@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/cookies/jwt.mjs

@@ -0,0 +1,44 @@
+import { parseCookieCachePayload } from "./cache.mjs";
+import { decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+//#region src/cookies/jwt.ts
+const SESSION_COOKIE_JWT_TYPE = "better-auth.session-cache+jwt";
+const SESSION_COOKIE_JWT_AUDIENCE = "better-auth:session-cache";
+const SESSION_COOKIE_JWT_ISSUER = "better-auth:session-cache";
+function getSessionCookieJwtVerifyOptions(options) {
+	const verifyOptions = {
+		clockTolerance: 15,
+		audience: options?.audience ?? "better-auth:session-cache"
+	};
+	if (options?.issuer) verifyOptions.issuer = options.issuer;
+	return verifyOptions;
+}
+function parseSessionCookieJwtPayload(payload) {
+	const data = parseCookieCachePayload(payload);
+	if (!data || typeof payload.iss !== "string" || !payload.iss) return null;
+	if (payload.sub !== data.user.id || payload.sid !== data.session.token) return null;
+	return {
+		...payload,
+		...data
+	};
+}
+async function verifySessionCookieJwtWithJwks(token, jwks, options) {
+	try {
+		const header = decodeProtectedHeader(token);
+		if (header.typ !== "better-auth.session-cache+jwt") return null;
+		const kid = header.kid;
+		if (!kid) return null;
+		const key = jwks.keys.find((entry) => entry.kid === kid);
+		if (!key) return null;
+		const alg = key.alg ?? header.alg;
+		if (!alg) return null;
+		const { payload } = await jwtVerify(token, await importJWK(key, alg), {
+			...getSessionCookieJwtVerifyOptions(options),
+			algorithms: [alg]
+		});
+		return parseSessionCookieJwtPayload(payload);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { SESSION_COOKIE_JWT_AUDIENCE, SESSION_COOKIE_JWT_ISSUER, SESSION_COOKIE_JWT_TYPE, getSessionCookieJwtVerifyOptions, parseSessionCookieJwtPayload, verifySessionCookieJwtWithJwks };

package/dist/cookies/session-store.d.mts

@@ -0,0 +1,32 @@
+import { GenericEndpointContext } from "@better-auth/core";
+import { CookieOptions } from "better-call";
+//#region src/cookies/session-store.d.ts
+interface Cookie {
+  name: string;
+  value: string;
+  attributes: CookieOptions;
+}
+declare const createSessionStore: (cookieName: string, cookieOptions: CookieOptions, ctx: GenericEndpointContext) => {
+  chunk(value: string, options?: Partial<CookieOptions>): Cookie[];
+  clean(): Cookie[];
+  setCookies(cookies: Cookie[]): void;
+};
+declare function getChunkedCookie(ctx: GenericEndpointContext, cookieName: string): string | null;
+declare function setAccountCookie(c: GenericEndpointContext, accountData: Record<string, any>): Promise<void>;
+declare function getAccountCookie(c: GenericEndpointContext): Promise<{
+  id: string;
+  createdAt: Date;
+  updatedAt: Date;
+  providerId: string;
+  accountId: string;
+  userId: string;
+  accessToken?: string | null | undefined;
+  refreshToken?: string | null | undefined;
+  idToken?: string | null | undefined;
+  accessTokenExpiresAt?: Date | null | undefined;
+  refreshTokenExpiresAt?: Date | null | undefined;
+  scope?: string | null | undefined;
+  password?: string | null | undefined;
+} | null>;
+//#endregion
+export { createSessionStore, getAccountCookie, getChunkedCookie, setAccountCookie };

package/dist/cookies/session-store.mjs

@@ -0,0 +1,183 @@
+import { symmetricDecodeJWT, symmetricEncodeJWT } from "../crypto/jwt.mjs";
+import { parseCookies } from "./cookie-utils.mjs";
+import { safeJSONParse } from "@better-auth/core/utils/json";
+import { serializeCookie } from "better-call";
+import * as z from "zod";
+//#region src/cookies/session-store.ts
+/**
+* Per-cookie byte ceiling.
+* Safari's ~4093 floor is the lowest among browsers.
+* Kept a little under it for attributes added after sizing.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6265#section-6.1
+* @see https://github.com/dotnet/aspnetcore/blob/aa5493528640932601bb82ef3295e4d8ca7e11c5/src/Shared/ChunkingCookieManager/ChunkingCookieManager.cs#L40
+*/
+const MAX_COOKIE_SIZE = 4050;
+/**
+* Max chunks per cookie.
+* A larger value does not belong in a cookie.
+*/
+const MAX_COOKIE_CHUNKS = 100;
+/**
+* Largest value that keeps the serialized cookie within {@link MAX_COOKIE_SIZE},
+* measured with the real `serializeCookie` writer so it stays in sync with the
+* wire. Non-positive when the name and attributes alone overflow.
+*/
+function getMaxCookieValueSize(name, options) {
+	return MAX_COOKIE_SIZE - serializeCookie(name, "", { ...options }).length;
+}
+function parseCookieChunkIndex(cookieName, name) {
+	const prefix = `${cookieName}.`;
+	if (!name.startsWith(prefix)) return null;
+	const suffix = name.slice(prefix.length);
+	const index = Number(suffix);
+	if (!Number.isSafeInteger(index) || index < 0 || String(index) !== suffix) return null;
+	return index;
+}
+/**
+* Read all existing chunks from cookies
+*/
+function readExistingChunks(cookieName, ctx) {
+	const chunks = {};
+	const cookies = parseCookies(ctx.headers?.get("cookie") || "");
+	for (const [name, value] of cookies) {
+		if (name !== cookieName && parseCookieChunkIndex(cookieName, name) === null) continue;
+		chunks[name] = value;
+	}
+	return chunks;
+}
+/**
+* Split a cookie value into chunks if needed
+*/
+function chunkCookie(storeName, cookie, chunks, logger) {
+	const chunkSize = getMaxCookieValueSize(`${cookie.name}.${MAX_COOKIE_CHUNKS - 1}`, cookie.attributes);
+	const chunkCount = chunkSize > 0 ? Math.ceil(cookie.value.length / chunkSize) : Infinity;
+	if (chunkCount <= 1) {
+		chunks[cookie.name] = cookie.value;
+		return [cookie];
+	}
+	if (chunkCount > MAX_COOKIE_CHUNKS) {
+		logger.warn(`${storeName} cookie is too large to store even after chunking, so the cookie cache was skipped. Reduce the cached data size or avoid storing this data in cookies.`);
+		return [];
+	}
+	const cookies = [];
+	for (let i = 0; i < chunkCount; i++) {
+		const name = `${cookie.name}.${i}`;
+		const start = i * chunkSize;
+		const value = cookie.value.substring(start, start + chunkSize);
+		cookies.push({
+			...cookie,
+			name,
+			value
+		});
+		chunks[name] = value;
+	}
+	logger.debug(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {
+		message: `${storeName} cookie exceeds the ${MAX_COOKIE_SIZE} byte limit and was split into ${chunkCount} chunks.`,
+		valueSize: cookie.value.length,
+		chunkCount,
+		chunkSizes: cookies.map((c) => c.value.length)
+	});
+	return cookies;
+}
+/**
+* Get all cookies that should be cleaned (removed)
+*/
+function getCleanCookies(chunks, cookieOptions) {
+	const cleanedChunks = {};
+	for (const name in chunks) cleanedChunks[name] = {
+		name,
+		value: "",
+		attributes: {
+			...cookieOptions,
+			maxAge: 0
+		}
+	};
+	return cleanedChunks;
+}
+/**
+* Store that splits a cookie into numbered chunks when its serialized form
+* would exceed the per-cookie byte limit, expiring stale chunks as needed.
+*
+* @see https://github.com/nextauthjs/next-auth/blob/27b2519b84b8eb9cf053775dea29d577d2aa0098/packages/next-auth/src/core/lib/cookie.ts
+*/
+const storeFactory = (storeName) => (cookieName, cookieOptions, ctx) => {
+	const chunks = readExistingChunks(cookieName, ctx);
+	const logger = ctx.context.logger;
+	const expireExistingChunks = () => {
+		const expired = getCleanCookies(chunks, cookieOptions);
+		for (const name in chunks) delete chunks[name];
+		return expired;
+	};
+	return {
+		chunk(value, options) {
+			const cookies = expireExistingChunks();
+			const chunked = chunkCookie(storeName, {
+				name: cookieName,
+				value,
+				attributes: {
+					...cookieOptions,
+					...options
+				}
+			}, chunks, logger);
+			for (const chunk of chunked) cookies[chunk.name] = chunk;
+			return Object.values(cookies);
+		},
+		clean() {
+			return Object.values(expireExistingChunks());
+		},
+		setCookies(cookies) {
+			for (const cookie of cookies) ctx.setCookie(cookie.name, cookie.value, cookie.attributes);
+		}
+	};
+};
+const createSessionStore = storeFactory("Session");
+const createAccountStore = storeFactory("Account");
+function getChunkedCookie(ctx, cookieName) {
+	const value = ctx.getCookie(cookieName);
+	if (value) return value;
+	const chunks = [];
+	const cookieHeader = ctx.headers?.get("cookie");
+	if (!cookieHeader) return null;
+	for (const [name, val] of parseCookies(cookieHeader)) {
+		const index = parseCookieChunkIndex(cookieName, name);
+		if (index === null) continue;
+		chunks.push({
+			index,
+			value: val
+		});
+	}
+	if (chunks.length > 0) {
+		chunks.sort((a, b) => a.index - b.index);
+		return chunks.map((c) => c.value).join("");
+	}
+	return null;
+}
+async function setAccountCookie(c, accountData) {
+	const accountDataCookie = c.context.authCookies.accountData;
+	const options = {
+		maxAge: 300,
+		...accountDataCookie.attributes
+	};
+	const data = await symmetricEncodeJWT(accountData, c.context.secretConfig, "better-auth-account", options.maxAge);
+	const accountStore = createAccountStore(accountDataCookie.name, options, c);
+	accountStore.setCookies(accountStore.chunk(data, options));
+}
+async function getAccountCookie(c) {
+	const accountCookie = getChunkedCookie(c, c.context.authCookies.accountData.name);
+	if (accountCookie) {
+		const accountData = safeJSONParse(await symmetricDecodeJWT(accountCookie, c.context.secretConfig, "better-auth-account"));
+		if (accountData) return accountData;
+	}
+	return null;
+}
+const getSessionQuerySchema = z.optional(z.object({
+	/**
+	* If cookie cache is enabled, it will disable the cache
+	* and fetch the session from the database
+	*/
+	disableCookieCache: z.coerce.boolean().meta({ description: "Disable cookie cache and fetch session from database" }).optional(),
+	disableRefresh: z.coerce.boolean().meta({ description: "Disable session refresh. Useful for checking session status, without updating the session" }).optional()
+}));
+//#endregion
+export { createAccountStore, createSessionStore, getAccountCookie, getChunkedCookie, getSessionQuerySchema, setAccountCookie };

package/dist/crypto/buffer.d.mts

@@ -0,0 +1,7 @@
+//#region src/crypto/buffer.d.ts
+/**
+ * Compare two buffers in constant time.
+ */
+declare function constantTimeEqual(a: ArrayBuffer | Uint8Array | string, b: ArrayBuffer | Uint8Array | string): boolean;
+//#endregion
+export { constantTimeEqual };

package/dist/crypto/buffer.mjs

@@ -0,0 +1,16 @@
+//#region src/crypto/buffer.ts
+/**
+* Compare two buffers in constant time.
+*/
+function constantTimeEqual(a, b) {
+	if (typeof a === "string") a = new TextEncoder().encode(a);
+	if (typeof b === "string") b = new TextEncoder().encode(b);
+	const aBuffer = new Uint8Array(a);
+	const bBuffer = new Uint8Array(b);
+	let c = aBuffer.length ^ bBuffer.length;
+	const length = Math.max(aBuffer.length, bBuffer.length);
+	for (let i = 0; i < length; i++) c |= (i < aBuffer.length ? aBuffer[i] : 0) ^ (i < bBuffer.length ? bBuffer[i] : 0);
+	return c === 0;
+}
+//#endregion
+export { constantTimeEqual };

package/dist/crypto/index.d.mts

@@ -0,0 +1,32 @@
+import { constantTimeEqual } from "./buffer.mjs";
+import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "./jwt.mjs";
+import { hashPassword, verifyPassword } from "./password.mjs";
+import { generateRandomString } from "./random.mjs";
+import { SecretConfig } from "@better-auth/core";
+
+//#region src/crypto/index.d.ts
+declare function parseEnvelope(data: string): {
+  version: number;
+  ciphertext: string;
+} | null;
+declare function formatEnvelope(version: number, ciphertext: string): string;
+type SymmetricEncryptOptions = {
+  key: string | SecretConfig;
+  data: string;
+};
+declare const symmetricEncrypt: ({
+  key,
+  data
+}: SymmetricEncryptOptions) => Promise<string>;
+type SymmetricDecryptOptions = {
+  key: string | SecretConfig;
+  data: string;
+};
+declare const symmetricDecrypt: ({
+  key,
+  data
+}: SymmetricDecryptOptions) => Promise<string>;
+declare const getCryptoKey: (secret: string | BufferSource) => Promise<CryptoKey>;
+declare const makeSignature: (value: string, secret: string | BufferSource) => Promise<string>;
+//#endregion
+export { type SecretConfig, SymmetricDecryptOptions, SymmetricEncryptOptions, constantTimeEqual, formatEnvelope, generateRandomString, getCryptoKey, hashPassword, makeSignature, parseEnvelope, signJWT, symmetricDecodeJWT, symmetricDecrypt, symmetricEncodeJWT, symmetricEncrypt, verifyJWT, verifyPassword };

package/dist/crypto/index.mjs

@@ -0,0 +1,69 @@
+import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "./jwt.mjs";
+import { constantTimeEqual } from "./buffer.mjs";
+import { hashPassword, verifyPassword } from "./password.mjs";
+import { generateRandomString } from "./random.mjs";
+import { getWebcryptoSubtle } from "@better-auth/utils";
+import { createHash } from "@better-auth/utils/hash";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { bytesToHex, hexToBytes, managedNonce, utf8ToBytes } from "@noble/ciphers/utils.js";
+//#region src/crypto/index.ts
+const algorithm = {
+	name: "HMAC",
+	hash: "SHA-256"
+};
+const ENVELOPE_PREFIX = "$ba$";
+function parseEnvelope(data) {
+	if (!data.startsWith(ENVELOPE_PREFIX)) return null;
+	const firstSep = 4;
+	const secondSep = data.indexOf("$", firstSep);
+	if (secondSep === -1) return null;
+	const version = parseInt(data.slice(firstSep, secondSep), 10);
+	if (!Number.isInteger(version) || version < 0) return null;
+	return {
+		version,
+		ciphertext: data.slice(secondSep + 1)
+	};
+}
+function formatEnvelope(version, ciphertext) {
+	return `${ENVELOPE_PREFIX}${version}$${ciphertext}`;
+}
+async function rawEncrypt(secret, data) {
+	const keyAsBytes = await createHash("SHA-256").digest(secret);
+	const dataAsBytes = utf8ToBytes(data);
+	return bytesToHex(managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes)).encrypt(dataAsBytes));
+}
+async function rawDecrypt(secret, hex) {
+	const keyAsBytes = await createHash("SHA-256").digest(secret);
+	const dataAsBytes = hexToBytes(hex);
+	const chacha = managedNonce(xchacha20poly1305)(new Uint8Array(keyAsBytes));
+	return new TextDecoder().decode(chacha.decrypt(dataAsBytes));
+}
+const symmetricEncrypt = async ({ key, data }) => {
+	if (typeof key === "string") return rawEncrypt(key, data);
+	const secret = key.keys.get(key.currentVersion);
+	if (!secret) throw new Error(`Secret version ${key.currentVersion} not found in keys`);
+	const ciphertext = await rawEncrypt(secret, data);
+	return formatEnvelope(key.currentVersion, ciphertext);
+};
+const symmetricDecrypt = async ({ key, data }) => {
+	if (typeof key === "string") return rawDecrypt(key, data);
+	const envelope = parseEnvelope(data);
+	if (envelope) {
+		const secret = key.keys.get(envelope.version);
+		if (!secret) throw new Error(`Secret version ${envelope.version} not found in keys (key may have been retired)`);
+		return rawDecrypt(secret, envelope.ciphertext);
+	}
+	if (key.legacySecret) return rawDecrypt(key.legacySecret, data);
+	throw new Error("Cannot decrypt legacy bare-hex payload: no legacy secret available. Set BETTER_AUTH_SECRET for backwards compatibility.");
+};
+const getCryptoKey = async (secret) => {
+	const secretBuf = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+	return await getWebcryptoSubtle().importKey("raw", secretBuf, algorithm, false, ["sign", "verify"]);
+};
+const makeSignature = async (value, secret) => {
+	const key = await getCryptoKey(secret);
+	const signature = await getWebcryptoSubtle().sign(algorithm.name, key, new TextEncoder().encode(value));
+	return btoa(String.fromCharCode(...new Uint8Array(signature)));
+};
+//#endregion
+export { constantTimeEqual, formatEnvelope, generateRandomString, getCryptoKey, hashPassword, makeSignature, parseEnvelope, signJWT, symmetricDecodeJWT, symmetricDecrypt, symmetricEncodeJWT, symmetricEncrypt, verifyJWT, verifyPassword };

package/dist/crypto/jwt.d.mts

@@ -0,0 +1,9 @@
+import { SecretConfig } from "./index.mjs";
+
+//#region src/crypto/jwt.d.ts
+declare function signJWT(payload: any, secret: string, expiresIn?: number): Promise<string>;
+declare function verifyJWT<T = any>(token: string, secret: string): Promise<T | null>;
+declare function symmetricEncodeJWT<T extends Record<string, any>>(payload: T, secret: string | SecretConfig, salt: string, expiresIn?: number): Promise<string>;
+declare function symmetricDecodeJWT<T = any>(token: string, secret: string | SecretConfig, salt: string): Promise<T | null>;
+//#endregion
+export { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT };

package/dist/crypto/jwt.mjs

@@ -0,0 +1,141 @@
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { EncryptJWT, SignJWT, base64url, calculateJwkThumbprint, decodeProtectedHeader, jwtDecrypt, jwtVerify } from "jose";
+//#region src/crypto/jwt.ts
+async function signJWT(payload, secret, expiresIn = 3600) {
+	return await new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + expiresIn).sign(new TextEncoder().encode(secret));
+}
+async function verifyJWT(token, secret) {
+	try {
+		return (await jwtVerify(token, new TextEncoder().encode(secret))).payload;
+	} catch {
+		return null;
+	}
+}
+const info = new Uint8Array([
+	66,
+	101,
+	116,
+	116,
+	101,
+	114,
+	65,
+	117,
+	116,
+	104,
+	46,
+	106,
+	115,
+	32,
+	71,
+	101,
+	110,
+	101,
+	114,
+	97,
+	116,
+	101,
+	100,
+	32,
+	69,
+	110,
+	99,
+	114,
+	121,
+	112,
+	116,
+	105,
+	111,
+	110,
+	32,
+	75,
+	101,
+	121
+]);
+const now = () => Date.now() / 1e3 | 0;
+const alg = "dir";
+const enc = "A256CBC-HS512";
+function deriveEncryptionSecret(secret, salt) {
+	return hkdf(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(salt), info, 64);
+}
+function getCurrentSecret(secret) {
+	if (typeof secret === "string") return secret;
+	const value = secret.keys.get(secret.currentVersion);
+	if (!value) throw new Error(`Secret version ${secret.currentVersion} not found in keys`);
+	return value;
+}
+function getAllSecrets(secret) {
+	if (typeof secret === "string") return [{
+		version: 0,
+		value: secret
+	}];
+	const result = [];
+	for (const [version, value] of secret.keys) result.push({
+		version,
+		value
+	});
+	if (secret.legacySecret && !result.some((s) => s.value === secret.legacySecret)) result.push({
+		version: -1,
+		value: secret.legacySecret
+	});
+	return result;
+}
+async function symmetricEncodeJWT(payload, secret, salt, expiresIn = 3600) {
+	const encryptionSecret = deriveEncryptionSecret(getCurrentSecret(secret), salt);
+	const thumbprint = await calculateJwkThumbprint({
+		kty: "oct",
+		k: base64url.encode(encryptionSecret)
+	}, "sha256");
+	return await new EncryptJWT(payload).setProtectedHeader({
+		alg,
+		enc,
+		kid: thumbprint
+	}).setIssuedAt().setExpirationTime(now() + expiresIn).setJti(crypto.randomUUID()).encrypt(encryptionSecret);
+}
+const jwtDecryptOpts = {
+	clockTolerance: 15,
+	keyManagementAlgorithms: [alg],
+	contentEncryptionAlgorithms: [enc, "A256GCM"]
+};
+async function symmetricDecodeJWT(token, secret, salt) {
+	if (!token) return null;
+	let hasKid = false;
+	try {
+		hasKid = decodeProtectedHeader(token).kid !== void 0;
+	} catch {
+		return null;
+	}
+	try {
+		const secrets = getAllSecrets(secret);
+		const { payload } = await jwtDecrypt(token, async (protectedHeader) => {
+			const kid = protectedHeader.kid;
+			if (kid !== void 0) {
+				for (const s of secrets) {
+					const encryptionSecret = deriveEncryptionSecret(s.value, salt);
+					if (kid === await calculateJwkThumbprint({
+						kty: "oct",
+						k: base64url.encode(encryptionSecret)
+					}, "sha256")) return encryptionSecret;
+				}
+				throw new Error("no matching decryption secret");
+			}
+			if (secrets.length === 1) return deriveEncryptionSecret(secrets[0].value, salt);
+			return deriveEncryptionSecret(secrets[0].value, salt);
+		}, jwtDecryptOpts);
+		return payload;
+	} catch {
+		if (hasKid) return null;
+		const secrets = getAllSecrets(secret);
+		if (secrets.length <= 1) return null;
+		for (let i = 1; i < secrets.length; i++) try {
+			const s = secrets[i];
+			const { payload } = await jwtDecrypt(token, deriveEncryptionSecret(s.value, salt), jwtDecryptOpts);
+			return payload;
+		} catch {
+			continue;
+		}
+		return null;
+	}
+}
+//#endregion
+export { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT };

package/dist/crypto/password.d.mts

@@ -0,0 +1,13 @@
+import { hashPassword } from "@better-auth/utils/password";
+
+//#region src/crypto/password.d.ts
+declare const hashPassword$1: typeof hashPassword;
+declare const verifyPassword$1: ({
+  hash,
+  password
+}: {
+  hash: string;
+  password: string;
+}) => Promise<boolean>;
+//#endregion
+export { hashPassword$1 as hashPassword, verifyPassword$1 as verifyPassword };

package/dist/crypto/password.mjs

@@ -0,0 +1,14 @@
+import { hashPassword, verifyPassword } from "@better-auth/utils/password";
+//#region src/crypto/password.ts
+/**
+* `@better-auth/utils/password` uses the "node" export condition in package.json
+* to automatically pick the right implementation:
+*   - Node.js / Bun / Deno → `node:crypto scrypt` (libuv thread pool, non-blocking)
+*   - Unsupported runtimes → `@noble/hashes scrypt` (pure JS fallback)
+*/
+const hashPassword$1 = hashPassword;
+const verifyPassword$1 = async ({ hash, password }) => {
+	return verifyPassword(hash, password);
+};
+//#endregion
+export { hashPassword$1 as hashPassword, verifyPassword$1 as verifyPassword };

package/dist/crypto/random.d.mts

@@ -0,0 +1,4 @@
+//#region src/crypto/random.d.ts
+declare const generateRandomString: <SubA extends "a-z" | "A-Z" | "0-9" | "-_">(length: number, ...alphabets: SubA[]) => string;
+//#endregion
+export { generateRandomString };

package/dist/crypto/random.mjs

@@ -0,0 +1,5 @@
+import { createRandomStringGenerator } from "@better-auth/utils/random";
+//#region src/crypto/random.ts
+const generateRandomString = createRandomStringGenerator("a-z", "0-9", "A-Z", "-_");
+//#endregion
+export { generateRandomString };

package/dist/db/adapter-base.d.mts

@@ -0,0 +1,7 @@
+import { BetterAuthOptions } from "@better-auth/core";
+import { DBAdapter } from "@better-auth/core/db/adapter";
+
+//#region src/db/adapter-base.d.ts
+declare function getBaseAdapter(options: BetterAuthOptions, handleDirectDatabase: (options: BetterAuthOptions) => Promise<DBAdapter<BetterAuthOptions>>): Promise<DBAdapter<BetterAuthOptions>>;
+//#endregion
+export { getBaseAdapter };

package/dist/db/adapter-base.mjs

@@ -0,0 +1,25 @@
+import { getAuthTables } from "@better-auth/core/db";
+import { logger } from "@better-auth/core/env";
+//#region src/db/adapter-base.ts
+async function getBaseAdapter(options, handleDirectDatabase) {
+	let adapter;
+	if (!options.database) {
+		const tables = getAuthTables(options);
+		const memoryDB = Object.keys(tables).reduce((acc, key) => {
+			acc[key] = [];
+			return acc;
+		}, {});
+		const { memoryAdapter } = await import("@better-auth/memory-adapter");
+		adapter = memoryAdapter(memoryDB)(options);
+	} else if (typeof options.database === "function") adapter = options.database(options);
+	else adapter = await handleDirectDatabase(options);
+	if (!adapter.transaction) {
+		logger.warn("Adapter does not correctly implement transaction function, patching it automatically. Please update your adapter implementation.");
+		adapter.transaction = async (cb) => {
+			return cb(adapter);
+		};
+	}
+	return adapter;
+}
+//#endregion
+export { getBaseAdapter };

package/dist/db/adapter-kysely.d.mts

@@ -0,0 +1,7 @@
+import { BetterAuthOptions } from "@better-auth/core";
+import { DBAdapter } from "@better-auth/core/db/adapter";
+
+//#region src/db/adapter-kysely.d.ts
+declare function getAdapter(options: BetterAuthOptions): Promise<DBAdapter<BetterAuthOptions>>;
+//#endregion
+export { getAdapter };

package/dist/db/adapter-kysely.mjs

@@ -0,0 +1,17 @@
+import { getBaseAdapter } from "./adapter-base.mjs";
+import { BetterAuthError } from "@better-auth/core/error";
+//#region src/db/adapter-kysely.ts
+async function getAdapter(options) {
+	return getBaseAdapter(options, async (opts) => {
+		const { createKyselyAdapter, kyselyAdapter } = await import("../adapters/kysely-adapter/index.mjs");
+		const { kysely, databaseType, transaction } = await createKyselyAdapter(opts);
+		if (!kysely) throw new BetterAuthError("Failed to initialize database adapter");
+		return kyselyAdapter(kysely, {
+			type: databaseType || "sqlite",
+			debugLogs: opts.database && "debugLogs" in opts.database ? opts.database.debugLogs : false,
+			transaction
+		})(opts);
+	});
+}
+//#endregion
+export { getAdapter };

package/dist/db/field-converter.d.mts

@@ -0,0 +1,7 @@
+import { DBFieldAttribute } from "@better-auth/core/db";
+
+//#region src/db/field-converter.d.ts
+declare function convertToDB<T extends Record<string, any>>(fields: Record<string, DBFieldAttribute>, values: T): T;
+declare function convertFromDB<T extends Record<string, any>>(fields: Record<string, DBFieldAttribute>, values: T | null): T | null;
+//#endregion
+export { convertFromDB, convertToDB };

package/dist/db/field-converter.mjs

@@ -0,0 +1,19 @@
+//#region src/db/field-converter.ts
+function convertToDB(fields, values) {
+	const result = values.id ? { id: values.id } : {};
+	for (const key in fields) {
+		const field = fields[key];
+		const value = values[key];
+		if (value === void 0) continue;
+		result[field.fieldName || key] = value;
+	}
+	return result;
+}
+function convertFromDB(fields, values) {
+	if (!values) return null;
+	const result = { id: values.id };
+	for (const [key, value] of Object.entries(fields)) result[key] = values[value.fieldName || key];
+	return result;
+}
+//#endregion
+export { convertFromDB, convertToDB };