_AUTH_SECRET appears low-entropy. Use a randomly generated secret for production.");
+}
+async function createAuthContext(adapter, options, getDatabaseType) {
+	const isStateful = hasServerSessionStore(options);
+	if (!isStateful) options = defu$1(options, { session: { cookieCache: {
+		enabled: true,
+		strategy: "jwe",
+		refreshCache: true,
+		maxAge: options.session?.expiresIn || 3600 * 24 * 7
+	} } });
+	if (!options.database) options = defu$1(options, { account: { storeAccountCookie: true } });
+	const plugins = options.plugins || [];
+	const internalPlugins = getInternalPlugins(options);
+	const logger = createLogger(options.logger);
+	const isDynamicConfig = isDynamicBaseURLConfig(options.baseURL);
+	if (isDynamicBaseURLConfig(options.baseURL)) {
+		const { allowedHosts } = options.baseURL;
+		if (!allowedHosts || allowedHosts.length === 0) throw new BetterAuthError("baseURL.allowedHosts cannot be empty. Provide at least one allowed host pattern (e.g., [\"myapp.com\", \"*.vercel.app\"]).");
+	}
+	const baseURL = isDynamicConfig ? void 0 : getBaseURL(typeof options.baseURL === "string" ? options.baseURL : void 0, options.basePath);
+	if (!baseURL && !isDynamicConfig) logger.warn(`[better-auth] Base URL is not set. Set the baseURL option or BETTER_AUTH_URL env, or use a dynamic baseURL with allowedHosts for multi-host setups. Without it the origin is derived from the incoming request, and callbacks and redirects may not work correctly.`);
+	if (adapter.id === "memory" && options.advanced?.database?.generateId === false) logger.error(`[better-auth] Misconfiguration detected.
+You are using the memory DB with generateId: false.
+This will cause no id to be generated for any model.
+Most of the features of Better Auth will not work correctly.`);
+	const secretsArray = options.secrets ?? parseSecretsEnv(env.BETTER_AUTH_SECRETS);
+	const legacySecret = options.secret || env.BETTER_AUTH_SECRET || env.AUTH_SECRET || "";
+	let secret;
+	let secretConfig;
+	if (secretsArray) {
+		validateSecretsArray(secretsArray, logger);
+		secret = secretsArray[0].value;
+		secretConfig = buildSecretConfig(secretsArray, legacySecret);
+	} else {
+		secret = legacySecret || "better-auth-secret-12345678901234567890";
+		validateSecret(secret, logger);
+		secretConfig = secret;
+	}
+	options = {
+		...options,
+		secret,
+		baseURL: isDynamicConfig ? options.baseURL : baseURL ? new URL(baseURL).origin : "",
+		basePath: options.basePath || "/api/auth",
+		plugins: plugins.concat(internalPlugins)
+	};
+	checkEndpointConflicts(options, logger);
+	const trustedProxies = options.advanced?.ipAddress?.trustedProxies;
+	if (trustedProxies && trustedProxies.length > 0) {
+		const invalid = findInvalidTrustedProxies(trustedProxies);
+		if (invalid.length > 0) logger.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${invalid.join(", ")}. Each entry must be an IP address or CIDR range.`);
+	}
+	const cookies = getCookies(options);
+	const tables = getAuthTables(options);
+	const providers = (await Promise.all(Object.entries(options.socialProviders || {}).map(async ([key, originalConfig]) => {
+		const config = typeof originalConfig === "function" ? await originalConfig() : originalConfig;
+		if (config == null) return null;
+		if (config.enabled === false) return null;
+		if (!config.clientId) logger.warn(`Social provider ${key} is missing clientId or clientSecret`);
+		const provider = socialProviders[key](config);
+		provider.disableImplicitSignUp = config.disableImplicitSignUp;
+		return provider;
+	}))).filter((x) => x !== null);
+	const generateIdFunc = ({ model, size }) => {
+		if (typeof options.advanced?.generateId === "function") return options.advanced.generateId({
+			model,
+			size
+		});
+		const dbGenerateId = options?.advanced?.database?.generateId;
+		if (typeof dbGenerateId === "function") return dbGenerateId({
+			model,
+			size
+		});
+		if (dbGenerateId === "uuid") return crypto.randomUUID();
+		if (dbGenerateId === "serial" || dbGenerateId === false) return false;
+		return generateId(size);
+	};
+	const { publish } = await createTelemetry(options, {
+		adapter: adapter.id,
+		database: typeof options.database === "function" ? "adapter" : getDatabaseType(options.database)
+	});
+	const pluginIds = new Set(options.plugins.map((p) => p.id));
+	const getPluginFn = (id) => options.plugins.find((p) => p.id === id) ?? null;
+	const hasPluginFn = (id) => pluginIds.has(id);
+	const trustedOrigins = await getTrustedOrigins(options);
+	const trustedProviders = await getTrustedProviders(options);
+	const ctx = {
+		appName: options.appName || "Better Auth",
+		baseURL: baseURL || "",
+		version: getBetterAuthVersion(),
+		socialProviders: providers,
+		options,
+		oauthConfig: {
+			storeStateStrategy: options.account?.storeStateStrategy || (isStateful ? "database" : "cookie"),
+			skipStateCookieCheck: !!options.account?.skipStateCookieCheck
+		},
+		tables,
+		trustedOrigins,
+		trustedProviders,
+		isTrustedOrigin(url, settings) {
+			return this.trustedOrigins.some((origin) => matchesOriginPattern(url, origin, settings));
+		},
+		sessionConfig: {
+			updateAge: options.session?.updateAge !== void 0 ? options.session.updateAge : 1440 * 60,
+			expiresIn: options.session?.expiresIn || 3600 * 24 * 7,
+			freshAge: options.session?.freshAge === void 0 ? 3600 * 24 : options.session.freshAge,
+			cookieRefreshCache: (() => {
+				const refreshCache = options.session?.cookieCache?.refreshCache;
+				const maxAge = options.session?.cookieCache?.maxAge || 300;
+				if (isStateful && refreshCache) {
+					logger.warn("[better-auth] `session.cookieCache.refreshCache` is enabled while `database` or `secondaryStorage` is configured. `refreshCache` is meant for stateless (DB-less) setups. Disabling `refreshCache` — remove it from your config to silence this warning.");
+					return false;
+				}
+				if (refreshCache === false || refreshCache === void 0) return false;
+				if (refreshCache === true) return {
+					enabled: true,
+					updateAge: Math.floor(maxAge * .2)
+				};
+				return {
+					enabled: true,
+					updateAge: refreshCache.updateAge !== void 0 ? refreshCache.updateAge : Math.floor(maxAge * .2)
+				};
+			})()
+		},
+		secret,
+		secretConfig,
+		rateLimit: {
+			...options.rateLimit,
+			enabled: options.rateLimit?.enabled ?? isProduction,
+			window: options.rateLimit?.window || 10,
+			max: options.rateLimit?.max || 100,
+			storage: options.rateLimit?.storage || (options.secondaryStorage ? "secondary-storage" : "memory")
+		},
+		authCookies: cookies,
+		logger,
+		generateId: generateIdFunc,
+		session: null,
+		secondaryStorage: options.secondaryStorage,
+		password: {
+			hash: options.emailAndPassword?.password?.hash || hashPassword,
+			verify: options.emailAndPassword?.password?.verify || verifyPassword,
+			config: {
+				minPasswordLength: options.emailAndPassword?.minPasswordLength || 8,
+				maxPasswordLength: options.emailAndPassword?.maxPasswordLength || 128
+			},
+			checkPassword
+		},
+		setNewSession(session) {
+			this.newSession = session;
+		},
+		newSession: null,
+		adapter,
+		internalAdapter: createInternalAdapter(adapter, {
+			options,
+			logger,
+			hooks: options.databaseHooks ? [{
+				source: "user",
+				hooks: options.databaseHooks
+			}] : [],
+			generateId: generateIdFunc
+		}),
+		createAuthCookie: createCookieGetter(options),
+		async runMigrations() {
+			throw new BetterAuthError("runMigrations will be set by the specific init implementation");
+		},
+		publishTelemetry: publish,
+		skipCSRFCheck: !!options.advanced?.disableCSRFCheck,
+		skipOriginCheck: options.advanced?.disableOriginCheck !== void 0 ? options.advanced.disableOriginCheck : isTest() ? true : false,
+		runInBackground: options.advanced?.backgroundTasks?.handler ?? ((p) => {
+			p.catch(() => {});
+		}),
+		async runInBackgroundOrAwait(promise) {
+			try {
+				if (options.advanced?.backgroundTasks?.handler) {
+					if (promise instanceof Promise) options.advanced.backgroundTasks.handler(promise.catch((e) => {
+						logger.error("Failed to run background task:", e);
+					}));
+				} else await promise;
+			} catch (e) {
+				logger.error("Failed to run background task:", e);
+			}
+		},
+		getPlugin: getPluginFn,
+		hasPlugin: hasPluginFn
+	};
+	const initOrPromise = runPluginInit(ctx);
+	if (isPromise(initOrPromise)) await initOrPromise;
+	ctx.checkSchema = schemaCheckFor(ctx.adapter);
+	return ctx;
+}
+//#endregion
+export { createAuthContext };

package/dist/context/helpers.mjs

@@ -0,0 +1,158 @@
+import { getBaseURL, getOrigin, isDynamicBaseURLConfig, isRequestLike, resolveBaseURL } from "../utils/url.mjs";
+import { isPromise } from "../utils/is-promise.mjs";
+import { createCookieGetter, getCookies } from "../cookies/index.mjs";
+import { createInternalAdapter } from "../db/internal-adapter.mjs";
+import { env } from "@better-auth/core/env";
+import { BetterAuthError } from "@better-auth/core/error";
+import { defu } from "defu";
+import { isLoopbackHost } from "@better-auth/core/utils/host";
+//#region src/context/helpers.ts
+async function runPluginInit(context) {
+	let options = context.options;
+	const plugins = options.plugins || [];
+	const pluginTrustedOrigins = [];
+	const dbHooks = [];
+	for (const plugin of plugins) if (plugin.init) {
+		const initPromise = plugin.init(context);
+		let result;
+		if (isPromise(initPromise)) result = await initPromise;
+		else result = initPromise;
+		if (typeof result === "object") {
+			if (result.options) {
+				const { databaseHooks, trustedOrigins, ...restOpts } = result.options;
+				if (databaseHooks) dbHooks.push({
+					source: `plugin:${plugin.id}`,
+					hooks: databaseHooks
+				});
+				if (trustedOrigins) pluginTrustedOrigins.push(trustedOrigins);
+				options = defu(options, restOpts);
+			}
+			if (result.context) Object.assign(context, result.context);
+		}
+	}
+	if (pluginTrustedOrigins.length > 0) {
+		const allSources = [...options.trustedOrigins ? [options.trustedOrigins] : [], ...pluginTrustedOrigins];
+		const staticOrigins = allSources.filter(Array.isArray).flat();
+		const dynamicOrigins = allSources.filter((s) => typeof s === "function");
+		if (dynamicOrigins.length > 0) options.trustedOrigins = async (request) => {
+			const resolved = await Promise.all(dynamicOrigins.map((fn) => fn(request)));
+			return [...staticOrigins, ...resolved.flat()].filter((v) => typeof v === "string" && v !== "");
+		};
+		else options.trustedOrigins = staticOrigins;
+	}
+	if (options.databaseHooks) dbHooks.push({
+		source: "user",
+		hooks: options.databaseHooks
+	});
+	context.internalAdapter = createInternalAdapter(context.adapter, {
+		options,
+		logger: context.logger,
+		hooks: dbHooks,
+		generateId: context.generateId
+	});
+	context.options = options;
+}
+function getInternalPlugins(options) {
+	const plugins = [];
+	if (options.advanced?.crossSubDomainCookies?.enabled) {}
+	return plugins;
+}
+async function getTrustedOrigins(options, request) {
+	const trustedOrigins = [];
+	if (isDynamicBaseURLConfig(options.baseURL)) {
+		const allowedHosts = options.baseURL.allowedHosts;
+		const proto = options.baseURL.protocol;
+		for (const host of allowedHosts) if (!host.includes("://")) {
+			if (!proto || proto === "https" || proto === "auto") trustedOrigins.push(`https://${host}`);
+			if (proto === "http" || proto === "auto" || isLoopbackHost(host)) trustedOrigins.push(`http://${host}`);
+		} else trustedOrigins.push(host);
+		if (options.baseURL.fallback) try {
+			trustedOrigins.push(new URL(options.baseURL.fallback).origin);
+		} catch {}
+	} else {
+		const baseURL = getBaseURL(typeof options.baseURL === "string" ? options.baseURL : void 0, options.basePath, request);
+		if (baseURL) trustedOrigins.push(new URL(baseURL).origin);
+	}
+	if (options.trustedOrigins) {
+		if (Array.isArray(options.trustedOrigins)) trustedOrigins.push(...options.trustedOrigins);
+		if (typeof options.trustedOrigins === "function") {
+			const validOrigins = await options.trustedOrigins(request);
+			trustedOrigins.push(...validOrigins);
+		}
+	}
+	const envTrustedOrigins = env.BETTER_AUTH_TRUSTED_ORIGINS;
+	if (envTrustedOrigins) trustedOrigins.push(...envTrustedOrigins.split(","));
+	return trustedOrigins.filter((v) => Boolean(v));
+}
+/**
+* Picks a `Request`-like or `Headers` value from a direct `auth.api` call.
+* Headers are only accepted when they carry a host: without one, host
+* resolution would fall back to `null` and the caller should use `fallback`
+* or pass a `Request` instead.
+*/
+function pickSource(input) {
+	if (isRequestLike(input?.request)) return input.request;
+	if (!input?.headers) return void 0;
+	const headers = input.headers instanceof Headers ? input.headers : new Headers(input.headers);
+	if (!headers.has("host") && !headers.has("x-forwarded-host")) return;
+	return headers;
+}
+/**
+* Returns the effective `trustedProxyHeaders` value for dynamic `baseURL`
+* resolution. Proxy headers (`x-forwarded-host` / `x-forwarded-proto`) are
+* ignored unless the user opts in with `advanced.trustedProxyHeaders: true`,
+* matching the static-config path. Deployments behind a reverse proxy that
+* only exposes the public host via `x-forwarded-host` must set the flag.
+*/
+function resolveDynamicTrustedProxyHeaders(options) {
+	return options.advanced?.trustedProxyHeaders ?? false;
+}
+/**
+* Per-request clone with `baseURL`, `trustedOrigins`, `trustedProviders`
+* and cookies rehydrated for the resolved host. Throws `BetterAuthError`
+* when the URL cannot be resolved; callers on the direct-API path convert
+* this to `APIError`.
+*/
+async function resolveRequestContext(ctx, source, trustedProxyHeaders) {
+	const dynamicBaseURLConfig = ctx.options.baseURL;
+	const baseURL = resolveBaseURL(dynamicBaseURLConfig, ctx.options.basePath || "/api/auth", source, void 0, trustedProxyHeaders);
+	if (!baseURL) throw new BetterAuthError("Could not resolve base URL from request. Check your allowedHosts config.");
+	const resolved = Object.create(Object.getPrototypeOf(ctx), Object.getOwnPropertyDescriptors(ctx));
+	resolved.baseURL = baseURL;
+	resolved.options = {
+		...ctx.options,
+		baseURL: getOrigin(baseURL) || void 0
+	};
+	const trustedOriginOptions = {
+		...resolved.options,
+		baseURL: dynamicBaseURLConfig
+	};
+	const needsRequest = typeof ctx.options.trustedOrigins === "function" || typeof ctx.options.account?.accountLinking?.trustedProviders === "function";
+	let callbackRequest;
+	if (needsRequest) if (isRequestLike(source)) callbackRequest = source;
+	else if (source) callbackRequest = new Request(baseURL, { headers: source });
+	else callbackRequest = void 0;
+	else callbackRequest = void 0;
+	resolved.trustedOrigins = await getTrustedOrigins(trustedOriginOptions, callbackRequest);
+	resolved.trustedProviders = await getTrustedProviders(resolved.options, callbackRequest);
+	if (ctx.options.advanced?.crossSubDomainCookies?.enabled) {
+		resolved.authCookies = getCookies(resolved.options);
+		resolved.createAuthCookie = createCookieGetter(resolved.options);
+	}
+	return resolved;
+}
+async function getAwaitableValue(arr, item) {
+	if (!arr) return void 0;
+	for (const val of arr) {
+		const value = typeof val === "function" ? await val() : val;
+		if (value[item.field ?? "id"] === item.value) return value;
+	}
+}
+async function getTrustedProviders(options, request) {
+	const trustedProviders = options.account?.accountLinking?.trustedProviders;
+	if (!trustedProviders) return [];
+	if (Array.isArray(trustedProviders)) return trustedProviders.filter((v) => Boolean(v));
+	return (await trustedProviders(request) ?? []).filter((v) => Boolean(v));
+}
+//#endregion
+export { getAwaitableValue, getInternalPlugins, getTrustedOrigins, getTrustedProviders, pickSource, resolveDynamicTrustedProxyHeaders, resolveRequestContext, runPluginInit };

package/dist/context/init-minimal.mjs

@@ -0,0 +1,17 @@
+import { getBaseAdapter } from "../db/adapter-base.mjs";
+import { createAuthContext } from "./create-context.mjs";
+import { BetterAuthError } from "@better-auth/core/error";
+//#region src/context/init-minimal.ts
+const initMinimal = async (options) => {
+	const adapter = await getBaseAdapter(options, async () => {
+		throw new BetterAuthError("Direct database connection requires Kysely. Please use `better-auth` instead of `better-auth/minimal`, or provide an adapter (drizzleAdapter, prismaAdapter, etc.)");
+	});
+	const getDatabaseType = (_database) => "unknown";
+	const ctx = await createAuthContext(adapter, options, getDatabaseType);
+	ctx.runMigrations = async function() {
+		throw new BetterAuthError("Migrations are not supported in 'better-auth/minimal'. Please use 'better-auth' for migration support.");
+	};
+	return ctx;
+};
+//#endregion
+export { initMinimal };

package/dist/context/init.mjs

@@ -0,0 +1,19 @@
+import { getAdapter } from "../db/adapter-kysely.mjs";
+import { getMigrations } from "../db/get-migration.mjs";
+import { createAuthContext } from "./create-context.mjs";
+import { BetterAuthError } from "@better-auth/core/error";
+import { getKyselyDatabaseType } from "@better-auth/kysely-adapter";
+//#region src/context/init.ts
+const init = async (options) => {
+	const adapter = await getAdapter(options);
+	const getDatabaseType = (database) => getKyselyDatabaseType(database) || "unknown";
+	const ctx = await createAuthContext(adapter, options, getDatabaseType);
+	ctx.runMigrations = async function() {
+		if (!options.database || "updateMany" in options.database) throw new BetterAuthError("Database is not provided or it's an adapter. Migrations are only supported with a database instance.");
+		const { runMigrations } = await getMigrations(options);
+		await runMigrations();
+	};
+	return ctx;
+};
+//#endregion
+export { init };

package/dist/context/secret-utils.mjs

@@ -0,0 +1,53 @@
+import "../utils/constants.mjs";
+import { BetterAuthError } from "@better-auth/core/error";
+//#region src/context/secret-utils.ts
+/**
+* Estimates the entropy of a string in bits.
+* This is a simple approximation that helps detect low-entropy secrets.
+*/
+function estimateEntropy(str) {
+	const unique = new Set(str).size;
+	if (unique === 0) return 0;
+	return Math.log2(Math.pow(unique, str.length));
+}
+function parseSecretsEnv(envValue) {
+	if (!envValue) return null;
+	return envValue.split(",").map((entry) => {
+		entry = entry.trim();
+		const colonIdx = entry.indexOf(":");
+		if (colonIdx === -1) throw new BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry: "${entry}". Expected format: "<version>:<secret>"`);
+		const version = parseInt(entry.slice(0, colonIdx), 10);
+		if (!Number.isInteger(version) || version < 0) throw new BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS: "${entry.slice(0, colonIdx)}". Version must be a non-negative integer.`);
+		const value = entry.slice(colonIdx + 1).trim();
+		if (!value) throw new BetterAuthError(`Empty secret value for version ${version} in BETTER_AUTH_SECRETS.`);
+		return {
+			version,
+			value
+		};
+	});
+}
+function validateSecretsArray(secrets, logger) {
+	if (secrets.length === 0) throw new BetterAuthError("`secrets` array must contain at least one entry.");
+	const seen = /* @__PURE__ */ new Set();
+	for (const s of secrets) {
+		const version = parseInt(String(s.version), 10);
+		if (!Number.isInteger(version) || version < 0 || String(version) !== String(s.version).trim()) throw new BetterAuthError(`Invalid version ${s.version} in \`secrets\`. Version must be a non-negative integer.`);
+		if (!s.value) throw new BetterAuthError(`Empty secret value for version ${version} in \`secrets\`.`);
+		if (seen.has(version)) throw new BetterAuthError(`Duplicate version ${version} in \`secrets\`. Each version must be unique.`);
+		seen.add(version);
+	}
+	const current = secrets[0];
+	if (current.value.length < 32) logger.warn(`[better-auth] Warning: the current secret (version ${current.version}) should be at least 32 characters long for adequate security.`);
+	if (estimateEntropy(current.value) < 120) logger.warn("[better-auth] Warning: the current secret appears low-entropy. Use a randomly generated secret for production.");
+}
+function buildSecretConfig(secrets, legacySecret) {
+	const keys = /* @__PURE__ */ new Map();
+	for (const s of secrets) keys.set(parseInt(String(s.version), 10), s.value);
+	return {
+		keys,
+		currentVersion: parseInt(String(secrets[0].version), 10),
+		legacySecret: legacySecret && legacySecret !== "better-auth-secret-12345678901234567890" ? legacySecret : void 0
+	};
+}
+//#endregion
+export { buildSecretConfig, parseSecretsEnv, validateSecretsArray };

package/dist/context/store-capabilities.mjs

@@ -0,0 +1,12 @@
+//#region src/context/store-capabilities.ts
+function hasServerSessionStore(options) {
+	return !!options.database || !!options.secondaryStorage;
+}
+function hasServerAccountStore(options) {
+	return !!options.database;
+}
+function shouldBindAccountCookieToSessionUser(options) {
+	return hasServerAccountStore(options);
+}
+//#endregion
+export { hasServerSessionStore, shouldBindAccountCookieToSessionUser };

package/dist/cookies/cache.mjs

@@ -0,0 +1,33 @@
+import { sessionSchema, userSchema } from "@better-auth/core/db";
+import { logger } from "@better-auth/core/env";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import * as z from "zod";
+//#region src/cookies/cache.ts
+const cookieCachePayloadSchema = z.looseObject({
+	session: sessionSchema.loose(),
+	user: userSchema.loose(),
+	updatedAt: z.number(),
+	version: z.string().optional()
+});
+const compactCookieCacheSchema = z.object({
+	session: z.record(z.string(), z.unknown()),
+	expiresAt: z.number(),
+	signature: z.string()
+});
+function parseCookieCachePayload(value) {
+	const parsed = safeJSONParse(value);
+	if (parsed === null) return null;
+	const result = cookieCachePayloadSchema.safeParse(parsed);
+	if (result.success) return result.data;
+	logger.warn("Cookie cache payload failed schema validation", { issues: result.error.issues.map(({ code, path }) => ({
+		code,
+		path
+	})) });
+	return null;
+}
+function parseCompactCookieCache(value) {
+	const result = compactCookieCacheSchema.safeParse(value);
+	return result.success ? result.data : null;
+}
+//#endregion
+export { parseCompactCookieCache, parseCookieCachePayload };

package/dist/cookies/cookie-utils.d.mts

@@ -0,0 +1,72 @@
+//#region src/cookies/cookie-utils.d.ts
+interface CookieAttributes {
+  value: string;
+  "max-age"?: number | undefined;
+  expires?: Date | undefined;
+  domain?: string | undefined;
+  path?: string | undefined;
+  secure?: boolean | undefined;
+  httponly?: boolean | undefined;
+  partitioned?: boolean | undefined;
+  samesite?: ("strict" | "lax" | "none") | undefined;
+  [key: string]: string | number | boolean | Date | undefined;
+}
+interface ParsedCookieOptions {
+  maxAge?: number | undefined;
+  expires?: Date | undefined;
+  domain?: string | undefined;
+  path?: string | undefined;
+  secure?: boolean | undefined;
+  httpOnly?: boolean | undefined;
+  partitioned?: boolean | undefined;
+  sameSite?: CookieAttributes["samesite"];
+}
+declare const SECURE_COOKIE_PREFIX = "__Secure-";
+declare const HOST_COOKIE_PREFIX = "__Host-";
+/**
+ * Remove __Secure- or __Host- prefix from cookie name.
+ */
+declare function stripSecureCookiePrefix(cookieName: string): string;
+/**
+ * Split a comma-joined `Set-Cookie` header string into individual cookies.
+ */
+declare function splitSetCookieHeader(setCookie: string): string[];
+declare function parseSetCookieHeader(setCookie: string): Map<string, CookieAttributes>;
+declare function toCookieOptions(attributes: CookieAttributes): ParsedCookieOptions;
+/**
+ * Cookie-name token char set per RFC 7230 §3.2.6.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6
+ */
+declare const cookieNameRegex: RegExp;
+/**
+ * Tolerates `;` separators without the SP that RFC 6265 §4.2.1 mandates,
+ * since proxies and runtimes commonly strip it. Silently drops entries
+ * whose name violates RFC 7230 token or whose value violates RFC 6265
+ * cookie-octet (plus space and comma). Strips optional surrounding
+ * double-quotes per RFC 6265 §4.1.1.
+ */
+declare function parseCookies(cookie: string): Map<string, string>;
+/**
+ * Add or replace a cookie in the request `Cookie` header.
+ *
+ * Cookie pairs are joined with `; `, but `headers.append("cookie", ...)`
+ * joins with `, ` in some runtimes (e.g. Deno, Cloudflare Workers) and
+ * breaks downstream cookie parsing. This builds the header value via
+ * parse-mutate-serialize.
+ */
+declare function setRequestCookie(headers: Headers, name: string, value: string): void;
+/**
+ * Merge `Set-Cookie` header values into the target's `Cookie` header.
+ * Mutates `target`.
+ *
+ * Name/value-level merge only. RFC 6265 §5 user-agent semantics
+ * (expiration, domain/path scoping, ordering) are out of scope. Suitable
+ * for single-request proxy, middleware, and test contexts.
+ */
+declare function applySetCookies(target: Headers, setCookieValues: Iterable<string>): void;
+declare function setCookieToHeader(headers: Headers): (context: {
+  response: Response;
+}) => void;
+//#endregion
+export { CookieAttributes, HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, parseCookies, parseSetCookieHeader, setCookieToHeader, setRequestCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions };