@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/index.d.mts

@@ -0,0 +1,30 @@
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "./types/helper.mjs";
+import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientStore, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferSessionFromClient, InferUserFromClient, IsSignal, SessionQueryParams } from "./client/types.mjs";
+import { DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, JoinConfig, JoinOption, Where } from "./types/adapter.mjs";
+import { FilteredAPI, InferAPI, InferSessionAPI } from "./types/api.mjs";
+import { Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, InferPluginTypes, RateLimit, Session, User, Verification } from "./types/models.mjs";
+import { InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginIDs } from "./types/plugins.mjs";
+import { Auth } from "./types/auth.mjs";
+import { BetterAuthAdvancedOptions, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, StoreIdentifierOption, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource } from "./types/index.mjs";
+import { betterAuth } from "./auth/full.mjs";
+import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
+import { StateData, generateGenericState, parseGenericState } from "./state.mjs";
+import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
+import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./utils/url.mjs";
+import { APIError } from "./api/index.mjs";
+import { StandardSchemaV1 } from "@better-auth/core";
+import { getCurrentAdapter } from "@better-auth/core/context";
+import { TelemetryEvent, createTelemetry, getTelemetryAuthConfig } from "@better-auth/telemetry";
+import { JSONWebKeySet, JWTPayload } from "jose";
+export * from "@better-auth/core";
+export * from "@better-auth/core/db";
+export * from "@better-auth/core/env";
+export * from "@better-auth/core/error";
+export * from "@better-auth/core/oauth2";
+export * from "@better-auth/core/utils/error-codes";
+export * from "@better-auth/core/utils/id";
+export * from "@better-auth/core/utils/json";
+export * from "@better-auth/core/social-providers";
+export * from "better-call";
+export * from "zod";
+export { APIError, Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, GenerateStateOptions, HIDE_METADATA, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, JoinConfig, JoinOption, OverrideMerge, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StandardSchemaV1, StateData, StoreIdentifierOption, StripEmptyObjects, type TelemetryEvent, UnionToIntersection, User, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource, Verification, Where, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/index.mjs

@@ -0,0 +1,17 @@
+import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./utils/url.mjs";
+import { generateGenericState, parseGenericState } from "./state.mjs";
+import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
+import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
+import { APIError } from "./api/index.mjs";
+import { betterAuth } from "./auth/full.mjs";
+import { getCurrentAdapter } from "@better-auth/core/context";
+import { createTelemetry, getTelemetryAuthConfig } from "@better-auth/telemetry";
+export * from "@better-auth/core";
+export * from "@better-auth/core/db";
+export * from "@better-auth/core/env";
+export * from "@better-auth/core/error";
+export * from "@better-auth/core/oauth2";
+export * from "@better-auth/core/utils/error-codes";
+export * from "@better-auth/core/utils/id";
+export * from "@better-auth/core/utils/json";
+export { APIError, HIDE_METADATA, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/integrations/cookie-plugin-guard.mjs

@@ -0,0 +1,18 @@
+//#region src/integrations/cookie-plugin-guard.ts
+/**
+* Warns when a cookie integration plugin is not effectively last.
+*
+* A plugin is considered misordered when there is at least one other plugin
+* after it in the `plugins` array that declares `hooks.after`, since those
+* hooks can set cookies that this integration will not see.
+*/
+function warnIfCookiePluginNotLast(ctx, pluginId) {
+	const plugins = ctx.options.plugins || [];
+	if (plugins.length === 0) return;
+	const index = plugins.findIndex((p) => p.id === pluginId);
+	if (index === -1) return;
+	if (!plugins.slice(index + 1).some((p) => p.hooks && Array.isArray(p.hooks.after) && p.hooks.after.length > 0)) return;
+	ctx.logger.warn(`[better-auth] Cookie integration plugin "${pluginId}" should be placed last in the plugins array. Plugins with \`hooks.after\` running after it may set cookies that are not forwarded to the framework cookie store. Move your cookie integration plugin to the end of the \`plugins\` array to avoid missing \`Set-Cookie\` headers.`);
+}
+//#endregion
+export { warnIfCookiePluginNotLast };

package/dist/integrations/next-js.d.mts

@@ -0,0 +1,29 @@
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+
+//#region src/integrations/next-js.d.ts
+declare function toNextJsHandler(auth: {
+  handler: (request: Request) => Promise<Response>;
+} | ((request: Request) => Promise<Response>)): {
+  GET: (request: Request) => Promise<Response>;
+  POST: (request: Request) => Promise<Response>;
+  PATCH: (request: Request) => Promise<Response>;
+  PUT: (request: Request) => Promise<Response>;
+  DELETE: (request: Request) => Promise<Response>;
+};
+declare const nextCookies: () => {
+  id: "next-cookies";
+  version: string;
+  hooks: {
+    before: {
+      matcher(ctx: _$_better_auth_core0.HookEndpointContext): boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+    after: {
+      matcher(ctx: _$_better_auth_core0.HookEndpointContext): true;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+};
+//#endregion
+export { nextCookies, toNextJsHandler };

package/dist/integrations/next-js.mjs

@@ -0,0 +1,105 @@
+import { parseSetCookieHeader, toCookieOptions } from "../cookies/cookie-utils.mjs";
+import { setShouldSkipSessionRefresh } from "../api/state/should-session-refresh.mjs";
+import { PACKAGE_VERSION } from "../version.mjs";
+import { warnIfCookiePluginNotLast } from "./cookie-plugin-guard.mjs";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/integrations/next-js.ts
+function toNextJsHandler(auth) {
+	const handler = async (request) => {
+		return "handler" in auth ? auth.handler(request) : auth(request);
+	};
+	return {
+		GET: handler,
+		POST: handler,
+		PATCH: handler,
+		PUT: handler,
+		DELETE: handler
+	};
+}
+let nextHeadersModulePromise;
+/**
+* Cache ESM resolution while leaving the request-scoped `headers()` and
+* `cookies()` calls uncached.
+*
+* @see https://github.com/better-auth/better-auth/issues/10466
+*/
+const loadNextHeadersModule = () => {
+	nextHeadersModulePromise ??= import("next/headers.js").catch((error) => {
+		nextHeadersModulePromise = void 0;
+		throw error;
+	});
+	return nextHeadersModulePromise;
+};
+const nextCookies = () => {
+	let hasWarned = false;
+	return {
+		id: "next-cookies",
+		version: PACKAGE_VERSION,
+		hooks: {
+			before: [{
+				matcher(ctx) {
+					return ctx.path === "/get-session";
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					if (!hasWarned) {
+						warnIfCookiePluginNotLast(ctx.context, "next-cookies");
+						hasWarned = true;
+					}
+					if ("_flag" in ctx && ctx._flag === "router") return;
+					let headersStore;
+					try {
+						const { headers } = await loadNextHeadersModule();
+						headersStore = await headers();
+					} catch {
+						return;
+					}
+					/**
+					* Detect RSC via headers, NOT by probing cookies().set().
+					* In Next.js, cookies().set() unconditionally triggers router
+					* cache invalidation -- even if the value is unchanged.
+					*
+					* RSC sends `RSC: 1` without `next-action`. Only in that
+					* context cookies cannot be written -- skip session refresh
+					* to avoid DB/cookie mismatch.
+					*
+					* @see https://github.com/vercel/next.js/blob/8c5af211d580/packages/next/src/server/web/spec-extension/adapters/request-cookies.ts#L112-L157
+					*/
+					const isRSC = headersStore.get("RSC") === "1";
+					const isServerAction = !!headersStore.get("next-action");
+					if (isRSC && !isServerAction) await setShouldSkipSessionRefresh(true);
+				})
+			}],
+			after: [{
+				matcher(ctx) {
+					return true;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const returned = ctx.context.responseHeaders;
+					if ("_flag" in ctx && ctx._flag === "router") return;
+					if (returned instanceof Headers) {
+						const setCookies = returned?.get("set-cookie");
+						if (!setCookies) return;
+						const parsed = parseSetCookieHeader(setCookies);
+						let cookieHelper;
+						try {
+							const { cookies } = await loadNextHeadersModule();
+							cookieHelper = await cookies();
+						} catch (error) {
+							if (error instanceof Error && (error.message.startsWith("`cookies` was called outside a request scope.") || error.message.includes("Cannot find module"))) return;
+							throw error;
+						}
+						parsed.forEach((value, key) => {
+							if (!key) return;
+							try {
+								cookieHelper.set(key, value.value, toCookieOptions(value));
+							} catch {}
+						});
+						return;
+					}
+				})
+			}]
+		}
+	};
+};
+//#endregion
+export { nextCookies, toNextJsHandler };

package/dist/integrations/node.d.mts

@@ -0,0 +1,11 @@
+import { Auth } from "../types/auth.mjs";
+import * as _$node_http0 from "node:http";
+import { IncomingHttpHeaders } from "node:http";
+
+//#region src/integrations/node.d.ts
+declare const toNodeHandler: (auth: {
+  handler: Auth["handler"];
+} | Auth["handler"]) => (req: _$node_http0.IncomingMessage, res: _$node_http0.ServerResponse) => Promise<void>;
+declare function fromNodeHeaders(nodeHeaders: IncomingHttpHeaders): Headers;
+//#endregion
+export { fromNodeHeaders, toNodeHandler };

package/dist/integrations/node.mjs

@@ -0,0 +1,13 @@
+import { toNodeHandler as toNodeHandler$1 } from "better-call/node";
+//#region src/integrations/node.ts
+const toNodeHandler = (auth) => {
+	return "handler" in auth ? toNodeHandler$1(auth.handler) : toNodeHandler$1(auth);
+};
+function fromNodeHeaders(nodeHeaders) {
+	const webHeaders = new Headers();
+	for (const [key, value] of Object.entries(nodeHeaders)) if (value !== void 0) if (Array.isArray(value)) value.forEach((v) => webHeaders.append(key, v));
+	else webHeaders.set(key, value);
+	return webHeaders;
+}
+//#endregion
+export { fromNodeHeaders, toNodeHandler };

package/dist/integrations/solid-start.d.mts

@@ -0,0 +1,22 @@
+//#region src/integrations/solid-start.d.ts
+declare function toSolidStartHandler(auth: {
+  handler: (request: Request) => Promise<Response>;
+} | ((request: Request) => Promise<Response>)): {
+  GET: (event: {
+    request: Request;
+  }) => Promise<Response>;
+  POST: (event: {
+    request: Request;
+  }) => Promise<Response>;
+  PATCH: (event: {
+    request: Request;
+  }) => Promise<Response>;
+  PUT: (event: {
+    request: Request;
+  }) => Promise<Response>;
+  DELETE: (event: {
+    request: Request;
+  }) => Promise<Response>;
+};
+//#endregion
+export { toSolidStartHandler };

package/dist/integrations/solid-start.mjs

@@ -0,0 +1,15 @@
+//#region src/integrations/solid-start.ts
+function toSolidStartHandler(auth) {
+	const handler = async (event) => {
+		return "handler" in auth ? auth.handler(event.request) : auth(event.request);
+	};
+	return {
+		GET: handler,
+		POST: handler,
+		PATCH: handler,
+		PUT: handler,
+		DELETE: handler
+	};
+}
+//#endregion
+export { toSolidStartHandler };

package/dist/integrations/svelte-kit.d.mts

@@ -0,0 +1,38 @@
+import { BetterAuthOptions } from "../types/index.mjs";
+import * as _$better_call0 from "better-call";
+import { RequestEvent } from "@sveltejs/kit";
+
+//#region src/integrations/svelte-kit.d.ts
+declare const toSvelteKitHandler: (auth: {
+  handler: (request: Request) => Response | Promise<Response>;
+  options: BetterAuthOptions;
+}) => (event: {
+  request: Request;
+}) => Response | Promise<Response>;
+declare const svelteKitHandler: ({
+  auth,
+  event,
+  resolve,
+  building
+}: {
+  auth: {
+    handler: (request: Request) => Response | Promise<Response>;
+    options: BetterAuthOptions;
+  };
+  event: RequestEvent;
+  resolve: (event: RequestEvent) => Response | Promise<Response>;
+  building: boolean;
+}) => Promise<Response>;
+declare function isAuthPath(url: string, options: BetterAuthOptions): boolean;
+declare const sveltekitCookies: (getRequestEvent: () => RequestEvent<any, any>) => {
+  id: "sveltekit-cookies";
+  version: string;
+  hooks: {
+    after: {
+      matcher(): true;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+};
+//#endregion
+export { isAuthPath, svelteKitHandler, sveltekitCookies, toSvelteKitHandler };

package/dist/integrations/svelte-kit.mjs

@@ -0,0 +1,57 @@
+import { parseSetCookieHeader, toCookieOptions } from "../cookies/cookie-utils.mjs";
+import { PACKAGE_VERSION } from "../version.mjs";
+import { warnIfCookiePluginNotLast } from "./cookie-plugin-guard.mjs";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/integrations/svelte-kit.ts
+const toSvelteKitHandler = (auth) => {
+	return (event) => auth.handler(event.request);
+};
+const svelteKitHandler = async ({ auth, event, resolve, building }) => {
+	if (building) return resolve(event);
+	const { request, url } = event;
+	if (isAuthPath(url.toString(), auth.options)) return auth.handler(request);
+	return resolve(event);
+};
+function isAuthPath(url, options) {
+	const _url = new URL(url);
+	const baseURLStr = typeof options.baseURL === "string" ? options.baseURL : void 0;
+	const baseURL = new URL(`${baseURLStr || _url.origin}${options.basePath || "/api/auth"}`);
+	if (_url.origin !== baseURL.origin) return false;
+	if (!_url.pathname.startsWith(baseURL.pathname.endsWith("/") ? baseURL.pathname : `${baseURL.pathname}/`)) return false;
+	return true;
+}
+const sveltekitCookies = (getRequestEvent) => {
+	let hasWarned = false;
+	return {
+		id: "sveltekit-cookies",
+		version: PACKAGE_VERSION,
+		hooks: { after: [{
+			matcher() {
+				return true;
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				if (!hasWarned) {
+					warnIfCookiePluginNotLast(ctx.context, "sveltekit-cookies");
+					hasWarned = true;
+				}
+				const returned = ctx.context.responseHeaders;
+				if ("_flag" in ctx && ctx._flag === "router") return;
+				if (returned instanceof Headers) {
+					const setCookies = returned?.get("set-cookie");
+					if (!setCookies) return;
+					const event = getRequestEvent();
+					if (!event) return;
+					const parsed = parseSetCookieHeader(setCookies);
+					for (const [name, attributes] of parsed) try {
+						event.cookies.set(name, attributes.value, {
+							...toCookieOptions(attributes),
+							path: attributes.path || "/"
+						});
+					} catch {}
+				}
+			})
+		}] }
+	};
+};
+//#endregion
+export { isAuthPath, svelteKitHandler, sveltekitCookies, toSvelteKitHandler };

package/dist/integrations/tanstack-start-solid.d.mts

@@ -0,0 +1,33 @@
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+
+//#region src/integrations/tanstack-start-solid.d.ts
+/**
+ * TanStack Start cookie plugin for Solid.js.
+ *
+ * This plugin automatically handles cookie setting for TanStack Start with Solid.js.
+ * It uses `@tanstack/solid-start-server` to set cookies.
+ *
+ * For React, use `better-auth/tanstack-start` instead.
+ *
+ * @example
+ * ```ts
+ * import { tanstackStartCookies } from "better-auth/tanstack-start/solid";
+ *
+ * const auth = betterAuth({
+ *   plugins: [tanstackStartCookies()],
+ * });
+ * ```
+ */
+declare const tanstackStartCookies: () => {
+  id: "tanstack-start-cookies-solid";
+  version: string;
+  hooks: {
+    after: {
+      matcher(ctx: _$_better_auth_core0.HookEndpointContext): true;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+};
+//#endregion
+export { tanstackStartCookies };

package/dist/integrations/tanstack-start-solid.mjs

@@ -0,0 +1,57 @@
+import { parseSetCookieHeader, toCookieOptions } from "../cookies/cookie-utils.mjs";
+import { PACKAGE_VERSION } from "../version.mjs";
+import { warnIfCookiePluginNotLast } from "./cookie-plugin-guard.mjs";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/integrations/tanstack-start-solid.ts
+/**
+* TanStack Start cookie plugin for Solid.js.
+*
+* This plugin automatically handles cookie setting for TanStack Start with Solid.js.
+* It uses `@tanstack/solid-start-server` to set cookies.
+*
+* For React, use `better-auth/tanstack-start` instead.
+*
+* @example
+* ```ts
+* import { tanstackStartCookies } from "better-auth/tanstack-start/solid";
+*
+* const auth = betterAuth({
+*   plugins: [tanstackStartCookies()],
+* });
+* ```
+*/
+const tanstackStartCookies = () => {
+	let hasWarned = false;
+	return {
+		id: "tanstack-start-cookies-solid",
+		version: PACKAGE_VERSION,
+		hooks: { after: [{
+			matcher(ctx) {
+				return true;
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				if (!hasWarned) {
+					warnIfCookiePluginNotLast(ctx.context, "tanstack-start-cookies-solid");
+					hasWarned = true;
+				}
+				const returned = ctx.context.responseHeaders;
+				if ("_flag" in ctx && ctx._flag === "router") return;
+				if (returned instanceof Headers) {
+					const setCookies = returned?.get("set-cookie");
+					if (!setCookies) return;
+					const parsed = parseSetCookieHeader(setCookies);
+					const { setCookie } = await import("@tanstack/solid-start/server");
+					parsed.forEach((value, key) => {
+						if (!key) return;
+						try {
+							setCookie(key, value.value, toCookieOptions(value));
+						} catch {}
+					});
+					return;
+				}
+			})
+		}] }
+	};
+};
+//#endregion
+export { tanstackStartCookies };

package/dist/integrations/tanstack-start.d.mts

@@ -0,0 +1,33 @@
+import * as _$_better_auth_core0 from "@better-auth/core";
+import * as _$better_call0 from "better-call";
+
+//#region src/integrations/tanstack-start.d.ts
+/**
+ * TanStack Start cookie plugin for React.
+ *
+ * This plugin automatically handles cookie setting for TanStack Start with React.
+ * It uses `@tanstack/react-start-server` to set cookies.
+ *
+ * For Solid.js, use `better-auth/tanstack-start/solid` instead.
+ *
+ * @example
+ * ```ts
+ * import { tanstackStartCookies } from "better-auth/tanstack-start";
+ *
+ * const auth = betterAuth({
+ *   plugins: [tanstackStartCookies()],
+ * });
+ * ```
+ */
+declare const tanstackStartCookies: () => {
+  id: "tanstack-start-cookies";
+  version: string;
+  hooks: {
+    after: {
+      matcher(ctx: _$_better_auth_core0.HookEndpointContext): true;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
+};
+//#endregion
+export { tanstackStartCookies };

package/dist/integrations/tanstack-start.mjs

@@ -0,0 +1,57 @@
+import { parseSetCookieHeader, toCookieOptions } from "../cookies/cookie-utils.mjs";
+import { PACKAGE_VERSION } from "../version.mjs";
+import { warnIfCookiePluginNotLast } from "./cookie-plugin-guard.mjs";
+import { createAuthMiddleware } from "@better-auth/core/api";
+//#region src/integrations/tanstack-start.ts
+/**
+* TanStack Start cookie plugin for React.
+*
+* This plugin automatically handles cookie setting for TanStack Start with React.
+* It uses `@tanstack/react-start-server` to set cookies.
+*
+* For Solid.js, use `better-auth/tanstack-start/solid` instead.
+*
+* @example
+* ```ts
+* import { tanstackStartCookies } from "better-auth/tanstack-start";
+*
+* const auth = betterAuth({
+*   plugins: [tanstackStartCookies()],
+* });
+* ```
+*/
+const tanstackStartCookies = () => {
+	let hasWarned = false;
+	return {
+		id: "tanstack-start-cookies",
+		version: PACKAGE_VERSION,
+		hooks: { after: [{
+			matcher(ctx) {
+				return true;
+			},
+			handler: createAuthMiddleware(async (ctx) => {
+				if (!hasWarned) {
+					warnIfCookiePluginNotLast(ctx.context, "tanstack-start-cookies");
+					hasWarned = true;
+				}
+				const returned = ctx.context.responseHeaders;
+				if ("_flag" in ctx && ctx._flag === "router") return;
+				if (returned instanceof Headers) {
+					const setCookies = returned?.get("set-cookie");
+					if (!setCookies) return;
+					const parsed = parseSetCookieHeader(setCookies);
+					const { setCookie } = await import("@tanstack/react-start/server");
+					parsed.forEach((value, key) => {
+						if (!key) return;
+						try {
+							setCookie(key, value.value, toCookieOptions(value));
+						} catch {}
+					});
+					return;
+				}
+			})
+		}] }
+	};
+};
+//#endregion
+export { tanstackStartCookies };

package/dist/oauth2/account-key.mjs

@@ -0,0 +1,43 @@
+import { APIError, BASE_ERROR_CODES, BetterAuthError } from "@better-auth/core/error";
+//#region src/oauth2/account-key.ts
+/**
+* Exposes a provider-declared profile as the raw claim record used by
+* provisioning hooks. Provider profile interfaces are object-shaped but do
+* not need an index signature solely to satisfy this erased boundary.
+*/
+function toOAuthProfileRecord(profile) {
+	return profile;
+}
+/**
+* Resolves the stable account key established by an OAuth provider response.
+*/
+async function resolveOAuthAccountKey(provider, tokens, profile) {
+	const accountKeyContext = {
+		tokens,
+		profile
+	};
+	const accountSubject = provider.accountSubject;
+	const resolvedSubject = await accountSubject(accountKeyContext);
+	const accountId = String(resolvedSubject);
+	if (typeof resolvedSubject === "number" && !Number.isFinite(resolvedSubject) || accountId.trim().length === 0 || accountId === "undefined" || accountId === "null") throw new BetterAuthError("OAUTH_ACCOUNT_SUBJECT_INVALID");
+	return {
+		providerId: provider.id,
+		accountId
+	};
+}
+/**
+* Resolves an OAuth account key at a direct HTTP authentication boundary.
+*
+* Provider resolvers are application code and can reject or return malformed
+* values. Direct sign-in and linking expose all such failures as one stable
+* authentication error instead of leaking implementation details or a 500.
+*/
+async function resolveOAuthAccountKeyForAPI(provider, tokens, profile) {
+	try {
+		return await resolveOAuthAccountKey(provider, tokens, profile);
+	} catch {
+		throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
+	}
+}
+//#endregion
+export { resolveOAuthAccountKey, resolveOAuthAccountKeyForAPI, toOAuthProfileRecord };

package/dist/oauth2/errors.mjs

@@ -0,0 +1,49 @@
+import { appendQueryParams } from "@better-auth/core/utils/url";
+//#region src/oauth2/errors.ts
+/**
+* Error codes used in OAuth callback redirects (`?error=<code>`). These are
+* URL-safe strings, not API error objects. Some also serve as the OAuth seam's
+* machine-readable `result.error` value, which non-redirect callers (e.g.
+* id-token sign-in) remap to an API error code.
+*/
+const OAUTH_CALLBACK_ERROR_CODES = {
+	NO_CODE: "no_code",
+	PROVIDER_NOT_FOUND: "oauth_provider_not_found",
+	ISSUER_MISSING: "issuer_missing",
+	ISSUER_MISMATCH: "issuer_mismatch",
+	INVALID_CODE: "invalid_code",
+	NONCE_BINDING_MISSING: "nonce_binding_missing",
+	UNABLE_TO_GET_USER_INFO: "unable_to_get_user_info",
+	NO_CALLBACK_URL: "no_callback_url",
+	UNABLE_TO_LINK_ACCOUNT: "unable_to_link_account",
+	EMAIL_DOES_NOT_MATCH: "email_does_not_match",
+	ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER: "account_already_linked_to_different_user",
+	EMAIL_NOT_FOUND: "email_not_found",
+	EMAIL_NOT_VERIFIED: "email_not_verified"
+};
+const HANDLING_DOCS_URL = "https://www.better-auth.com/docs/concepts/oauth#handling-providers-without-email";
+/**
+* Redirect the user to the OAuth error page with a machine-readable `error`
+* code (and optional `error_description`).
+*
+* Every OAuth callback path routes its failures through this helper so the
+* query parameter name, the `?`/`&` separator, and URL encoding are decided in
+* one place. The error page reads the `error` query parameter, so callers must
+* never hand-build the redirect with a different parameter name.
+*/
+function redirectOnError(ctx, errorURL, error, description) {
+	const params = new URLSearchParams({ error });
+	if (description) params.set("error_description", description);
+	const redirectURL = appendQueryParams(errorURL, params);
+	throw ctx.redirect(redirectURL);
+}
+/**
+* Build the logger message shown when an OAuth provider does not return an
+* email address. Kept in one place so every rejection site points users at
+* the same workaround docs.
+*/
+function missingEmailLogMessage(providerId, options) {
+	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or create a placeholder via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
+}
+//#endregion
+export { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage, redirectOnError };

package/dist/oauth2/index.d.mts

@@ -0,0 +1,5 @@
+import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./state.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
+export * from "@better-auth/core/oauth2";
+export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };

package/dist/oauth2/index.mjs

@@ -0,0 +1,5 @@
+import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { generateIdTokenNonce, generateState, parseState } from "./state.mjs";
+export * from "@better-auth/core/oauth2";
+export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };