@nuxtjs/better-auth 0.0.0 → 0.1.3

package/dist/module.mjs

@@ -0,0 +1,1468 @@
+import { existsSync, statSync, writeFileSync, readFileSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { getLayerDirectories, updateTemplates, addServerImportsDir, addServerImports, addServerScanDir, addServerHandler, addImportsDir, addPlugin, addComponentsDir, extendPages, addTemplate, hasNuxtModule, addTypeTemplate, defineNuxtModule, createResolver } from '@nuxt/kit';
+import { consola as consola$1 } from 'consola';
+import { isAbsolute, join, relative, dirname } from 'pathe';
+import { defu } from 'defu';
+import { toRouteMatcher, createRouter } from 'radix3';
+import { generateDrizzleSchema as generateDrizzleSchema$1 } from 'auth/api';
+import { randomBytes } from 'node:crypto';
+import { isCI, isTest } from 'std-env';
+export { defineClientAuth, defineServerAuth } from '../dist/runtime/config.js';
+
+const version = "0.1.3";
+
+const CONFIG_EXTENSIONS = [".ts", ".js"];
+const CONFIG_EXTENSION_RE = /\.(?:ts|js)$/;
+const DEFAULT_CONFIG_FILES = {
+  server: "server/auth.config",
+  client: "app/auth.config"
+};
+const OPTION_KEY_BY_KIND = {
+  server: "serverConfig",
+  client: "clientConfig"
+};
+function stripConfigExtension(path) {
+  return path.replace(CONFIG_EXTENSION_RE, "");
+}
+function defaultConfigExists(path) {
+  return CONFIG_EXTENSIONS.some((ext) => existsSync(`${path}${ext}`));
+}
+function getLayerDirectoriesWithConfigs(nuxt) {
+  const directories = getLayerDirectories(nuxt);
+  const layers = nuxt.options._layers;
+  return directories.map((directory, index) => ({ directory, layer: layers[index] }));
+}
+function getProjectDirectory(nuxt) {
+  return getLayerDirectories(nuxt)[0];
+}
+function getDefaultConfigPath(nuxt, kind) {
+  const project = getProjectDirectory(nuxt);
+  return kind === "server" ? join(project.server, "auth.config") : join(project.app, "auth.config");
+}
+function getLayerDefaultConfigPath(nuxt, kind, configExists) {
+  for (const { directory } of getLayerDirectoriesWithConfigs(nuxt)) {
+    const candidate = kind === "server" ? join(directory.server, "auth.config") : join(directory.app, "auth.config");
+    if (configExists(candidate)) {
+      return {
+        path: candidate,
+        declaringLayerRoot: directory.root
+      };
+    }
+  }
+}
+function resolveDeclaringLayerRoot(nuxt, kind, file) {
+  const optionKey = OPTION_KEY_BY_KIND[kind];
+  for (const { directory, layer } of getLayerDirectoriesWithConfigs(nuxt)) {
+    const declared = layer?.config?.auth?.[optionKey];
+    if (typeof declared === "string" && stripConfigExtension(declared) === file)
+      return directory.root;
+  }
+  return getProjectDirectory(nuxt).root;
+}
+function getRelativeConfigFile(nuxt, path) {
+  return relative(getProjectDirectory(nuxt).root, path);
+}
+function getEffectiveModuleConfigFile(nuxt, kind) {
+  const optionKey = OPTION_KEY_BY_KIND[kind];
+  const authOptions = nuxt.options.auth;
+  return authOptions?.[optionKey] ?? DEFAULT_CONFIG_FILES[kind];
+}
+function resolveAuthConfigDescriptor(nuxt, kind, file = getEffectiveModuleConfigFile(nuxt, kind), dependencies = {}) {
+  const configExists = dependencies.configExists ?? defaultConfigExists;
+  const configuredFile = stripConfigExtension(file);
+  if (isAbsolute(configuredFile)) {
+    const declaringLayerRoot2 = resolveDeclaringLayerRoot(nuxt, kind, configuredFile);
+    const exists2 = configExists(configuredFile);
+    return {
+      kind,
+      configuredFile,
+      file: configuredFile,
+      path: configuredFile,
+      declaringLayerRoot: declaringLayerRoot2,
+      isDefault: false,
+      isExplicit: true,
+      exists: exists2,
+      shouldCreateDefaultFile: false
+    };
+  }
+  if (configuredFile === DEFAULT_CONFIG_FILES[kind]) {
+    const project = getProjectDirectory(nuxt);
+    const discovered = getLayerDefaultConfigPath(nuxt, kind, configExists);
+    const path2 = discovered?.path ?? getDefaultConfigPath(nuxt, kind);
+    const declaringLayerRoot2 = discovered?.declaringLayerRoot ?? project.root;
+    const exists2 = configExists(path2);
+    return {
+      kind,
+      configuredFile,
+      file: getRelativeConfigFile(nuxt, path2),
+      path: path2,
+      declaringLayerRoot: declaringLayerRoot2,
+      isDefault: true,
+      isExplicit: false,
+      exists: exists2,
+      shouldCreateDefaultFile: !exists2
+    };
+  }
+  const declaringLayerRoot = resolveDeclaringLayerRoot(nuxt, kind, configuredFile);
+  const path = join(declaringLayerRoot, configuredFile);
+  const exists = configExists(path);
+  return {
+    kind,
+    configuredFile,
+    file: getRelativeConfigFile(nuxt, path),
+    path,
+    declaringLayerRoot,
+    isDefault: false,
+    isExplicit: true,
+    exists,
+    shouldCreateDefaultFile: false
+  };
+}
+function resolveAuthConfigDescriptors(nuxt, files = {}, dependencies = {}) {
+  return {
+    server: resolveAuthConfigDescriptor(nuxt, "server", files.server, dependencies),
+    client: resolveAuthConfigDescriptor(nuxt, "client", files.client, dependencies)
+  };
+}
+
+function resolveNitroCompatibilityImports(nuxtVersion) {
+  const major = Number.parseInt(nuxtVersion, 10);
+  const nitroV3 = Number.isFinite(major) && major >= 5;
+  return {
+    h3: nitroV3 ? "nitro/h3" : "h3",
+    runtime: nitroV3 ? "nitro3" : "nitro2",
+    types: nitroV3 ? "nitro/types" : "nitropack/types"
+  };
+}
+
+function setupDevTools(nuxt) {
+  const hookable = nuxt;
+  hookable.hook("devtools:customTabs", (tabs) => {
+    tabs.push({
+      category: "server",
+      name: "better-auth",
+      title: "Auth",
+      icon: "simple-icons:betterauth",
+      view: {
+        type: "iframe",
+        src: "/__better-auth-devtools"
+      }
+    });
+  });
+}
+
+function registerTemplateHmrHook(nuxt) {
+  nuxt.hook("builder:watch", async (_event, relativePath) => {
+    if (relativePath.includes("auth.config"))
+      await updateTemplates({ filter: (t) => t.filename.includes("nuxt-better-auth") });
+  });
+}
+function registerServerRuntime(input) {
+  const { clientOnly, resolve } = input;
+  if (!clientOnly) {
+    addServerImportsDir(resolve("./runtime/server/utils"));
+    addServerImports([{ name: "defineServerAuth", from: resolve("./runtime/config") }]);
+    addServerScanDir(resolve("./runtime/server/middleware"));
+    addServerHandler({ route: "/api/auth/**", handler: resolve("./runtime/server/api/auth/[...all]") });
+  }
+  addImportsDir(resolve("./runtime/app/composables"));
+  addImportsDir(resolve("./runtime/utils"));
+  if (!clientOnly)
+    addPlugin({ src: resolve("./runtime/app/plugins/session.server"), mode: "server" });
+  addPlugin({ src: resolve("./runtime/app/plugins/session.client"), mode: "client" });
+  addComponentsDir({ path: resolve("./runtime/app/components") });
+}
+function registerAuthMiddlewareHook(nuxt, resolve) {
+  nuxt.hook("app:resolve", (app) => {
+    app.middleware.push({ name: "auth", path: resolve("./runtime/app/middleware/auth.global"), global: true });
+  });
+}
+function registerPrepareTypesHook(input) {
+  const { nuxt, serverDir, hasHubDb } = input;
+  nuxt.hook("prepare:types", ({ nodeTsConfig, nodeReferences, sharedReferences }) => {
+    nodeTsConfig.compilerOptions ||= {};
+    nodeTsConfig.compilerOptions.paths ||= {};
+    const projectReferenceTypePaths = [
+      join(nuxt.options.buildDir, "types/nitro-imports.d.ts"),
+      join(nuxt.options.buildDir, "types/auth-database.d.ts"),
+      join(nuxt.options.buildDir, "types/auth-schema.d.ts"),
+      join(nuxt.options.buildDir, "types/auth-secondary-storage.d.ts")
+    ];
+    if (hasHubDb)
+      projectReferenceTypePaths.push(join(nuxt.options.buildDir, "hub/db.d.ts"));
+    const exactNodeAliases = {
+      "#server": serverDir,
+      "#auth/server": nuxt.options.alias["#auth/server"],
+      "#auth/client": nuxt.options.alias["#auth/client"],
+      "#auth/database": nuxt.options.alias["#auth/database"],
+      "#auth/schema": nuxt.options.alias["#auth/schema"],
+      "#auth/secondary-storage": nuxt.options.alias["#auth/secondary-storage"],
+      "#auth/route-rules": nuxt.options.alias["#auth/route-rules"]
+    };
+    for (const [key, value] of Object.entries(exactNodeAliases)) {
+      if (typeof value === "string")
+        nodeTsConfig.compilerOptions.paths[key] = [value];
+    }
+    for (const [key, value] of Object.entries(nuxt.options.alias)) {
+      if (typeof value !== "string" || !isAbsolute(value))
+        continue;
+      nodeTsConfig.compilerOptions.paths[key] ||= [value];
+      if (!key.includes("*") && existsSync(value) && statSync(value).isDirectory())
+        nodeTsConfig.compilerOptions.paths[`${key}/*`] ||= [join(value, "*")];
+    }
+    nodeTsConfig.compilerOptions.paths["#server/*"] = [join(serverDir, "*")];
+    for (const path of projectReferenceTypePaths) {
+      if (!nodeReferences.some((reference) => "path" in reference && reference.path === path))
+        nodeReferences.push({ path });
+      if (!sharedReferences.some((reference) => "path" in reference && reference.path === path))
+        sharedReferences.push({ path });
+    }
+  });
+}
+function registerNuxtHubDatabaseExternalHook(nuxt) {
+  nuxt.hook("nitro:config", (nitroConfig) => {
+    nitroConfig.externals ||= {};
+    nitroConfig.externals.external ||= [];
+    if (!nitroConfig.externals.external.includes("@nuxthub/db"))
+      nitroConfig.externals.external.push("@nuxthub/db");
+  });
+}
+async function registerDevtools(input) {
+  const { nuxt, clientOnly, hasHubDb, resolve } = input;
+  const isProduction = process.env.NODE_ENV === "production" || !nuxt.options.dev;
+  if (isProduction || clientOnly)
+    return;
+  setupDevTools(nuxt);
+  addServerHandler({ route: "/api/_better-auth/config", method: "get", handler: resolve("./runtime/server/api/_better-auth/config.get") });
+  if (hasHubDb) {
+    const handlers = [
+      { route: "/api/_better-auth/sessions", method: "get", handler: resolve("./runtime/server/api/_better-auth/sessions.get") },
+      { route: "/api/_better-auth/sessions", method: "delete", handler: resolve("./runtime/server/api/_better-auth/sessions.delete") },
+      { route: "/api/_better-auth/users", method: "get", handler: resolve("./runtime/server/api/_better-auth/users.get") },
+      { route: "/api/_better-auth/accounts", method: "get", handler: resolve("./runtime/server/api/_better-auth/accounts.get") }
+    ];
+    handlers.forEach((handler) => addServerHandler(handler));
+  }
+  extendPages((pages) => {
+    pages.push({ name: "better-auth-devtools", path: "/__better-auth-devtools", file: resolve("./runtime/app/pages/__better-auth-devtools.vue"), meta: { layout: false } });
+  });
+}
+function registerRouteRulesMetaHook(nuxt) {
+  nuxt.hook("pages:extend", (pages) => {
+    const options = nuxt.options;
+    const routeRules = options.nitro?.routeRules || options.routeRules || {};
+    if (!Object.keys(routeRules).length)
+      return;
+    const matcher = toRouteMatcher(createRouter({ routes: routeRules }));
+    const applyMetaFromRules = (page) => {
+      const matches = matcher.matchAll(page.path);
+      if (!matches.length)
+        return;
+      const matchedRules = defu({}, ...matches.reverse());
+      if (matchedRules.auth !== void 0) {
+        page.meta = page.meta || {};
+        page.meta.auth = matchedRules.auth;
+      }
+      page.children?.forEach((child) => applyMetaFromRules(child));
+    };
+    pages.forEach((page) => applyMetaFromRules(page));
+  });
+}
+
+function dialectToProvider(dialect) {
+  return dialect === "postgresql" ? "pg" : dialect;
+}
+async function generateDrizzleSchema(authOptions, dialect, schemaOptions) {
+  const provider = dialectToProvider(dialect);
+  const options = {
+    ...authOptions,
+    advanced: {
+      ...authOptions.advanced,
+      database: {
+        ...authOptions.advanced?.database,
+        ...schemaOptions?.useUuid && { generateId: "uuid" }
+      }
+    }
+  };
+  const adapter = {
+    id: "drizzle",
+    options: {
+      provider,
+      camelCase: schemaOptions?.casing !== "snake_case",
+      schemaName: schemaOptions?.schemaName,
+      adapterConfig: { usePlural: schemaOptions?.usePlural ?? false }
+    }
+  };
+  const result = await generateDrizzleSchema$1({
+    adapter,
+    options
+  });
+  if (!result.code) {
+    throw new Error(`Schema generation returned empty result for ${dialect}`);
+  }
+  return result.code;
+}
+function loadLocalEnv(rootDir) {
+  if (!rootDir)
+    return;
+  const envPath = join(rootDir, ".env.local");
+  if (!existsSync(envPath))
+    return;
+  process.loadEnvFile(envPath);
+}
+async function loadUserAuthConfig(configPath, throwOnError = false, alias, runtimeConfig = {}, rootDir) {
+  const { createJiti } = await import('jiti');
+  const { defineServerAuth: runtimeDefineServerAuth } = await import('../dist/runtime/config.js');
+  const jiti = createJiti(import.meta.url, { interopDefault: true, moduleCache: false, alias });
+  const schemaGlobals = globalThis;
+  if (!schemaGlobals.__nuxtBetterAuthDefineServerAuth) {
+    runtimeDefineServerAuth._count = 0;
+    schemaGlobals.__nuxtBetterAuthDefineServerAuth = runtimeDefineServerAuth;
+  }
+  if (!schemaGlobals.defineServerAuth) {
+    schemaGlobals.defineServerAuth = schemaGlobals.__nuxtBetterAuthDefineServerAuth;
+  }
+  schemaGlobals.__nuxtBetterAuthDefineServerAuth._count++;
+  try {
+    loadLocalEnv(rootDir);
+    const mod = await jiti.import(configPath);
+    const configFn = mod.default;
+    if (typeof configFn === "function") {
+      return configFn({ runtimeConfig, db: null });
+    }
+    consola$1.warn("[@nuxtjs/better-auth] auth.config.ts does not export default. Expected: export default defineServerAuth(...)");
+    if (throwOnError) {
+      throw new Error("auth.config.ts must export default defineServerAuth(...)");
+    }
+    return {};
+  } catch (error) {
+    if (throwOnError) {
+      throw new Error(`Failed to load auth config: ${error instanceof Error ? error.message : error}`);
+    }
+    consola$1.error("[@nuxtjs/better-auth] Failed to load auth config for schema generation. Schema may be incomplete:", error);
+    return {};
+  } finally {
+    const sharedDefineServerAuth = schemaGlobals.__nuxtBetterAuthDefineServerAuth;
+    if (sharedDefineServerAuth) {
+      sharedDefineServerAuth._count--;
+      if (!sharedDefineServerAuth._count) {
+        schemaGlobals.__nuxtBetterAuthDefineServerAuth = void 0;
+        if (schemaGlobals.defineServerAuth === sharedDefineServerAuth) {
+          schemaGlobals.defineServerAuth = void 0;
+        }
+      }
+    }
+  }
+}
+
+function getHubDialect(hub) {
+  if (!hub?.db)
+    return void 0;
+  if (typeof hub.db === "string")
+    return hub.db;
+  if (typeof hub.db === "object" && hub.db !== null)
+    return hub.db.dialect;
+  return void 0;
+}
+function getHubCasing(hub) {
+  if (!hub?.db || typeof hub.db !== "object" || hub.db === null)
+    return void 0;
+  return hub.db.casing;
+}
+
+const NODE_MODULES_SEGMENT_RE = /[\\/]/;
+function resolveSchemaSecondaryStorageInjection(hubSecondaryStorage, userHasSecondaryStorage, isProduction) {
+  if (hubSecondaryStorage === true)
+    return { inject: false };
+  if (hubSecondaryStorage !== "custom")
+    return { inject: false };
+  if (userHasSecondaryStorage)
+    return { inject: true };
+  const message = '[nuxt-better-auth] hubSecondaryStorage: "custom" requires secondaryStorage in defineServerAuth() to omit the session table from the generated schema.';
+  if (isProduction)
+    return { inject: false, error: message };
+  return { inject: false, warn: message };
+}
+function isInsideNodeModules(path) {
+  return path.split(NODE_MODULES_SEGMENT_RE).includes("node_modules");
+}
+function resolveHubSchemaPath(buildDir, rootDir, dialect, exists = existsSync) {
+  const rootTsPath = join(rootDir, ".nuxt", "better-auth", `schema.${dialect}.ts`);
+  if (isInsideNodeModules(buildDir) && exists(rootTsPath))
+    return rootTsPath;
+  const tsPath = join(buildDir, "better-auth", `schema.${dialect}.ts`);
+  if (exists(tsPath))
+    return tsPath;
+  const mjsPath = join(buildDir, "better-auth", `schema.${dialect}.mjs`);
+  if (exists(mjsPath))
+    return mjsPath;
+  return null;
+}
+async function loadAuthOptions(context) {
+  const isProduction = !context.nuxt.options.dev;
+  const configFile = `${context.serverConfigPath}.ts`;
+  const alias = Object.fromEntries(
+    Object.entries(context.nuxt.options.alias).filter(([, value]) => typeof value === "string").map(([key, value]) => [key, value])
+  );
+  const userConfig = await loadUserAuthConfig(configFile, isProduction, alias, context.nuxt.options.runtimeConfig, context.nuxt.options.rootDir);
+  const extendedConfig = {};
+  await context.nuxt.callHook("better-auth:config:extend", extendedConfig);
+  const plugins = [...userConfig.plugins || [], ...extendedConfig.plugins || []];
+  return { userConfig, plugins };
+}
+async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, hubSecondaryStorage) {
+  const hub = nuxt.options.hub;
+  const dialect = getHubDialect(hub);
+  if (!dialect || !["sqlite", "postgresql", "mysql"].includes(dialect)) {
+    consola.warn(`Unsupported database dialect: ${dialect}`);
+    return;
+  }
+  const context = { nuxt, serverConfigPath };
+  try {
+    const { userConfig, plugins } = await loadAuthOptions(context);
+    const userHasSecondaryStorage = userConfig.secondaryStorage != null;
+    const secondaryStorageResolution = resolveSchemaSecondaryStorageInjection(hubSecondaryStorage, userHasSecondaryStorage, !nuxt.options.dev);
+    if (secondaryStorageResolution.error)
+      throw new Error(secondaryStorageResolution.error);
+    if (secondaryStorageResolution.warn)
+      consola.warn(secondaryStorageResolution.warn);
+    const authOptions = {
+      ...userConfig,
+      plugins,
+      secondaryStorage: secondaryStorageResolution.inject ? {
+        delete: async (_key) => {
+        },
+        get: async (_key) => null,
+        getAndDelete: async (_key) => null,
+        increment: async (_key, _ttl) => 1,
+        set: async (_key, _value, _ttl) => {
+        }
+      } : void 0
+    };
+    const hubCasing = getHubCasing(hub);
+    const schemaOptions = { ...options.schema, useUuid: userConfig.advanced?.database?.generateId === "uuid", casing: options.schema?.casing ?? hubCasing };
+    const schemaCode = await generateDrizzleSchema(authOptions, dialect, schemaOptions);
+    const schemaDir = join(nuxt.options.buildDir, "better-auth");
+    const schemaPathTs = join(schemaDir, `schema.${dialect}.ts`);
+    const schemaPathMjs = join(schemaDir, `schema.${dialect}.mjs`);
+    await mkdir(schemaDir, { recursive: true });
+    await writeFile(schemaPathTs, schemaCode);
+    await writeFile(schemaPathMjs, schemaCode);
+    if (isInsideNodeModules(nuxt.options.buildDir)) {
+      const rootSchemaDir = join(nuxt.options.rootDir, ".nuxt", "better-auth");
+      const rootSchemaPathTs = join(rootSchemaDir, `schema.${dialect}.ts`);
+      await mkdir(rootSchemaDir, { recursive: true });
+      await writeFile(rootSchemaPathTs, schemaCode);
+    }
+    addTemplate({ filename: `better-auth/schema.${dialect}.ts`, getContents: () => schemaCode, write: true });
+    addTemplate({ filename: `better-auth/schema.${dialect}.mjs`, getContents: () => schemaCode, write: true });
+    consola.info(`Generated ${dialect} schema (.ts + .mjs)`);
+    const nuxtWithHubHooks = nuxt;
+    nuxtWithHubHooks.hook("hub:db:schema:extend", ({ paths, dialect: hookDialect }) => {
+      const schemaPath = resolveHubSchemaPath(nuxt.options.buildDir, nuxt.options.rootDir, hookDialect);
+      if (schemaPath)
+        paths.unshift(schemaPath);
+    });
+  } catch (error) {
+    const isProduction = !nuxt.options.dev;
+    if (isProduction)
+      throw error;
+    consola.error("Failed to generate schema:", error);
+    throw error;
+  }
+}
+
+const DEFAULT_SECRET_ENV = "NUXT_BETTER_AUTH_SECRET";
+const FALLBACK_SECRET_ENV = "BETTER_AUTH_SECRET";
+const VERSIONED_SECRET_ENV = "BETTER_AUTH_SECRETS";
+const generateSecret = () => randomBytes(32).toString("hex");
+function readEnvFile(rootDir) {
+  const envPath = join(rootDir, ".env");
+  return existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
+}
+function hasEnvSecret(rootDir) {
+  const envFile = readEnvFile(rootDir);
+  return [DEFAULT_SECRET_ENV, FALLBACK_SECRET_ENV, VERSIONED_SECRET_ENV].some((name) => {
+    const match = envFile.match(new RegExp(`^${name}=(.+)$`, "m"));
+    return !!match && !!match[1] && match[1].trim().length > 0;
+  });
+}
+function appendSecretToEnv(rootDir, secret) {
+  const envPath = join(rootDir, ".env");
+  let content = readEnvFile(rootDir);
+  if (content.length > 0 && !content.endsWith("\n"))
+    content += "\n";
+  content += `${DEFAULT_SECRET_ENV}=${secret}
+`;
+  writeFileSync(envPath, content, "utf-8");
+}
+async function promptForSecret(rootDir, consola, options = {}) {
+  const configuredSecret = options.configuredSecret?.trim();
+  if (configuredSecret)
+    return void 0;
+  if (process.env.NUXT_BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRETS || hasEnvSecret(rootDir))
+    return void 0;
+  const hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (options.prepare || !hasTty) {
+    consola.warn("[nuxt-better-auth] Skipping auth secret prompt (non-interactive). Set NUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET, or BETTER_AUTH_SECRETS.");
+    return void 0;
+  }
+  if (isCI || isTest) {
+    const secret2 = generateSecret();
+    appendSecretToEnv(rootDir, secret2);
+    consola.info("Generated NUXT_BETTER_AUTH_SECRET and added to .env (CI/test mode)");
+    return secret2;
+  }
+  consola.box("An auth secret is required for authentication.\nThis will add NUXT_BETTER_AUTH_SECRET to your .env file.\nBETTER_AUTH_SECRET and BETTER_AUTH_SECRETS are also supported.");
+  const choice = await consola.prompt("How do you want to set it?", {
+    type: "select",
+    options: [
+      { label: "Generate for me", value: "generate", hint: "uses crypto.randomBytes(32)" },
+      { label: "Enter manually", value: "paste" },
+      { label: "Skip", value: "skip", hint: "will fail in production" }
+    ],
+    cancel: "null"
+  });
+  if (typeof choice === "symbol" || choice === "skip") {
+    consola.warn("Skipping auth secret setup. Auth will fail without a configured secret in production.");
+    return void 0;
+  }
+  let secret;
+  if (choice === "generate") {
+    secret = generateSecret();
+  } else {
+    const input = await consola.prompt("Paste your secret (min 32 chars):", { type: "text", cancel: "null" });
+    if (typeof input === "symbol" || !input || input.length < 32) {
+      consola.warn("Invalid secret. Skipping.");
+      return void 0;
+    }
+    secret = input;
+  }
+  const preview = `${secret.slice(0, 8)}...${secret.slice(-4)}`;
+  const confirm = await consola.prompt(`Add to .env:
+${DEFAULT_SECRET_ENV}=${preview}
+Proceed?`, { type: "confirm", initial: true, cancel: "null" });
+  if (typeof confirm === "symbol" || !confirm) {
+    consola.info("Cancelled. Secret not written.");
+    return void 0;
+  }
+  appendSecretToEnv(rootDir, secret);
+  consola.success("Added NUXT_BETTER_AUTH_SECRET to .env");
+  return secret;
+}
+
+function resolveDatabaseProvider(input) {
+  const enabledProviders = Object.entries(input.providers).filter(([_id, provider]) => provider.isEnabled?.(input.context) ?? true);
+  if (!enabledProviders.length) {
+    throw new Error("[nuxt-better-auth] No database provider is enabled. Register one with the better-auth:database:providers hook.");
+  }
+  enabledProviders.sort((a, b) => (b[1].priority ?? 0) - (a[1].priority ?? 0));
+  const [id, definition] = enabledProviders[0];
+  return { id, definition };
+}
+
+function resolveSecondaryStorage(input) {
+  const { options, clientOnly, hasNuxtHub, hub } = input;
+  const opt = options.hubSecondaryStorage ?? false;
+  const useHubKV = opt === true;
+  const secondaryStorageEnabled = opt === true || opt === "custom";
+  if (secondaryStorageEnabled && clientOnly) {
+    throw new Error("[nuxt-better-auth] hubSecondaryStorage is not available in clientOnly mode. Either disable clientOnly or remove auth.hubSecondaryStorage.");
+  }
+  if (useHubKV && (!hasNuxtHub || !hub?.kv)) {
+    throw new Error("[nuxt-better-auth] hubSecondaryStorage: true requires @nuxthub/core with hub.kv: true. Either add hub.kv: true to your nuxt.config or remove auth.hubSecondaryStorage.");
+  }
+  return { useHubKV, secondaryStorageEnabled };
+}
+function setupRuntimeConfig(input) {
+  const { nuxt, options, clientOnly, databaseProvider, consola } = input;
+  const { useHubKV, secondaryStorageEnabled } = resolveSecondaryStorage(input);
+  nuxt.options.runtimeConfig.public = nuxt.options.runtimeConfig.public || {};
+  const configuredSiteUrl = nuxt.options.runtimeConfig.public.siteUrl;
+  nuxt.options.runtimeConfig.public.siteUrl = configuredSiteUrl || process.env.NUXT_PUBLIC_SITE_URL || "";
+  nuxt.options.runtimeConfig.public.auth = defu(nuxt.options.runtimeConfig.public.auth, {
+    redirects: {
+      login: options.redirects?.login ?? "/login",
+      guest: options.redirects?.guest ?? "/",
+      authenticated: options.redirects?.authenticated,
+      logout: options.redirects?.logout
+    },
+    preserveRedirect: options.preserveRedirect ?? true,
+    redirectQueryKey: options.redirectQueryKey ?? "redirect",
+    useDatabase: databaseProvider !== "none",
+    databaseProvider,
+    clientOnly,
+    session: {
+      skipHydratedSsrGetSession: options.session?.skipHydratedSsrGetSession ?? false
+    }
+  });
+  if (clientOnly) {
+    const siteUrl = nuxt.options.runtimeConfig.public.siteUrl;
+    if (!siteUrl)
+      consola.warn("clientOnly mode: set runtimeConfig.public.siteUrl (or NUXT_PUBLIC_SITE_URL) to your frontend URL");
+    consola.info("clientOnly mode enabled - server utilities (serverAuth, getRequestSession, getUserSession, requireUserSession) are not available");
+    return { useHubKV, secondaryStorageEnabled };
+  }
+  const currentSecret = nuxt.options.runtimeConfig.betterAuthSecret;
+  nuxt.options.runtimeConfig.betterAuthSecret = currentSecret || process.env.NUXT_BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRET || "";
+  nuxt.options.runtimeConfig.auth = defu(nuxt.options.runtimeConfig.auth, {
+    hubSecondaryStorage: options.hubSecondaryStorage ?? false
+  });
+  return { useHubKV, secondaryStorageEnabled };
+}
+
+function buildSecondaryStorageCode(useHubKV) {
+  if (!useHubKV)
+    return "export function createSecondaryStorage() { return undefined }";
+  return `import { kv } from '@nuxthub/kv'
+export function createSecondaryStorage() {
+  return {
+    get: async (key) => kv.get(\`_auth:\${key}\`),
+    set: async (key, value, ttl) => kv.set(\`_auth:\${key}\`, value, { ttl }),
+    delete: async (key) => kv.del(\`_auth:\${key}\`),
+  }
+}`;
+}
+function buildDatabaseCode(input) {
+  if (input.provider === "nuxthub") {
+    if (input.hubDialect === "postgresql") {
+      return `import { db } from '@nuxthub/db'
+import * as schema from './schema.${input.hubDialect}.mjs'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { drizzle } from 'drizzle-orm/postgres-js'
+import postgres from 'postgres'
+
+const dialect = 'pg'
+const requestDatabaseKey = Symbol.for('nuxt-better-auth.requestDatabase')
+const fallbackRequestDatabaseContext = new WeakMap()
+
+function getRequestDatabaseContext(event) {
+  const eventWithContext = event
+  if (eventWithContext?.context && typeof eventWithContext.context === 'object')
+    return eventWithContext.context
+
+  let context = fallbackRequestDatabaseContext.get(event)
+  if (!context) {
+    context = {}
+    fallbackRequestDatabaseContext.set(event, context)
+  }
+  return context
+}
+
+function createHyperdriveAdapter(client) {
+  return drizzleAdapter(drizzle({ client, schema }), { provider: dialect, schema, usePlural: ${input.usePlural}, camelCase: ${input.camelCase} })
+}
+
+function getCloudflareContext(event) {
+  return event?.context?.cloudflare
+}
+
+function resolveHyperdrive(event) {
+  const cloudflareEnv = getCloudflareContext(event)?.env
+  return cloudflareEnv?.POSTGRES || process.env.POSTGRES || globalThis.__env__?.POSTGRES || globalThis.POSTGRES
+}
+
+function scheduleCleanup(event, cleanup) {
+  const cloudflareContext = getCloudflareContext(event)
+  if (typeof cloudflareContext?.context?.waitUntil === 'function') {
+    cloudflareContext.context.waitUntil(cleanup)
+    return
+  }
+
+  if (typeof event?.context?.waitUntil === 'function') {
+    event.context.waitUntil(cleanup)
+    return
+  }
+
+  const waitUntil = event?.waitUntil || event?.req?.waitUntil || event?.node?.req?.waitUntil
+  if (typeof waitUntil === 'function')
+    waitUntil.call(event?.req || event?.node?.req || event, cleanup)
+  else
+    void cleanup
+}
+
+function registerClientCleanup(event, client) {
+  const response = event?.node?.res
+  if (!response || typeof response.once !== 'function')
+    return
+
+  let closed = false
+
+  const cleanup = () => {
+    if (closed)
+      return
+
+    closed = true
+    const close = client.end({ timeout: 0 }).catch(() => {})
+    scheduleCleanup(event, close)
+  }
+
+  response.once('finish', cleanup)
+  response.once('close', cleanup)
+}
+
+export function createDatabase(event) {
+  const hyperdrive = resolveHyperdrive(event)
+  if (!hyperdrive?.connectionString)
+    return drizzleAdapter(db, { provider: dialect, schema, usePlural: ${input.usePlural}, camelCase: ${input.camelCase} })
+
+  if (event) {
+    const context = getRequestDatabaseContext(event)
+    const cached = context[requestDatabaseKey]
+    if (cached)
+      return cached
+
+    const client = postgres(hyperdrive.connectionString, {
+      prepare: false,
+      onnotice: () => {},
+      max: 1,
+    })
+    const database = createHyperdriveAdapter(client)
+
+    context[requestDatabaseKey] = database
+    registerClientCleanup(event, client)
+    return database
+  }
+  const client = postgres(hyperdrive.connectionString, {
+    prepare: false,
+    onnotice: () => {},
+    max: 1,
+  })
+
+  return createHyperdriveAdapter(client)
+}
+export { db }`;
+    }
+    return `import { db } from '@nuxthub/db'
+import * as schema from './schema.${input.hubDialect}.mjs'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+const rawDialect = '${input.hubDialect}'
+const dialect = rawDialect === 'postgresql' ? 'pg' : rawDialect
+export function createDatabase() { return drizzleAdapter(db, { provider: dialect, schema, usePlural: ${input.usePlural}, camelCase: ${input.camelCase} }) }
+export { db }`;
+  }
+  return `export function createDatabase() { return undefined }
+export const db = undefined`;
+}
+function buildSchemaExportCode(hasHubDb, hubDialect) {
+  if (!hasHubDb) {
+    return `export const user = undefined
+export const session = undefined
+export const account = undefined
+export const verification = undefined
+export const schema = undefined
+`;
+  }
+  return `export * from './schema.${hubDialect}.mjs'
+import * as generatedSchema from './schema.${hubDialect}.mjs'
+
+const getGeneratedTable = name => generatedSchema[name] ?? generatedSchema[\`\${name}s\`]
+export const user = getGeneratedTable('user')
+export const session = getGeneratedTable('session')
+export const account = getGeneratedTable('account')
+export const verification = getGeneratedTable('verification')
+export const schema = { ...generatedSchema, user, session, account, verification }
+`;
+}
+function buildAuthRouteRulesCode(authRouteRules) {
+  return `export const authRouteRules = ${JSON.stringify(authRouteRules, null, 2)}
+`;
+}
+
+function assertConfigPresence(configs, clientOnly) {
+  if (!clientOnly && !configs.server.exists)
+    throw new Error(`[nuxt-better-auth] Missing ${configs.server.file}.ts - export default defineServerAuth(...)`);
+  if (!configs.client.exists)
+    throw new Error(`[nuxt-better-auth] Missing ${configs.client.file}.ts - export default defineClientAuth(...)`);
+}
+function createDefaultDatabaseProviders(buildContext) {
+  return {
+    nuxthub: {
+      priority: 100,
+      isEnabled: ({ hasHubDbAvailable: enabled }) => enabled,
+      buildDatabaseCode: () => buildDatabaseCode({
+        provider: "nuxthub",
+        ...buildContext
+      })
+    },
+    none: {
+      priority: 0,
+      buildDatabaseCode: () => buildDatabaseCode({
+        provider: "none",
+        ...buildContext
+      })
+    }
+  };
+}
+function collectAuthRouteRules(nuxt) {
+  const runtimeRouteRulesSource = nuxt.options.nitro?.routeRules || nuxt.options.routeRules || {};
+  return Object.fromEntries(
+    Object.entries(runtimeRouteRulesSource).flatMap(([path, rule]) => {
+      if (!rule || typeof rule !== "object" || !("auth" in rule))
+        return [];
+      return [[path, { auth: rule.auth }]];
+    })
+  );
+}
+async function resolveAuthModuleSetup(input, dependencies = {}) {
+  const { nuxt, options, runtimeTypesAugmentPath, consola } = input;
+  const hasNuxtModuleFn = dependencies.hasNuxtModule ?? hasNuxtModule;
+  const clientOnly = options.clientOnly ?? false;
+  const configs = resolveAuthConfigDescriptors(nuxt, {
+    server: options.serverConfig,
+    client: options.clientConfig
+  }, {
+    configExists: dependencies.configExists
+  });
+  assertConfigPresence(configs, clientOnly);
+  const aliases = {
+    "#auth/server": clientOnly ? void 0 : configs.server.path,
+    "#auth/client": configs.client.path
+  };
+  if (aliases["#auth/server"])
+    nuxt.options.alias["#auth/server"] = aliases["#auth/server"];
+  nuxt.options.alias["#auth/client"] = aliases["#auth/client"];
+  const hasNuxtHub = hasNuxtModuleFn("@nuxthub/core", nuxt);
+  const hub = hasNuxtHub ? nuxt.options.hub : void 0;
+  const hasHubDbAvailable = !clientOnly && hasNuxtHub && !!hub?.db;
+  const hubDialect = getHubDialect(hub) ?? "sqlite";
+  const usePlural = options.schema?.usePlural ?? false;
+  const camelCase = (options.schema?.casing ?? getHubCasing(hub)) !== "snake_case";
+  let providerId = "none";
+  let providerDefinition;
+  if (!clientOnly) {
+    const buildContext = { hubDialect, usePlural, camelCase };
+    const providers = createDefaultDatabaseProviders(buildContext);
+    const enabledContext = {
+      nuxt,
+      options,
+      clientOnly,
+      hasHubDbAvailable
+    };
+    await nuxt.callHook("better-auth:database:providers", providers);
+    const resolvedProvider = resolveDatabaseProvider({
+      providers,
+      context: enabledContext
+    });
+    providerId = resolvedProvider.id;
+    providerDefinition = resolvedProvider.definition;
+  }
+  const runtime = setupRuntimeConfig({
+    nuxt,
+    options,
+    clientOnly,
+    databaseProvider: providerId,
+    hasNuxtHub,
+    hub,
+    consola
+  });
+  if (runtime.useHubKV && !nuxt.options.alias["hub:kv"]) {
+    throw new Error("[nuxt-better-auth] hub:kv not found. Ensure @nuxthub/core is loaded before this module and hub.kv is enabled.");
+  }
+  const hasHubDb = providerId === "nuxthub";
+  if (hasHubDb && !nuxt.options.alias["hub:db"]) {
+    throw new Error("[nuxt-better-auth] hub:db not found. Ensure @nuxthub/core is loaded before this module and hub.db is configured.");
+  }
+  return {
+    clientOnly,
+    configs,
+    aliases,
+    hub: {
+      hasNuxtHub,
+      options: hub,
+      hasHubDbAvailable
+    },
+    database: {
+      providerId,
+      hasHubDb,
+      providerDefinition,
+      buildContext: clientOnly ? void 0 : { hubDialect, usePlural, camelCase }
+    },
+    runtime,
+    prepareTypes: clientOnly ? void 0 : {
+      serverDir: dirname(configs.server.path),
+      hasHubDb
+    },
+    serverTypes: clientOnly ? void 0 : {
+      serverConfigPath: configs.server.path,
+      hasHubDb
+    },
+    sharedTypes: {
+      runtimeTypesAugmentPath,
+      clientConfigPath: configs.client.path
+    },
+    schemaGeneration: hasHubDb ? {
+      serverConfigPath: configs.server.path,
+      hubSecondaryStorage: options.hubSecondaryStorage ?? false,
+      externalizeNuxtHubDatabase: true
+    } : void 0
+  };
+}
+
+function registerServerTypeTemplates(input) {
+  const { serverConfigPath, hasHubDb, runtimeTypesPath, sharedServerConfigSafe, h3TypesPath, nitroTypesPath } = input;
+  const routeRuleAugmentations = (nitroTypesPath === "nitro/types" ? [nitroTypesPath] : ["nitropack", nitroTypesPath]).map((moduleName) => `declare module '${moduleName}' {
+  interface NitroRouteRules {
+    auth?: import('${runtimeTypesPath}').AuthMeta
+  }
+  interface NitroRouteConfig {
+    auth?: import('${runtimeTypesPath}').AuthMeta
+  }
+}`).join("\n");
+  const serverConfigTypeTemplateOptions = sharedServerConfigSafe ? { nuxt: true, nitro: true, node: true, shared: true } : { nuxt: true, nitro: true, node: true };
+  addTypeTemplate({
+    filename: "types/auth-secondary-storage.d.ts",
+    getContents: () => `
+declare module '#auth/secondary-storage' {
+  interface SecondaryStorage {
+    get: (key: string) => Promise<string | null>
+    set: (key: string, value: unknown, ttl?: number) => Promise<void>
+    delete: (key: string) => Promise<void>
+  }
+  export function createSecondaryStorage(): SecondaryStorage | undefined
+}
+`
+  }, { nitro: true });
+  addTypeTemplate({
+    filename: "types/auth-database.d.ts",
+    getContents: () => `
+declare module '#auth/database' {
+  import type { BetterAuthOptions } from 'better-auth'
+  export function createDatabase(event?: import('${h3TypesPath}').H3Event): BetterAuthOptions['database']
+  export const db: ${hasHubDb ? `typeof import('@nuxthub/db')['db']` : "undefined"}
+}
+`
+  }, { nitro: true });
+  addTypeTemplate({
+    filename: "types/auth-schema.d.ts",
+    getContents: () => `
+declare module '#auth/schema' {
+  export const user: any
+  export const session: any
+  export const account: any
+  export const verification: any
+  export const schema: {
+    user: any
+    session: any
+    account: any
+    verification: any
+    [key: string]: any
+  } | undefined
+}
+`
+  }, { nitro: true });
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-server-context.d.ts",
+    getContents: () => `
+/// <reference path="./nitro-imports.d.ts" />
+/// <reference path="./auth-database.d.ts" />
+/// <reference path="./auth-schema.d.ts" />
+/// <reference path="./auth-secondary-storage.d.ts" />
+${hasHubDb ? '/// <reference path="../hub/db.d.ts" />' : ""}
+
+export {}
+`
+  }, { node: true });
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-config-context.d.ts",
+    getContents: () => `
+import type { RuntimeConfig } from 'nuxt/schema'
+
+declare module '@nuxtjs/better-auth/config' {
+  interface ServerAuthContextExtension {
+    runtimeConfig: RuntimeConfig
+    db: ${hasHubDb ? `typeof import('@nuxthub/db')['db']` : "undefined"}
+    requestOrigin?: string
+  }
+}
+
+`
+  }, { nuxt: true, nitro: true, node: true, shared: true });
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-infer.d.ts",
+    getContents: () => `
+import type { BetterAuthOptions, BetterAuthPlugin, InferPluginTypes, UnionToIntersection } from 'better-auth'
+import type { InferFieldsOutput } from 'better-auth/db'
+import type createServerAuth from '${serverConfigPath}'
+
+type _RawConfig = ReturnType<typeof createServerAuth>
+type _RawPlugins = _RawConfig extends { plugins: infer P } ? P : _RawConfig extends { plugins?: infer P } ? P : []
+type _NormalizedPlugins = _RawPlugins extends readonly (infer T)[]
+  ? Array<T & BetterAuthPlugin>
+  : _RawPlugins extends (infer T)[]
+      ? Array<T & BetterAuthPlugin>
+      : BetterAuthPlugin[]
+type _Config = Omit<BetterAuthOptions, 'plugins'> & Omit<_RawConfig, 'plugins'> & {
+  plugins?: _NormalizedPlugins
+}
+
+type _InferModelFieldsFromPlugins<P, M extends string> = P extends readonly (infer Plugin)[]
+  ? UnionToIntersection<Plugin extends { schema: { [K in M]: { fields: infer F } } } ? InferFieldsOutput<F> : {}>
+  : P extends (infer Plugin)[]
+      ? UnionToIntersection<Plugin extends { schema: { [K in M]: { fields: infer F } } } ? InferFieldsOutput<F> : {}>
+      : {}
+
+type _InferModelFieldsFromOptions<C, M extends 'user' | 'session'> = C extends { [K in M]: { additionalFields: infer F } }
+  ? InferFieldsOutput<F>
+  : {}
+
+type _UserFallback = _InferModelFieldsFromPlugins<_RawPlugins, 'user'> & _InferModelFieldsFromOptions<_RawConfig, 'user'>
+type _SessionFallback = _InferModelFieldsFromPlugins<_RawPlugins, 'session'> & _InferModelFieldsFromOptions<_RawConfig, 'session'>
+
+declare module '#nuxt-better-auth' {
+  interface AuthUser extends _UserFallback {}
+  interface AuthSession extends _SessionFallback {}
+  type PluginTypes = InferPluginTypes<_Config>
+}
+`
+  }, serverConfigTypeTemplateOptions);
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-social-providers.d.ts",
+    getContents: () => `
+import type createServerAuth from '${serverConfigPath}'
+
+type _RawConfig = ReturnType<typeof createServerAuth>
+type _RawSocialProviders = _RawConfig extends { socialProviders: infer S } ? S : _RawConfig extends { socialProviders?: infer S } ? S : {}
+type _SocialProviderIds = Extract<keyof NonNullable<_RawSocialProviders>, string>
+
+declare module '#nuxt-better-auth' {
+  interface AuthSocialProviderRegistry {
+    ids: _SocialProviderIds
+  }
+}
+`
+  }, serverConfigTypeTemplateOptions);
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-endpoints.d.ts",
+    getContents: () => `
+import type createServerAuth from '${serverConfigPath}'
+import type { BetterAuthOptions } from 'better-auth'
+import type { getEndpoints } from 'better-auth/api'
+import type { Serialize, Simplify } from '${nitroTypesPath}'
+import type { FetchError } from 'ofetch'
+
+type _RawConfig = ReturnType<typeof createServerAuth>
+type _RawPlugins = _RawConfig extends { plugins: infer P } ? P : _RawConfig extends { plugins?: infer P } ? P : []
+type _Config = Omit<BetterAuthOptions, 'plugins'> & Omit<_RawConfig, 'plugins'> & {
+  plugins?: _RawPlugins
+}
+
+type _AuthApi = ReturnType<typeof getEndpoints<_Config>>['api']
+type _NormalizeMethod<M extends string> = M extends '*' ? 'default' : Lowercase<M>
+type _RouteMethodFromOption<M> = M extends readonly (infer T)[]
+  ? _NormalizeMethod<Extract<T, string>>
+  : M extends string
+      ? _NormalizeMethod<M>
+      : 'default'
+type _RouteMethodFromEndpoint<E> = E extends { options: { method: infer M } } ? _RouteMethodFromOption<M> : 'default'
+type _RoutePathFromEndpoint<E> = E extends { path: infer P extends string }
+  ? string extends P
+      ? never
+      : \`/api/auth\${P}\`
+  : never
+type _RouteResponseFromEndpoint<E> = E extends (...args: any[]) => Promise<infer R> ? Simplify<Serialize<Awaited<R>>> : never
+type _RouteDefaultResponse<E> = never
+type _UnionToIntersection<U> = (U extends unknown ? (value: U) => void : never) extends (value: infer I) => void ? I : never
+
+type _CoreAuthInternalApi = {
+  [K in keyof _AuthApi as _RoutePathFromEndpoint<_AuthApi[K]>]: {
+    [M in _RouteMethodFromEndpoint<_AuthApi[K]> | 'default']: M extends 'default' ? _RouteDefaultResponse<_AuthApi[K]> : _RouteResponseFromEndpoint<_AuthApi[K]>
+  }
+}
+type _PluginEndpointMaps<Plugins> = Plugins extends readonly (infer Plugin)[]
+  ? Plugin extends { endpoints: infer Endpoints extends Record<string, unknown> }
+      ? {
+          [K in keyof Endpoints as _RoutePathFromEndpoint<Endpoints[K]>]: {
+            [M in _RouteMethodFromEndpoint<Endpoints[K]> | 'default']: M extends 'default' ? _RouteDefaultResponse<Endpoints[K]> : _RouteResponseFromEndpoint<Endpoints[K]>
+          }
+        }
+      : {}
+  : Plugins extends (infer Plugin)[]
+      ? Plugin extends { endpoints: infer Endpoints extends Record<string, unknown> }
+          ? {
+              [K in keyof Endpoints as _RoutePathFromEndpoint<Endpoints[K]>]: {
+                [M in _RouteMethodFromEndpoint<Endpoints[K]> | 'default']: M extends 'default' ? _RouteDefaultResponse<Endpoints[K]> : _RouteResponseFromEndpoint<Endpoints[K]>
+              }
+            }
+          : {}
+      : {}
+type _PluginAuthInternalApi = _UnionToIntersection<_PluginEndpointMaps<_RawPlugins>>
+type _GeneratedAuthInternalApi = _CoreAuthInternalApi & _PluginAuthInternalApi
+
+type _RoutePathToRequestPath<Path extends string> = Path extends \`\${infer Prefix}:\${string}/\${infer Rest}\`
+  ? \`\${Prefix}\${string}/\${_RoutePathToRequestPath<Rest>}\`
+  : Path extends \`\${infer Prefix}:\${string}\`
+      ? \`\${Prefix}\${string}\`
+      : Path
+type _AuthApiPatternPath = Extract<keyof _GeneratedAuthInternalApi, string>
+type _AuthApiRequestPath = _RoutePathToRequestPath<_AuthApiPatternPath>
+type _AuthPatternFromRequestPath<Path extends string> = {
+  [Pattern in _AuthApiPatternPath]: Path extends _RoutePathToRequestPath<Pattern> ? Pattern : never
+}[_AuthApiPatternPath]
+type _AuthEndpointMethod<Path extends _AuthApiRequestPath> = Extract<keyof _GeneratedAuthInternalApi[_AuthPatternFromRequestPath<Path>], string>
+
+type _AuthFetchMethod<Path extends _AuthApiRequestPath> = Extract<Exclude<import('${nitroTypesPath}').NitroFetchOptions<Path>['method'], undefined>, string>
+type _AuthFetchDefaultMethod<Path extends _AuthApiRequestPath> = 'get'
+type _AuthFetchResolvedMethod<Path extends _AuthApiRequestPath, Method extends string> = Lowercase<Method> extends _AuthEndpointMethod<Path>
+  ? Lowercase<Method>
+  : never
+type _AuthFetchResult<Path extends _AuthApiRequestPath, Method extends string> = _GeneratedAuthInternalApi[_AuthPatternFromRequestPath<Path>][_AuthFetchResolvedMethod<Path, Method>]
+
+declare module '#nuxt-better-auth' {
+  export type AuthApiInternalRoutes = _GeneratedAuthInternalApi
+  export type AuthApiEndpointPatternPath = _AuthApiPatternPath
+  export type AuthApiEndpointPath = _AuthApiRequestPath
+  export type AuthApiEndpointMethod<Path extends AuthApiEndpointPath> = _AuthEndpointMethod<Path>
+  export type AuthApiEndpointResponse<
+    Path extends AuthApiEndpointPath,
+    Method extends AuthApiEndpointMethod<Path> = AuthApiEndpointMethod<Path>,
+  > = AuthApiInternalRoutes[_AuthPatternFromRequestPath<Path>][Method]
+}
+
+declare module 'nuxt/dist/app/composables/fetch' {
+  export function useFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = undefined,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = DataT,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useFetch(request: string | import('vue').Ref<string> | (() => string), opts?: any): any
+
+  export function useLazyFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = undefined,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: Omit<import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>, 'lazy'>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useLazyFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = DataT,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: Omit<import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>, 'lazy'>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useLazyFetch(request: string | import('vue').Ref<string> | (() => string), opts?: any): any
+}
+
+declare module 'nuxt/app' {
+  export function useFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = undefined,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = DataT,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useFetch(request: string | import('vue').Ref<string> | (() => string), opts?: any): any
+
+  export function useLazyFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = undefined,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: Omit<import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>, 'lazy'>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useLazyFetch<
+    ErrorT = FetchError,
+    Path extends import('#nuxt-better-auth').AuthApiEndpointPath = import('#nuxt-better-auth').AuthApiEndpointPath,
+    Method extends _AuthFetchMethod<Path> = _AuthFetchDefaultMethod<Path>,
+    _ResT = _AuthFetchResult<Path, Method>,
+    DataT = _ResT,
+    PickKeys extends import('nuxt/dist/app/composables/asyncData').KeysOf<DataT> = import('nuxt/dist/app/composables/asyncData').KeysOf<DataT>,
+    DefaultT = DataT,
+  >(request: import('vue').Ref<Path> | Path | (() => Path), opts?: Omit<import('nuxt/dist/app/composables/fetch').UseFetchOptions<_ResT, DataT, PickKeys, DefaultT, Path, Method>, 'lazy'>): import('nuxt/dist/app/composables/asyncData').AsyncData<import('nuxt/dist/app/composables/asyncData').PickFrom<DataT, PickKeys> | DefaultT, ErrorT | undefined>
+  export function useLazyFetch(request: string | import('vue').Ref<string> | (() => string), opts?: any): any
+}
+export {}
+`
+  }, serverConfigTypeTemplateOptions);
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-nitro.d.ts",
+    getContents: () => `
+${routeRuleAugmentations}
+export {}
+`
+  }, { nitro: true, node: true });
+}
+function registerSharedTypeTemplates(input) {
+  const nitroV3 = input.h3TypesPath === "nitro/h3";
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth.d.ts",
+    getContents: () => `
+declare module '#nuxt-better-auth' {
+  import type { ComputedRef, Ref } from 'vue'
+
+  export interface AuthUser {
+    id: string
+    createdAt: Date
+    updatedAt: Date
+    email: string
+    emailVerified: boolean
+    name: string
+    image?: string | null
+  }
+
+  export interface AuthSession {
+    id: string
+    createdAt: Date
+    updatedAt: Date
+    userId: string
+    expiresAt: Date
+    token: string
+    ipAddress?: string | null
+    userAgent?: string | null
+  }
+
+  export interface ServerAuthContext {
+    runtimeConfig: Record<string, unknown>
+    db: unknown
+    requestOrigin?: string
+  }
+
+  export interface AuthSocialProviderRegistry {}
+  export type AuthSocialProviderId = AuthSocialProviderRegistry extends { ids: infer T } ? Extract<T, string> : never
+
+  export interface UserSessionComposable {
+    user: Ref<AuthUser | null>
+    session: Ref<AuthSession | null>
+    loggedIn: ComputedRef<boolean>
+    ready: ComputedRef<boolean>
+    fetchSession: (options?: { headers?: HeadersInit, force?: boolean }) => Promise<void>
+    waitForSession: () => Promise<void>
+    signOut: (options?: { onSuccess?: () => void | Promise<void> }) => Promise<void>
+    updateUser: (updates: Partial<AuthUser>) => Promise<void>
+  }
+
+  export type UserMatch<T> = { [K in keyof T]?: T[K] | T[K][] }
+
+  export interface AppSession {
+    user: AuthUser
+    session: AuthSession
+  }
+
+  export interface RequireSessionOptions {
+    user?: UserMatch<AuthUser>
+    rule?: (ctx: { user: AuthUser, session: AuthSession }) => boolean | Promise<boolean>
+  }
+
+  export type { AuthMeta, AuthMode, AuthRouteRules, Auth, InferUser, InferSession } from '${input.runtimeTypesPath}'
+}
+`
+  }, { nuxt: true, nitro: true, node: true, shared: true });
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-h3.d.ts",
+    getContents: () => `
+declare module '${nitroV3 ? "srvx" : "h3"}' {
+  interface ${nitroV3 ? "ServerRequestContext" : "H3EventContext"} {
+    requestSession?: import('${input.runtimeTypesAugmentPath}').AppSession | null
+  }
+}
+export {}
+`
+  }, { nuxt: true, nitro: true, node: true, shared: true });
+  addTypeTemplate({
+    filename: "types/nuxt-better-auth-client.d.ts",
+    getContents: () => `
+import type createAppAuthClient from '${input.clientConfigPath}'
+declare module '#nuxt-better-auth' {
+  export type AppAuthClient = ReturnType<typeof createAppAuthClient>
+}
+`
+  });
+}
+
+const consola = consola$1.withTag("nuxt-better-auth");
+const serverAliasImportRE = /from\s+['"]#server/;
+const layersAliasImportRE = /from\s+['"]#layers\//;
+const rootAliasImportRE = /from\s+['"]~~/;
+const workspaceAliasImportRE = /from\s+['"]@@/;
+const dbIdentifierRE = /\bdb\b/;
+const sessionHookAfterIdentifierRE = /\bsessionHookAfter\b/;
+const nuxtHubDbImportRE = /@nuxthub\/db/;
+function isServerConfigSharedTypeSafe(serverConfigPath) {
+  const resolvedPath = [
+    serverConfigPath,
+    `${serverConfigPath}.ts`,
+    `${serverConfigPath}.mts`,
+    `${serverConfigPath}.cts`,
+    `${serverConfigPath}.js`,
+    `${serverConfigPath}.mjs`,
+    `${serverConfigPath}.cjs`
+  ].find((path) => existsSync(path));
+  if (!resolvedPath)
+    return false;
+  const contents = readFileSync(resolvedPath, "utf8");
+  return !(serverAliasImportRE.test(contents) || layersAliasImportRE.test(contents) || rootAliasImportRE.test(contents) || workspaceAliasImportRE.test(contents) || dbIdentifierRE.test(contents) || sessionHookAfterIdentifierRE.test(contents) || nuxtHubDbImportRE.test(contents));
+}
+async function createDefaultAuthConfigFiles(nuxt) {
+  const configs = resolveAuthConfigDescriptors(nuxt);
+  const serverTemplate = `import { defineServerAuth } from '@nuxtjs/better-auth/config'
+
+export default defineServerAuth({
+  emailAndPassword: { enabled: true },
+})
+`;
+  const clientTemplate = `import { defineClientAuth } from '@nuxtjs/better-auth/config'
+
+export default defineClientAuth({})
+`;
+  if (configs.server.shouldCreateDefaultFile) {
+    const serverPath = `${configs.server.path}.ts`;
+    await mkdir(dirname(serverPath), { recursive: true });
+    await writeFile(serverPath, serverTemplate);
+    consola.success(`Created ${relative(configs.server.declaringLayerRoot, serverPath)}`);
+  }
+  if (configs.client.shouldCreateDefaultFile) {
+    const clientPath = `${configs.client.path}.ts`;
+    await mkdir(dirname(clientPath), { recursive: true });
+    await writeFile(clientPath, clientTemplate);
+    consola.success(`Created ${relative(configs.client.declaringLayerRoot, clientPath)}`);
+  }
+}
+async function ensureSchemaBootstrap(schemaPath, dialect) {
+  const dialectSchemaPath = join(dirname(schemaPath), `schema.${dialect}.mjs`);
+  if (existsSync(schemaPath) && existsSync(dialectSchemaPath))
+    return;
+  await mkdir(dirname(schemaPath), { recursive: true });
+  await writeFile(schemaPath, buildSchemaExportCode(false, dialect));
+}
+const module$1 = defineNuxtModule({
+  meta: { name: "@nuxtjs/better-auth", version, configKey: "auth", compatibility: { nuxt: ">=4.0.0" } },
+  defaults: {
+    clientOnly: false,
+    serverConfig: "server/auth.config",
+    clientConfig: "app/auth.config",
+    redirects: { login: "/login", guest: "/" },
+    preserveRedirect: true,
+    redirectQueryKey: "redirect",
+    hubSecondaryStorage: false
+  },
+  async onInstall(nuxt) {
+    const configuredSecret = nuxt.options.runtimeConfig?.betterAuthSecret;
+    const generatedSecret = await promptForSecret(nuxt.options.rootDir, consola, { configuredSecret, prepare: Boolean(nuxt.options._prepare) });
+    if (generatedSecret)
+      process.env.NUXT_BETTER_AUTH_SECRET = generatedSecret;
+    await createDefaultAuthConfigFiles(nuxt);
+  },
+  async setup(options, nuxt) {
+    const resolver = createResolver(import.meta.url);
+    const nitroImports = resolveNitroCompatibilityImports(nuxt._version);
+    nuxt.options.alias["#better-auth/nitro-compat"] = resolver.resolve(`./runtime/server/internal/${nitroImports.runtime}`);
+    const setup = await resolveAuthModuleSetup({
+      nuxt,
+      options,
+      runtimeTypesAugmentPath: resolver.resolve("./runtime/types/augment"),
+      consola
+    });
+    if (setup.aliases["#auth/server"])
+      nuxt.options.alias["#auth/server"] = setup.aliases["#auth/server"];
+    nuxt.options.alias["#auth/client"] = setup.aliases["#auth/client"];
+    if (!setup.clientOnly) {
+      const secondaryStorageTemplate = addTemplate({
+        filename: "better-auth/secondary-storage.mjs",
+        getContents: () => buildSecondaryStorageCode(setup.runtime.useHubKV),
+        write: true
+      });
+      nuxt.options.alias["#auth/secondary-storage"] = secondaryStorageTemplate.dst;
+      const databaseTemplate = addTemplate({
+        filename: "better-auth/database.mjs",
+        getContents: () => setup.database.providerDefinition.buildDatabaseCode(setup.database.buildContext),
+        write: true
+      });
+      nuxt.options.alias["#auth/database"] = databaseTemplate.dst;
+      const schemaTemplate = addTemplate({
+        filename: "better-auth/schema.mjs",
+        getContents: () => buildSchemaExportCode(setup.database.hasHubDb, setup.database.buildContext?.hubDialect ?? "sqlite"),
+        write: true
+      });
+      nuxt.options.alias["#auth/schema"] = schemaTemplate.dst;
+      if (setup.schemaGeneration)
+        await ensureSchemaBootstrap(schemaTemplate.dst, setup.database.buildContext?.hubDialect ?? "sqlite");
+    }
+    if (setup.prepareTypes) {
+      registerPrepareTypesHook({
+        nuxt,
+        serverDir: setup.prepareTypes.serverDir,
+        hasHubDb: setup.prepareTypes.hasHubDb
+      });
+    }
+    if (setup.database.providerDefinition) {
+      const setupCtx = {
+        nuxt,
+        options,
+        clientOnly: setup.clientOnly
+      };
+      await setup.database.providerDefinition.setup?.(setupCtx);
+    }
+    const authRouteRulesTemplate = addTemplate({
+      filename: "better-auth/route-rules.mjs",
+      getContents: () => buildAuthRouteRulesCode(collectAuthRouteRules(nuxt)),
+      write: true
+    });
+    nuxt.options.alias["#auth/route-rules"] = authRouteRulesTemplate.dst;
+    if (setup.serverTypes) {
+      registerServerTypeTemplates({
+        serverConfigPath: setup.serverTypes.serverConfigPath,
+        hasHubDb: setup.serverTypes.hasHubDb,
+        runtimeTypesPath: resolver.resolve("./runtime/types"),
+        sharedServerConfigSafe: isServerConfigSharedTypeSafe(setup.serverTypes.serverConfigPath),
+        h3TypesPath: nitroImports.h3,
+        nitroTypesPath: nitroImports.types
+      });
+    }
+    if (setup.schemaGeneration) {
+      if (setup.schemaGeneration.externalizeNuxtHubDatabase)
+        registerNuxtHubDatabaseExternalHook(nuxt);
+      await setupBetterAuthSchema(
+        nuxt,
+        setup.schemaGeneration.serverConfigPath,
+        options,
+        consola,
+        setup.schemaGeneration.hubSecondaryStorage
+      );
+    }
+    registerSharedTypeTemplates({
+      runtimeTypesAugmentPath: setup.sharedTypes.runtimeTypesAugmentPath,
+      runtimeTypesPath: resolver.resolve("./runtime/types"),
+      clientConfigPath: setup.sharedTypes.clientConfigPath,
+      h3TypesPath: nitroImports.h3
+    });
+    registerTemplateHmrHook(nuxt);
+    registerServerRuntime({ clientOnly: setup.clientOnly, resolve: resolver.resolve });
+    registerAuthMiddlewareHook(nuxt, resolver.resolve);
+    await registerDevtools({ nuxt, clientOnly: setup.clientOnly, hasHubDb: setup.database.hasHubDb, resolve: resolver.resolve });
+    registerRouteRulesMetaHook(nuxt);
+  }
+});
+
+export { module$1 as default };