@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/cookies/cookie-utils.mjs

@@ -0,0 +1,203 @@
+//#region src/cookies/cookie-utils.ts
+function tryDecode(str) {
+	if (str.indexOf("%") === -1) return str;
+	try {
+		return decodeURIComponent(str);
+	} catch {
+		return str;
+	}
+}
+const SECURE_COOKIE_PREFIX = "__Secure-";
+const HOST_COOKIE_PREFIX = "__Host-";
+/**
+* Remove __Secure- or __Host- prefix from cookie name.
+*/
+function stripSecureCookiePrefix(cookieName) {
+	if (cookieName.startsWith("__Secure-")) return cookieName.slice(9);
+	if (cookieName.startsWith("__Host-")) return cookieName.slice(7);
+	return cookieName;
+}
+/**
+* Split a comma-joined `Set-Cookie` header string into individual cookies.
+*/
+function splitSetCookieHeader(setCookie) {
+	if (!setCookie) return [];
+	const result = [];
+	let start = 0;
+	let i = 0;
+	while (i < setCookie.length) {
+		if (setCookie[i] === ",") {
+			let j = i + 1;
+			while (j < setCookie.length && setCookie[j] === " ") j++;
+			while (j < setCookie.length && setCookie[j] !== "=" && setCookie[j] !== ";" && setCookie[j] !== ",") j++;
+			if (j < setCookie.length && setCookie[j] === "=") {
+				const part = setCookie.slice(start, i).trim();
+				if (part) result.push(part);
+				start = i + 1;
+				while (start < setCookie.length && setCookie[start] === " ") start++;
+				i = start;
+				continue;
+			}
+		}
+		i++;
+	}
+	const last = setCookie.slice(start).trim();
+	if (last) result.push(last);
+	return result;
+}
+function parseSetCookieHeader(setCookie) {
+	const cookies = /* @__PURE__ */ new Map();
+	splitSetCookieHeader(setCookie).forEach((cookieString) => {
+		const [nameValue, ...attributes] = cookieString.split(";").map((part) => part.trim());
+		const [name, ...valueParts] = (nameValue || "").split("=");
+		const value = unquoteCookieValue(valueParts.join("="));
+		if (!name) return;
+		const attrObj = { value: tryDecode(value) };
+		attributes.forEach((attribute) => {
+			const [attrName, ...attrValueParts] = attribute.split("=");
+			const attrValue = attrValueParts.join("=");
+			const normalizedAttrName = attrName.trim().toLowerCase();
+			switch (normalizedAttrName) {
+				case "max-age":
+					attrObj["max-age"] = attrValue ? parseInt(attrValue.trim(), 10) : void 0;
+					break;
+				case "expires":
+					attrObj.expires = attrValue ? new Date(attrValue.trim()) : void 0;
+					break;
+				case "domain":
+					attrObj.domain = attrValue ? attrValue.trim() : void 0;
+					break;
+				case "path":
+					attrObj.path = attrValue ? attrValue.trim() : void 0;
+					break;
+				case "secure":
+					attrObj.secure = true;
+					break;
+				case "httponly":
+					attrObj.httponly = true;
+					break;
+				case "samesite":
+					attrObj.samesite = attrValue ? attrValue.trim().toLowerCase() : void 0;
+					break;
+				case "partitioned":
+					attrObj.partitioned = true;
+					break;
+				default:
+					attrObj[normalizedAttrName] = attrValue ? attrValue.trim() : true;
+					break;
+			}
+		});
+		cookies.set(name, attrObj);
+	});
+	return cookies;
+}
+function toCookieOptions(attributes) {
+	return {
+		maxAge: attributes["max-age"],
+		expires: attributes.expires,
+		domain: attributes.domain,
+		path: attributes.path,
+		secure: attributes.secure,
+		httpOnly: attributes.httponly,
+		sameSite: attributes.samesite,
+		partitioned: attributes.partitioned
+	};
+}
+/**
+* Cookie-name token char set per RFC 7230 §3.2.6.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6
+*/
+const cookieNameRegex = /^[\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E\x5F\x60\x61-\x7A\x7C\x7E]+$/;
+/**
+* Cookie-value char set per RFC 6265 §4.1.1, plus space and comma.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1
+* @see https://github.com/golang/go/issues/7243
+*/
+const cookieValueRegex = /^[\x20\x21\x23-\x3A\x3C-\x5B\x5D-\x7E]*$/;
+/**
+* Strip surrounding double-quotes per RFC 6265 §4.1.1 quoted-string form.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1
+*/
+function unquoteCookieValue(value) {
+	if (value.length < 2 || !value.startsWith("\"") || !value.endsWith("\"")) return value;
+	return value.slice(1, -1);
+}
+/**
+* Trim leading/trailing OWS (space / horizontal tab) per RFC 7230 §3.2.3.
+* Narrower than `String.prototype.trim()`, which strips CR/LF and other
+* whitespace and would let CTLs escape `cookieValueRegex`.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.3
+*/
+function trimOWS(s) {
+	let start = 0;
+	let end = s.length;
+	while (start < end) {
+		const c = s.charCodeAt(start);
+		if (c !== 32 && c !== 9) break;
+		start++;
+	}
+	while (end > start) {
+		const c = s.charCodeAt(end - 1);
+		if (c !== 32 && c !== 9) break;
+		end--;
+	}
+	return start === 0 && end === s.length ? s : s.slice(start, end);
+}
+/**
+* Tolerates `;` separators without the SP that RFC 6265 §4.2.1 mandates,
+* since proxies and runtimes commonly strip it. Silently drops entries
+* whose name violates RFC 7230 token or whose value violates RFC 6265
+* cookie-octet (plus space and comma). Strips optional surrounding
+* double-quotes per RFC 6265 §4.1.1.
+*/
+function parseCookies(cookie) {
+	const cookieMap = /* @__PURE__ */ new Map();
+	if (cookie.length < 2) return cookieMap;
+	for (const chunk of cookie.split(";")) {
+		const eq = chunk.indexOf("=");
+		if (eq === -1) continue;
+		const key = trimOWS(chunk.slice(0, eq));
+		const val = unquoteCookieValue(trimOWS(chunk.slice(eq + 1)));
+		if (cookieNameRegex.test(key) && cookieValueRegex.test(val)) cookieMap.set(key, tryDecode(val));
+	}
+	return cookieMap;
+}
+/**
+* Add or replace a cookie in the request `Cookie` header.
+*
+* Cookie pairs are joined with `; `, but `headers.append("cookie", ...)`
+* joins with `, ` in some runtimes (e.g. Deno, Cloudflare Workers) and
+* breaks downstream cookie parsing. This builds the header value via
+* parse-mutate-serialize.
+*/
+function setRequestCookie(headers, name, value) {
+	const cookieMap = parseCookies(headers.get("cookie") || "");
+	if (cookieNameRegex.test(name)) cookieMap.set(name, value);
+	headers.set("cookie", Array.from(cookieMap, ([k, v]) => `${k}=${encodeURIComponent(v)}`).join("; "));
+}
+/**
+* Merge `Set-Cookie` header values into the target's `Cookie` header.
+* Mutates `target`.
+*
+* Name/value-level merge only. RFC 6265 §5 user-agent semantics
+* (expiration, domain/path scoping, ordering) are out of scope. Suitable
+* for single-request proxy, middleware, and test contexts.
+*/
+function applySetCookies(target, setCookieValues) {
+	const cookieMap = parseCookies(target.get("cookie") || "");
+	for (const setCookie of setCookieValues) for (const [name, attr] of parseSetCookieHeader(setCookie)) if (cookieNameRegex.test(name)) cookieMap.set(name, attr.value);
+	target.set("cookie", Array.from(cookieMap, ([k, v]) => `${k}=${encodeURIComponent(v)}`).join("; "));
+}
+function setCookieToHeader(headers) {
+	return (context) => {
+		const setCookieHeader = context.response.headers.get("set-cookie");
+		if (!setCookieHeader) return;
+		applySetCookies(headers, [setCookieHeader]);
+	};
+}
+//#endregion
+export { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, parseCookies, parseSetCookieHeader, setCookieToHeader, setRequestCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions };

package/dist/cookies/index.d.mts

@@ -0,0 +1,124 @@
+import { Session, User } from "../types/models.mjs";
+import { CookieAttributes, HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, parseCookies, parseSetCookieHeader, setCookieToHeader, setRequestCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions } from "./cookie-utils.mjs";
+import { createSessionStore, getAccountCookie, getChunkedCookie, setAccountCookie } from "./session-store.mjs";
+import { Awaitable, BetterAuthCookie, BetterAuthCookies, BetterAuthOptions, CookieCachePayload, GenericEndpointContext } from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+import { CookieOptions } from "better-call";
+import { JSONWebKeySet } from "jose";
+
+//#region src/cookies/index.d.ts
+declare function createCookieGetter(options: BetterAuthOptions): (cookieName: string, overrideAttributes?: Partial<CookieOptions>) => {
+  name: string;
+  attributes: {
+    domain?: string;
+    expires?: Date;
+    httpOnly: boolean;
+    maxAge?: number;
+    path: string;
+    secure: boolean;
+    sameSite: "Strict" | "Lax" | "None" | "strict" | "lax" | "none";
+    partitioned?: boolean;
+    prefix?: _$better_call0.CookiePrefixOptions;
+  };
+};
+declare function getCookies(options: BetterAuthOptions): {
+  sessionToken: {
+    name: string;
+    attributes: {
+      domain?: string;
+      expires?: Date;
+      httpOnly: boolean;
+      maxAge?: number;
+      path: string;
+      secure: boolean;
+      sameSite: "Strict" | "Lax" | "None" | "strict" | "lax" | "none";
+      partitioned?: boolean;
+      prefix?: _$better_call0.CookiePrefixOptions;
+    };
+  };
+  /**
+   * This cookie is used to store the session data in the cookie
+   * This is useful for when you want to cache the session in the cookie
+   */
+  sessionData: {
+    name: string;
+    attributes: {
+      domain?: string;
+      expires?: Date;
+      httpOnly: boolean;
+      maxAge?: number;
+      path: string;
+      secure: boolean;
+      sameSite: "Strict" | "Lax" | "None" | "strict" | "lax" | "none";
+      partitioned?: boolean;
+      prefix?: _$better_call0.CookiePrefixOptions;
+    };
+  };
+  dontRememberToken: {
+    name: string;
+    attributes: {
+      domain?: string;
+      expires?: Date;
+      httpOnly: boolean;
+      maxAge?: number;
+      path: string;
+      secure: boolean;
+      sameSite: "Strict" | "Lax" | "None" | "strict" | "lax" | "none";
+      partitioned?: boolean;
+      prefix?: _$better_call0.CookiePrefixOptions;
+    };
+  };
+  accountData: {
+    name: string;
+    attributes: {
+      domain?: string;
+      expires?: Date;
+      httpOnly: boolean;
+      maxAge?: number;
+      path: string;
+      secure: boolean;
+      sameSite: "Strict" | "Lax" | "None" | "strict" | "lax" | "none";
+      partitioned?: boolean;
+      prefix?: _$better_call0.CookiePrefixOptions;
+    };
+  };
+};
+declare function setCookieCache(ctx: GenericEndpointContext, session: {
+  session: Session & Record<string, unknown>;
+  user: User;
+}, dontRememberMe: boolean): Promise<void>;
+declare function decodeCookieCache(ctx: GenericEndpointContext, value: string): Promise<{
+  session: CookieCachePayload;
+  expiresAt: number;
+} | null>;
+declare function setSessionCookie(ctx: GenericEndpointContext, session: {
+  session: Session & Record<string, unknown>;
+  user: User;
+}, dontRememberMe?: boolean | undefined, overrides?: Partial<CookieOptions> | undefined): Promise<void>;
+/**
+ * Expires a cookie by setting `maxAge: 0` while preserving its attributes
+ */
+declare function expireCookie(ctx: GenericEndpointContext, cookie: BetterAuthCookie): void;
+declare function deleteSessionCookie(ctx: GenericEndpointContext, skipDontRememberMe?: boolean | undefined): void;
+type EligibleCookies = (string & {}) | (keyof BetterAuthCookies & {});
+declare const getSessionCookie: (request: Request | Headers, config?: {
+  cookiePrefix?: string;
+  cookieName?: string;
+  path?: string;
+} | undefined) => string | null;
+type CookieCacheVersion = string | ((session: CookieCachePayload["session"], user: CookieCachePayload["user"]) => Awaitable<string>);
+declare const getCookieCache: <S extends CookieCachePayload = CookieCachePayload>(request: Request | Headers, config?: {
+  cookiePrefix?: string;
+  cookieName?: string;
+  isSecure?: boolean;
+  secret?: string;
+  strategy?: "compact" | "jwt" | "jwe";
+  jwt?: {
+    jwks?: JSONWebKeySet;
+    issuer?: string;
+    audience?: string;
+  } | undefined;
+  version?: CookieCacheVersion;
+} | undefined) => Promise<S | null>;
+//#endregion
+export { CookieAttributes, EligibleCookies, HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, createCookieGetter, createSessionStore, decodeCookieCache, deleteSessionCookie, expireCookie, getAccountCookie, getChunkedCookie, getCookieCache, getCookies, getSessionCookie, parseCookies, parseSetCookieHeader, setAccountCookie, setCookieCache, setCookieToHeader, setRequestCookie, setSessionCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions };

package/dist/cookies/index.mjs

@@ -0,0 +1,350 @@
+import { isDynamicBaseURLConfig } from "../utils/url.mjs";
+import { shouldBindAccountCookieToSessionUser } from "../context/store-capabilities.mjs";
+import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "../crypto/jwt.mjs";
+import { parseUserOutput } from "../db/schema.mjs";
+import { getDate } from "../utils/date.mjs";
+import { isPromise } from "../utils/is-promise.mjs";
+import { sec } from "../utils/time.mjs";
+import { parseCompactCookieCache, parseCookieCachePayload } from "./cache.mjs";
+import { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, parseCookies, parseSetCookieHeader, setCookieToHeader, setRequestCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions } from "./cookie-utils.mjs";
+import { verifySessionCookieJwtWithJwks } from "./jwt.mjs";
+import { createAccountStore, createSessionStore, getAccountCookie, getChunkedCookie, setAccountCookie } from "./session-store.mjs";
+import { env, isProduction } from "@better-auth/core/env";
+import { BetterAuthError } from "@better-auth/core/error";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import { filterOutputFields } from "@better-auth/core/utils/db";
+import { base64Url } from "@better-auth/utils/base64";
+import { binary } from "@better-auth/utils/binary";
+import { createHMAC } from "@better-auth/utils/hmac";
+//#region src/cookies/index.ts
+function createCookieGetter(options) {
+	const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0;
+	const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0;
+	const secureCookiePrefix = (options.advanced?.useSecureCookies !== void 0 ? options.advanced?.useSecureCookies : dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("https://") : isProduction) ? SECURE_COOKIE_PREFIX : "";
+	const crossSubdomainEnabled = !!options.advanced?.crossSubDomainCookies?.enabled;
+	const domain = crossSubdomainEnabled ? options.advanced?.crossSubDomainCookies?.domain || (baseURLString ? new URL(baseURLString).hostname : void 0) : void 0;
+	if (crossSubdomainEnabled && !domain && !isDynamicBaseURLConfig(options.baseURL)) throw new BetterAuthError("baseURL is required when crossSubdomainCookies are enabled.");
+	function createCookie(cookieName, overrideAttributes = {}) {
+		const prefix = options.advanced?.cookiePrefix || "better-auth";
+		const name = options.advanced?.cookies?.[cookieName]?.name || `${prefix}.${cookieName}`;
+		const attributes = options.advanced?.cookies?.[cookieName]?.attributes ?? {};
+		return {
+			name: `${secureCookiePrefix}${name}`,
+			attributes: {
+				secure: !!secureCookiePrefix,
+				sameSite: "lax",
+				path: "/",
+				httpOnly: true,
+				...crossSubdomainEnabled ? { domain } : {},
+				...options.advanced?.defaultCookieAttributes,
+				...overrideAttributes,
+				...attributes
+			}
+		};
+	}
+	return createCookie;
+}
+function getCookies(options) {
+	const createCookie = createCookieGetter(options);
+	const sessionToken = createCookie("session_token", { maxAge: options.session?.expiresIn || sec("7d") });
+	const sessionData = createCookie("session_data", { maxAge: options.session?.cookieCache?.maxAge || 300 });
+	const accountData = createCookie("account_data", { maxAge: options.session?.cookieCache?.maxAge || 300 });
+	const dontRememberToken = createCookie("dont_remember");
+	return {
+		sessionToken: {
+			name: sessionToken.name,
+			attributes: sessionToken.attributes
+		},
+		/**
+		* This cookie is used to store the session data in the cookie
+		* This is useful for when you want to cache the session in the cookie
+		*/
+		sessionData: {
+			name: sessionData.name,
+			attributes: sessionData.attributes
+		},
+		dontRememberToken: {
+			name: dontRememberToken.name,
+			attributes: dontRememberToken.attributes
+		},
+		accountData: {
+			name: accountData.name,
+			attributes: accountData.attributes
+		}
+	};
+}
+async function setCookieCache(ctx, session, dontRememberMe) {
+	if (!ctx.context.options.session?.cookieCache?.enabled) return;
+	const filteredSession = filterOutputFields(session.session, ctx.context.options.session?.additionalFields);
+	const filteredUser = parseUserOutput(ctx.context.options, session.user);
+	const versionConfig = ctx.context.options.session?.cookieCache?.version;
+	let version = "1";
+	if (versionConfig) {
+		if (typeof versionConfig === "string") version = versionConfig;
+		else if (typeof versionConfig === "function") {
+			const result = versionConfig(session.session, session.user);
+			version = isPromise(result) ? await result : result;
+		}
+	}
+	const sessionData = {
+		session: filteredSession,
+		user: filteredUser,
+		updatedAt: Date.now(),
+		version
+	};
+	const options = {
+		...ctx.context.authCookies.sessionData.attributes,
+		maxAge: dontRememberMe ? void 0 : ctx.context.authCookies.sessionData.attributes.maxAge
+	};
+	const expiresAtDate = getDate(options.maxAge || 60, "sec").getTime();
+	const strategy = ctx.context.options.session?.cookieCache?.strategy || "compact";
+	let data;
+	if (strategy === "jwe") data = await symmetricEncodeJWT(sessionData, ctx.context.secretConfig, "better-auth-session", options.maxAge || 300);
+	else if (strategy === "jwt") {
+		const cookieCacheSigner = ctx.context.sessionConfig.cookieCacheSigner;
+		data = cookieCacheSigner ? await cookieCacheSigner.sign(ctx, sessionData, options.maxAge || 300) : await signJWT(sessionData, ctx.context.secret, options.maxAge || 300);
+	} else data = base64Url.encode(JSON.stringify({
+		session: sessionData,
+		expiresAt: expiresAtDate,
+		signature: await createHMAC("SHA-256", "base64urlnopad").sign(ctx.context.secret, JSON.stringify({
+			...sessionData,
+			expiresAt: expiresAtDate
+		}))
+	}), { padding: false });
+	const sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
+	sessionStore.setCookies(sessionStore.chunk(data, options));
+	if (ctx.context.options.account?.storeAccountCookie && !hasPendingSetCookie(ctx, ctx.context.authCookies.accountData.name)) {
+		const accountData = await getAccountCookie(ctx);
+		if (accountData) if (!shouldBindAccountCookieToSessionUser(ctx.context.options) || accountData.userId === session.user.id) await setAccountCookie(ctx, accountData);
+		else {
+			expireCookie(ctx, ctx.context.authCookies.accountData);
+			const accountStore = createAccountStore(ctx.context.authCookies.accountData.name, ctx.context.authCookies.accountData.attributes, ctx);
+			accountStore.setCookies(accountStore.clean());
+		}
+	}
+}
+async function decodeCookieCache(ctx, value) {
+	const strategy = ctx.context.options.session?.cookieCache?.strategy || "compact";
+	if (strategy === "jwe") {
+		const decoded = await symmetricDecodeJWT(value, ctx.context.secretConfig, "better-auth-session");
+		const payload = parseCookieCachePayload(decoded);
+		if (!payload) return null;
+		return {
+			session: payload,
+			expiresAt: decoded?.exp ? decoded.exp * 1e3 : Date.now()
+		};
+	}
+	if (strategy === "jwt") {
+		const cookieCacheSigner = ctx.context.sessionConfig.cookieCacheSigner;
+		if (cookieCacheSigner) {
+			const verified = await cookieCacheSigner.verify(ctx, value);
+			if (!verified) return null;
+			return {
+				session: verified.payload,
+				expiresAt: verified.expiresAt
+			};
+		}
+		const decoded = await verifyJWT(value, ctx.context.secret);
+		const payload = parseCookieCachePayload(decoded);
+		if (!payload) return null;
+		return {
+			session: payload,
+			expiresAt: decoded?.exp ? decoded.exp * 1e3 : Date.now()
+		};
+	}
+	const parsed = parseCompactCookieCache(safeJSONParse(binary.decode(base64Url.decode(value))));
+	if (!parsed) return null;
+	if (!await createHMAC("SHA-256", "base64urlnopad").verify(ctx.context.secret, JSON.stringify({
+		...parsed.session,
+		expiresAt: parsed.expiresAt
+	}), parsed.signature)) return null;
+	const payload = parseCookieCachePayload(parsed.session);
+	return payload ? {
+		session: payload,
+		expiresAt: parsed.expiresAt
+	} : null;
+}
+async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
+	const dontRememberMeCookie = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
+	dontRememberMe = dontRememberMe !== void 0 ? dontRememberMe : !!dontRememberMeCookie;
+	const options = ctx.context.authCookies.sessionToken.attributes;
+	const maxAge = dontRememberMe ? void 0 : ctx.context.sessionConfig.expiresIn;
+	await ctx.setSignedCookie(ctx.context.authCookies.sessionToken.name, session.session.token, ctx.context.secret, {
+		...options,
+		maxAge,
+		...overrides
+	});
+	if (dontRememberMe) await ctx.setSignedCookie(ctx.context.authCookies.dontRememberToken.name, "true", ctx.context.secret, ctx.context.authCookies.dontRememberToken.attributes);
+	await setCookieCache(ctx, session, dontRememberMe);
+	ctx.context.setNewSession(session);
+}
+/**
+* Remove any prior `Set-Cookie` entries on the current response whose cookie
+* name matches `cookieName` or any chunked variant (`${cookieName}.0`, etc.).
+*
+* Prevents a valid cookie value from leaking on the wire when the same cookie
+* is set and then expired within a single request (e.g. `/sign-in/email`
+* writes credential session cookies and the 2FA after-hook expires them).
+* Browsers honor the expiring entry, but anything reading the raw response
+* headers — proxy/LB logs, server-side SDK consumers, observability tools —
+* sees the earlier valid value and could replay it (bypassing the 2FA gate
+* when the cookie cache is enabled).
+*
+* Scrubs both the local middleware scope's `responseHeaders` and the outer
+* endpoint scope's `ctx.context.responseHeaders`, because plugin after-hooks
+* run in a fresh local scope while accumulated response headers live on the
+* outer one. `scoped.context` is required by {@link GenericEndpointContext}
+* but unit-test mocks pass a minimal object via `as any`, so we use optional
+* chaining defensively. The `Set` collapses the case where both scopes
+* reference the same `Headers`.
+*/
+function removeSetCookieEntries(ctx, cookieName) {
+	const scoped = ctx;
+	const targets = /* @__PURE__ */ new Set();
+	if (scoped.responseHeaders) targets.add(scoped.responseHeaders);
+	if (scoped.context?.responseHeaders) targets.add(scoped.context.responseHeaders);
+	const exact = `${cookieName}=`;
+	const chunk = `${cookieName}.`;
+	for (const headers of targets) {
+		const existing = typeof headers.getSetCookie === "function" ? headers.getSetCookie() : splitSetCookieHeader(headers.get("set-cookie") || "");
+		if (!existing.length) continue;
+		const survivors = existing.filter((entry) => !entry.startsWith(exact) && !entry.startsWith(chunk));
+		if (survivors.length === existing.length) continue;
+		headers.delete("set-cookie");
+		for (const entry of survivors) headers.append("set-cookie", entry);
+	}
+}
+/**
+* Whether the response already has a pending `Set-Cookie` for `cookieName`
+* or a chunked variant.
+*/
+function hasPendingSetCookie(ctx, cookieName) {
+	const scoped = ctx;
+	const targets = /* @__PURE__ */ new Set();
+	if (scoped.responseHeaders) targets.add(scoped.responseHeaders);
+	if (scoped.context?.responseHeaders) targets.add(scoped.context.responseHeaders);
+	const exact = `${cookieName}=`;
+	const chunk = `${cookieName}.`;
+	for (const headers of targets) if ((typeof headers.getSetCookie === "function" ? headers.getSetCookie() : splitSetCookieHeader(headers.get("set-cookie") || "")).some((entry) => entry.startsWith(exact) || entry.startsWith(chunk))) return true;
+	return false;
+}
+/**
+* Expires a cookie by setting `maxAge: 0` while preserving its attributes
+*/
+function expireCookie(ctx, cookie) {
+	removeSetCookieEntries(ctx, cookie.name);
+	ctx.setCookie(cookie.name, "", {
+		...cookie.attributes,
+		maxAge: 0
+	});
+}
+function deleteSessionCookie(ctx, skipDontRememberMe) {
+	expireCookie(ctx, ctx.context.authCookies.sessionToken);
+	expireCookie(ctx, ctx.context.authCookies.sessionData);
+	if (ctx.context.options.account?.storeAccountCookie) {
+		expireCookie(ctx, ctx.context.authCookies.accountData);
+		const accountStore = createAccountStore(ctx.context.authCookies.accountData.name, ctx.context.authCookies.accountData.attributes, ctx);
+		const cleanCookies = accountStore.clean();
+		accountStore.setCookies(cleanCookies);
+	}
+	if (ctx.context.oauthConfig.storeStateStrategy === "cookie") expireCookie(ctx, ctx.context.createAuthCookie("oauth_state"));
+	const sessionStore = createSessionStore(ctx.context.authCookies.sessionData.name, ctx.context.authCookies.sessionData.attributes, ctx);
+	const cleanCookies = sessionStore.clean();
+	sessionStore.setCookies(cleanCookies);
+	if (!skipDontRememberMe) expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
+}
+function isEmbeddedSessionExpired(session) {
+	if (!session?.expiresAt) return false;
+	const expiresAt = new Date(session.expiresAt).getTime();
+	return Number.isFinite(expiresAt) && expiresAt < Date.now();
+}
+const getSessionCookie = (request, config) => {
+	const cookies = (request instanceof Headers || !("headers" in request) ? request : request.headers).get("cookie");
+	if (!cookies) return null;
+	const { cookieName = "session_token", cookiePrefix = "better-auth" } = config || {};
+	const parsedCookie = parseCookies(cookies);
+	const getCookie = (name) => parsedCookie.get(`__Secure-${name}`) ?? parsedCookie.get(name);
+	const sessionToken = getCookie(`${cookiePrefix}.${cookieName}`) || getCookie(`${cookiePrefix}-${cookieName}`);
+	if (sessionToken) return sessionToken;
+	return null;
+};
+async function matchesVersion(payload, version) {
+	const expectedVersion = typeof version === "string" ? version : await version(payload.session, payload.user);
+	return (payload.version || "1") === expectedVersion;
+}
+const getCookieCache = async (request, config) => {
+	const cookies = (request instanceof Headers || !("headers" in request) ? request : request.headers).get("cookie");
+	if (!cookies) return null;
+	const { cookieName = "session_data", cookiePrefix = "better-auth" } = config || {};
+	const name = config?.isSecure !== void 0 ? config.isSecure ? `${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}` : isProduction ? `${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}`;
+	const parsedCookie = parseCookies(cookies);
+	let sessionData = parsedCookie.get(name);
+	if (!sessionData) {
+		const chunks = [];
+		for (const [cookieName, value] of parsedCookie.entries()) if (cookieName.startsWith(name + ".")) {
+			const parts = cookieName.split(".");
+			const indexStr = parts[parts.length - 1];
+			const index = parseInt(indexStr || "0", 10);
+			if (!isNaN(index)) chunks.push({
+				index,
+				value
+			});
+		}
+		if (chunks.length > 0) {
+			chunks.sort((a, b) => a.index - b.index);
+			sessionData = chunks.map((c) => c.value).join("");
+		}
+	}
+	if (sessionData) {
+		const strategy = config?.strategy || "compact";
+		if (strategy === "jwe") {
+			const secret = config?.secret || env.BETTER_AUTH_SECRET;
+			if (!secret) throw new BetterAuthError("getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable");
+			const payload = parseCookieCachePayload(await symmetricDecodeJWT(sessionData, secret, "better-auth-session"));
+			if (!payload) return null;
+			if (config?.version) {
+				if (!await matchesVersion(payload, config.version)) return null;
+			}
+			if (isEmbeddedSessionExpired(payload.session)) return null;
+			return payload;
+		} else if (strategy === "jwt") {
+			const jwks = config?.jwt?.jwks;
+			let payload;
+			if (jwks) payload = await verifySessionCookieJwtWithJwks(sessionData, jwks, {
+				issuer: config?.jwt?.issuer,
+				audience: config?.jwt?.audience
+			});
+			else {
+				const secret = config?.secret || env.BETTER_AUTH_SECRET;
+				if (!secret) throw new BetterAuthError("getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable");
+				payload = parseCookieCachePayload(await verifyJWT(sessionData, secret));
+			}
+			if (!payload) return null;
+			if (config?.version) {
+				if (!await matchesVersion(payload, config.version)) return null;
+			}
+			if (isEmbeddedSessionExpired(payload.session)) return null;
+			return payload;
+		} else {
+			const secret = config?.secret || env.BETTER_AUTH_SECRET;
+			if (!secret) throw new BetterAuthError("getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable");
+			const sessionDataPayload = parseCompactCookieCache(safeJSONParse(binary.decode(base64Url.decode(sessionData))));
+			if (!sessionDataPayload) return null;
+			if (!await createHMAC("SHA-256", "base64urlnopad").verify(secret, JSON.stringify({
+				...sessionDataPayload.session,
+				expiresAt: sessionDataPayload.expiresAt
+			}), sessionDataPayload.signature)) return null;
+			const payload = parseCookieCachePayload(sessionDataPayload.session);
+			if (!payload) return null;
+			if (config?.version) {
+				if (!await matchesVersion(payload, config.version)) return null;
+			}
+			if (typeof sessionDataPayload.expiresAt === "number" && sessionDataPayload.expiresAt < Date.now()) return null;
+			if (isEmbeddedSessionExpired(payload.session)) return null;
+			return payload;
+		}
+	}
+	return null;
+};
+//#endregion
+export { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, applySetCookies, cookieNameRegex, createCookieGetter, createSessionStore, decodeCookieCache, deleteSessionCookie, expireCookie, getAccountCookie, getChunkedCookie, getCookieCache, getCookies, getSessionCookie, parseCookies, parseSetCookieHeader, setAccountCookie, setCookieCache, setCookieToHeader, setRequestCookie, setSessionCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions };