@nuxtjs/better-auth 0.0.0 → 0.1.3

package/dist/runtime/server/api/_better-auth/config.get.js

@@ -0,0 +1,58 @@
+import { defineEventHandler, useRuntimeConfig } from "../../internal/nitro-compat.js";
+import { serverAuth } from "../../utils/auth.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const auth = serverAuth(event);
+    const options = auth.options;
+    const authContext = await auth.$context;
+    const runtimeConfig = useRuntimeConfig();
+    const publicAuth = runtimeConfig.public?.auth;
+    const privateAuth = runtimeConfig.auth;
+    const configuredTrustedOrigins = Array.isArray(options.trustedOrigins) ? options.trustedOrigins : [];
+    const effectiveTrustedOrigins = authContext?.trustedOrigins || configuredTrustedOrigins;
+    const sessionConfig = options.session || {};
+    const expiresInDays = sessionConfig.expiresIn ? Math.round(sessionConfig.expiresIn / 86400) : 7;
+    const updateAgeDays = sessionConfig.updateAge ? Math.round(sessionConfig.updateAge / 86400) : 1;
+    return {
+      config: {
+        // Module config (nuxt.config.ts)
+        module: {
+          redirects: {
+            login: publicAuth?.redirects?.login ?? "/login",
+            guest: publicAuth?.redirects?.guest ?? "/",
+            authenticated: publicAuth?.redirects?.authenticated,
+            logout: publicAuth?.redirects?.logout
+          },
+          preserveRedirect: publicAuth?.preserveRedirect ?? true,
+          redirectQueryKey: publicAuth?.redirectQueryKey ?? "redirect",
+          hubSecondaryStorage: privateAuth?.hubSecondaryStorage ?? false,
+          useDatabase: publicAuth?.useDatabase ?? false,
+          databaseProvider: publicAuth?.databaseProvider ?? "none"
+        },
+        // Server config (server/auth.config.ts)
+        server: {
+          baseURL: options.baseURL,
+          basePath: options.basePath || "/api/auth",
+          socialProviders: Object.keys(options.socialProviders || {}),
+          plugins: (options.plugins || []).map((p) => p.id || "unknown"),
+          trustedOrigins: effectiveTrustedOrigins,
+          configuredTrustedOrigins,
+          session: {
+            expiresIn: `${expiresInDays} days`,
+            updateAge: `${updateAgeDays} days`,
+            cookieCache: sessionConfig.cookieCache?.enabled ?? false
+          },
+          emailAndPassword: !!options.emailAndPassword,
+          rateLimit: options.rateLimit?.enabled ?? false,
+          advanced: {
+            useSecureCookies: options.advanced?.useSecureCookies ?? "auto",
+            disableCSRFCheck: options.advanced?.disableCSRFCheck ?? false
+          }
+        }
+      }
+    };
+  } catch (error) {
+    console.error("[DevTools] Config fetch failed:", error);
+    return { config: null, error: "Failed to fetch configuration" };
+  }
+});

package/dist/runtime/server/api/_better-auth/sessions.delete.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/api/_better-auth/sessions.delete.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+import { createAuthError, defineEventHandler, readBody } from "../../internal/nitro-compat.js";
+const deleteSessionSchema = z.object({
+  id: z.string().min(1, "Session ID required")
+});
+export default defineEventHandler(async (event) => {
+  try {
+    const body = deleteSessionSchema.parse(await readBody(event));
+    const { db } = await import("@nuxthub/db");
+    const { schema } = await import("#auth/schema");
+    if (!schema?.session)
+      throw createAuthError(500, "Session table not found");
+    const { eq } = await import("drizzle-orm");
+    await db.delete(schema.session).where(eq(schema.session.id, body.id));
+    return { success: true };
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw createAuthError(400, error.errors[0]?.message || "Invalid request");
+    }
+    console.error("[DevTools] Delete session failed:", error);
+    throw createAuthError(500, "Failed to delete session");
+  }
+});

package/dist/runtime/server/api/_better-auth/sessions.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/api/_better-auth/sessions.get.js

@@ -0,0 +1,44 @@
+import { paginationQuerySchema, sanitizeSearchPattern } from "./_schema.js";
+import { defineEventHandler, getQuery } from "../../internal/nitro-compat.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const { db } = await import("@nuxthub/db");
+    const { schema } = await import("#auth/schema");
+    if (!schema?.session)
+      return { sessions: [], total: 0, error: "Session table not found" };
+    const query = paginationQuerySchema.parse(getQuery(event));
+    const { page, limit, search } = query;
+    const offset = (page - 1) * limit;
+    const { count, like, or, desc } = await import("drizzle-orm");
+    let dbQuery = db.select().from(schema.session);
+    let countQuery = db.select({ count: count() }).from(schema.session);
+    if (search) {
+      const pattern = sanitizeSearchPattern(search);
+      const searchCondition = or(
+        like(schema.session.userId, pattern),
+        schema.session.ipAddress ? like(schema.session.ipAddress, pattern) : void 0
+      );
+      if (searchCondition) {
+        dbQuery = dbQuery.where(searchCondition);
+        countQuery = countQuery.where(searchCondition);
+      }
+    }
+    const [sessions, totalResult] = await Promise.all([
+      dbQuery.orderBy(desc(schema.session.createdAt)).limit(limit).offset(offset),
+      countQuery
+    ]);
+    const safeSessions = sessions.map((s) => ({
+      id: s.id,
+      userId: s.userId,
+      createdAt: s.createdAt,
+      updatedAt: s.updatedAt,
+      expiresAt: s.expiresAt,
+      ipAddress: s.ipAddress,
+      userAgent: s.userAgent
+    }));
+    return { sessions: safeSessions, total: totalResult[0]?.count ?? 0, page, limit };
+  } catch (error) {
+    console.error("[DevTools] Fetch sessions failed:", error);
+    return { sessions: [], total: 0, error: "Failed to fetch sessions" };
+  }
+});

package/dist/runtime/server/api/_better-auth/users.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/api/_better-auth/users.get.js

@@ -0,0 +1,35 @@
+import { paginationQuerySchema, sanitizeSearchPattern } from "./_schema.js";
+import { defineEventHandler, getQuery } from "../../internal/nitro-compat.js";
+export default defineEventHandler(async (event) => {
+  try {
+    const { db } = await import("@nuxthub/db");
+    const { schema } = await import("#auth/schema");
+    if (!schema?.user)
+      return { users: [], total: 0, error: "User table not found" };
+    const query = paginationQuerySchema.parse(getQuery(event));
+    const { page, limit, search } = query;
+    const offset = (page - 1) * limit;
+    const { count, like, or, desc } = await import("drizzle-orm");
+    let dbQuery = db.select().from(schema.user);
+    let countQuery = db.select({ count: count() }).from(schema.user);
+    if (search) {
+      const pattern = sanitizeSearchPattern(search);
+      const searchCondition = or(
+        like(schema.user.name, pattern),
+        like(schema.user.email, pattern)
+      );
+      if (searchCondition) {
+        dbQuery = dbQuery.where(searchCondition);
+        countQuery = countQuery.where(searchCondition);
+      }
+    }
+    const [users, totalResult] = await Promise.all([
+      dbQuery.orderBy(desc(schema.user.createdAt)).limit(limit).offset(offset),
+      countQuery
+    ]);
+    return { users, total: totalResult[0]?.count ?? 0, page, limit };
+  } catch (error) {
+    console.error("[DevTools] Fetch users failed:", error);
+    return { users: [], total: 0, error: "Failed to fetch users" };
+  }
+});

package/dist/runtime/server/api/auth/[...all].d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/api/auth/[...all].js

@@ -0,0 +1,6 @@
+import { defineEventHandler, toWebRequest } from "../../internal/nitro-compat.js";
+import { serverAuth } from "../../utils/auth.js";
+export default defineEventHandler(async (event) => {
+  const auth = serverAuth(event);
+  return auth.handler(toWebRequest(event));
+});

package/dist/runtime/server/internal/nitro-compat.d.ts

@@ -0,0 +1 @@
+export * from '#better-auth/nitro-compat';

package/dist/runtime/server/internal/nitro-compat.js

@@ -0,0 +1 @@
+export * from "#better-auth/nitro-compat";

package/dist/runtime/server/internal/nitro2.d.ts

@@ -0,0 +1,8 @@
+import type { H3Event } from 'h3';
+import type { AuthRouteRules } from '../../types.js';
+import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, splitCookiesString, toWebRequest } from 'h3';
+import { useRuntimeConfig } from 'nitropack/runtime';
+export { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, splitCookiesString, toWebRequest, useRuntimeConfig, };
+export type ServerEvent = H3Event;
+export declare function getAuthRouteRules(event: ServerEvent): AuthRouteRules;
+export declare function createAuthError(status: number, statusText: string): Error;

package/dist/runtime/server/internal/nitro2.js

@@ -0,0 +1,29 @@
+import {
+  createError,
+  defineEventHandler,
+  getQuery,
+  getRequestHost,
+  getRequestProtocol,
+  getRequestURL,
+  readBody,
+  splitCookiesString,
+  toWebRequest
+} from "h3";
+import { getRouteRules, useRuntimeConfig } from "nitropack/runtime";
+export {
+  defineEventHandler,
+  getQuery,
+  getRequestHost,
+  getRequestProtocol,
+  getRequestURL,
+  readBody,
+  splitCookiesString,
+  toWebRequest,
+  useRuntimeConfig
+};
+export function getAuthRouteRules(event) {
+  return getRouteRules(event);
+}
+export function createAuthError(status, statusText) {
+  return createError({ statusCode: status, statusMessage: statusText });
+}

package/dist/runtime/server/internal/nitro3.d.ts

@@ -0,0 +1,10 @@
+import type { H3Event } from 'nitro/h3';
+import type { AuthRouteRules } from '../../types.js';
+import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody } from 'nitro/h3';
+import { useRuntimeConfig } from 'nitro/runtime-config';
+export { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, useRuntimeConfig, };
+export type ServerEvent = H3Event;
+export declare function getAuthRouteRules(event: ServerEvent): AuthRouteRules;
+export declare function createAuthError(status: number, statusText: string): Error;
+export declare function toWebRequest(event: ServerEvent): Request;
+export declare function splitCookiesString(header: string): string[];

package/dist/runtime/server/internal/nitro3.js

@@ -0,0 +1,60 @@
+import { getRouteRules } from "nitro/app";
+import {
+  defineEventHandler,
+  getQuery,
+  getRequestHost,
+  getRequestProtocol,
+  getRequestURL,
+  HTTPError,
+  readBody
+} from "nitro/h3";
+import { useRuntimeConfig } from "nitro/runtime-config";
+export {
+  defineEventHandler,
+  getQuery,
+  getRequestHost,
+  getRequestProtocol,
+  getRequestURL,
+  readBody,
+  useRuntimeConfig
+};
+export function getAuthRouteRules(event) {
+  const auth = getRouteRules(event.req.method, getRequestURL(event).pathname).routeRules.auth?.options;
+  return { auth };
+}
+export function createAuthError(status, statusText) {
+  return HTTPError.status(status, statusText);
+}
+export function toWebRequest(event) {
+  return event.req;
+}
+export function splitCookiesString(header) {
+  const cookies = [];
+  let position = 0;
+  while (position < header.length) {
+    const start = position;
+    let separator;
+    while (position < header.length) {
+      if (header[position] !== ",") {
+        position += 1;
+        continue;
+      }
+      separator = position;
+      position += 1;
+      while (position < header.length && /\s/.test(header[position]))
+        position += 1;
+      const nextStart = position;
+      while (position < header.length && !["=", ";", ","].includes(header[position]))
+        position += 1;
+      if (header[position] === "=") {
+        cookies.push(header.slice(start, separator));
+        position = nextStart;
+        break;
+      }
+      position = separator + 1;
+    }
+    if (separator === void 0 || position >= header.length)
+      cookies.push(header.slice(start));
+  }
+  return cookies;
+}

package/dist/runtime/server/middleware/route-access.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/middleware/route-access.js

@@ -0,0 +1,29 @@
+import { shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
+import { matchesUser } from "../../utils/match-user.js";
+import { createAuthError, defineEventHandler, getAuthRouteRules, getRequestURL } from "../internal/nitro-compat.js";
+import { getUserSession, requireUserSession } from "../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const path = getRequestURL(event).pathname;
+  if (!path.startsWith("/api/"))
+    return;
+  if (shouldSkipAuthRouteRules(path))
+    return;
+  const rules = getAuthRouteRules(event);
+  if (!rules.auth)
+    return;
+  const auth = rules.auth;
+  const mode = typeof auth === "string" ? auth : auth?.only ?? "user";
+  if (mode === "guest") {
+    const session = await getUserSession(event);
+    if (session)
+      throw createAuthError(403, "Authenticated users not allowed");
+    return;
+  }
+  if (mode === "user") {
+    const session = await requireUserSession(event);
+    if (typeof auth === "object" && auth.user) {
+      if (!matchesUser(session.user, auth.user))
+        throw createAuthError(403, "Access denied");
+    }
+  }
+});

package/dist/runtime/server/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../../../tsconfig.json",
+  "compilerOptions": {
+    "baseUrl": ".",
+    "paths": {
+      "#better-auth/nitro-compat": ["./internal/nitro2"],
+      "#nuxt-better-auth": ["../types/augment"]
+    }
+  },
+  "include": ["./**/*.ts", "./**/*.d.ts"],
+  "exclude": ["node_modules"]
+}

package/dist/runtime/server/utils/auth.d.ts

@@ -0,0 +1,20 @@
+import type { BetterAuthOptions } from 'better-auth';
+import type { ServerEvent } from '../internal/nitro-compat.js';
+import { betterAuth } from 'better-auth';
+import createServerAuth from '#auth/server';
+type AuthOptions = ReturnType<typeof createServerAuth>;
+type UserAuthConfig = AuthOptions & {
+    secrets?: BetterAuthOptions['secrets'];
+    trustedOrigins?: BetterAuthOptions['trustedOrigins'];
+    secondaryStorage?: BetterAuthOptions['secondaryStorage'];
+};
+type ResolvedAuthOptions = UserAuthConfig & {
+    secret: string;
+    baseURL: string;
+    trustedOrigins?: BetterAuthOptions['trustedOrigins'];
+    database?: BetterAuthOptions['database'];
+};
+type AuthInstance = ReturnType<typeof betterAuth<ResolvedAuthOptions>>;
+/** Returns Better Auth instance. Caches per resolved host (or single instance when siteUrl is explicit). */
+export declare function serverAuth(event?: ServerEvent): AuthInstance;
+export {};

package/dist/runtime/server/utils/auth.js

@@ -0,0 +1,246 @@
+import { betterAuth, env } from "better-auth";
+import { withoutProtocol } from "ufo";
+import { createDatabase, db } from "#auth/database";
+import { createSecondaryStorage } from "#auth/secondary-storage";
+import createServerAuth from "#auth/server";
+import { getRequestHost, getRequestProtocol, useRuntimeConfig } from "../internal/nitro-compat.js";
+import { resolveCustomSecondaryStorageRequirement } from "./custom-secondary-storage.js";
+const _authCache = /* @__PURE__ */ new Map();
+const requestAuthKey = Symbol.for("nuxt-better-auth.requestAuth");
+let _baseURLInferenceLogged = false;
+let _customSecondaryStorageMisconfigWarned = false;
+const fallbackRequestAuthContext = /* @__PURE__ */ new WeakMap();
+function getRequestAuthContext(event) {
+  const eventWithContext = event;
+  if (eventWithContext.context && typeof eventWithContext.context === "object")
+    return eventWithContext.context;
+  let context = fallbackRequestAuthContext.get(event);
+  if (!context) {
+    context = {};
+    fallbackRequestAuthContext.set(event, context);
+  }
+  return context;
+}
+function normalizeLoopbackOrigin(origin) {
+  if (!import.meta.dev)
+    return origin;
+  try {
+    const url = new URL(origin);
+    if (url.hostname === "127.0.0.1" || url.hostname === "::1" || url.hostname === "[::1]") {
+      url.hostname = "localhost";
+      return url.origin;
+    }
+  } catch {
+  }
+  return origin;
+}
+function logInferredBaseURL(baseURL, source) {
+  if (!import.meta.dev || _baseURLInferenceLogged)
+    return;
+  _baseURLInferenceLogged = true;
+  console.warn(`[nuxt-better-auth] Using inferred baseURL "${baseURL}" from ${source}. Set runtimeConfig.public.siteUrl for deterministic OAuth callbacks.`);
+}
+function validateURL(url) {
+  try {
+    return normalizeLoopbackOrigin(new URL(url).origin);
+  } catch {
+    throw new Error(`Invalid siteUrl: "${url}". Must be a valid URL.`);
+  }
+}
+function resolveConfiguredSiteUrl(config) {
+  if (typeof config.public.siteUrl !== "string" || !config.public.siteUrl)
+    return void 0;
+  return validateURL(config.public.siteUrl);
+}
+function resolveEventOrigin(event) {
+  if (!event)
+    return void 0;
+  const host = getRequestHost(event, { xForwardedHost: true });
+  const protocol = getRequestProtocol(event, { xForwardedProto: true });
+  if (!host || !protocol)
+    return void 0;
+  try {
+    return validateURL(`${protocol}://${host}`);
+  } catch {
+    return void 0;
+  }
+}
+function getNitroOrigin() {
+  const cert = process.env.NITRO_SSL_CERT;
+  const key = process.env.NITRO_SSL_KEY;
+  let host = process.env.NITRO_HOST || process.env.HOST;
+  let port;
+  if (import.meta.dev)
+    port = process.env.NITRO_PORT || process.env.PORT || "3000";
+  let protocol = cert && key || !import.meta.dev ? "https" : "http";
+  try {
+    if ((import.meta.dev || import.meta.prerender) && process.env.__NUXT_DEV__) {
+      const origin = JSON.parse(process.env.__NUXT_DEV__).proxy.url;
+      host = withoutProtocol(origin);
+      protocol = origin.includes("https") ? "https" : "http";
+    } else if ((import.meta.dev || import.meta.prerender) && process.env.NUXT_VITE_NODE_OPTIONS) {
+      const origin = JSON.parse(process.env.NUXT_VITE_NODE_OPTIONS).baseURL.replace("/__nuxt_vite_node__", "");
+      host = withoutProtocol(origin);
+      protocol = origin.includes("https") ? "https" : "http";
+    }
+  } catch {
+  }
+  if (!host)
+    return void 0;
+  if (host.startsWith("[") && host.includes("]:")) {
+    const lastBracketColon = host.lastIndexOf("]:");
+    const extractedPort = host.slice(lastBracketColon + 2);
+    host = host.slice(0, lastBracketColon + 1);
+    if (extractedPort)
+      port = extractedPort;
+  } else if (host.includes(":") && !host.startsWith("[")) {
+    const hostParts = host.split(":");
+    port = hostParts.pop();
+    host = hostParts.join(":");
+  }
+  const portSuffix = port ? `:${port}` : "";
+  return `${protocol}://${host}${portSuffix}`;
+}
+function resolveEnvironmentOrigin() {
+  const nitroOrigin = getNitroOrigin();
+  if (nitroOrigin)
+    return { origin: validateURL(nitroOrigin), source: "Nitro environment detection" };
+  if (process.env.VERCEL_URL)
+    return { origin: validateURL(`https://${process.env.VERCEL_URL}`), source: "VERCEL_URL" };
+  if (process.env.CF_PAGES_URL)
+    return { origin: validateURL(`https://${process.env.CF_PAGES_URL}`), source: "CF_PAGES_URL" };
+  if (process.env.URL)
+    return { origin: validateURL(process.env.URL.startsWith("http") ? process.env.URL : `https://${process.env.URL}`), source: "URL" };
+  return void 0;
+}
+function resolveDevFallback() {
+  if (!import.meta.dev)
+    return void 0;
+  return { origin: "http://localhost:3000", source: "development fallback" };
+}
+function getBaseURL(event) {
+  const config = useRuntimeConfig();
+  const configuredSiteUrl = resolveConfiguredSiteUrl(config);
+  if (configuredSiteUrl)
+    return configuredSiteUrl;
+  const eventOrigin = resolveEventOrigin(event);
+  if (eventOrigin) {
+    logInferredBaseURL(eventOrigin, "request origin");
+    return eventOrigin;
+  }
+  const environmentOrigin = resolveEnvironmentOrigin();
+  if (environmentOrigin) {
+    logInferredBaseURL(environmentOrigin.origin, environmentOrigin.source);
+    return environmentOrigin.origin;
+  }
+  const devFallback = resolveDevFallback();
+  if (devFallback) {
+    logInferredBaseURL(devFallback.origin, devFallback.source);
+    return devFallback.origin;
+  }
+  throw new Error("siteUrl required. Set NUXT_PUBLIC_SITE_URL.");
+}
+function dedupeOrigins(origins) {
+  return [...new Set(origins)];
+}
+function getDevTrustedOrigins() {
+  const fallbackOrigin = "http://localhost:3000";
+  const nitroOrigin = getNitroOrigin();
+  if (!nitroOrigin)
+    return [fallbackOrigin];
+  try {
+    const url = new URL(nitroOrigin);
+    const protocol = url.protocol === "https:" ? "https" : "http";
+    const port = url.port || "3000";
+    const localhostOrigin = `${protocol}://localhost:${port}`;
+    return dedupeOrigins([localhostOrigin, url.origin]);
+  } catch {
+    return [fallbackOrigin];
+  }
+}
+function getRequestOrigin(request) {
+  if (!request)
+    return void 0;
+  try {
+    return new URL(request.url).origin;
+  } catch {
+    return void 0;
+  }
+}
+function withDevTrustedOrigins(trustedOrigins) {
+  if (!import.meta.dev)
+    return trustedOrigins;
+  const devOrigins = getDevTrustedOrigins();
+  const mergeOrigins = (origins, request) => {
+    const validOrigins = origins.filter((origin) => typeof origin === "string");
+    const requestOrigin = getRequestOrigin(request);
+    return dedupeOrigins(requestOrigin ? [...validOrigins, ...devOrigins, requestOrigin] : [...validOrigins, ...devOrigins]);
+  };
+  if (typeof trustedOrigins === "function") {
+    return async (request) => {
+      const resolvedOrigins = await trustedOrigins(request);
+      return mergeOrigins(resolvedOrigins, request);
+    };
+  }
+  if (Array.isArray(trustedOrigins)) {
+    const baseOrigins = mergeOrigins(trustedOrigins);
+    return async (request) => {
+      return mergeOrigins(baseOrigins, request);
+    };
+  }
+  return async (request) => {
+    return mergeOrigins([], request);
+  };
+}
+export function serverAuth(event) {
+  const runtimeConfig = useRuntimeConfig();
+  const betterAuthSecret = runtimeConfig.betterAuthSecret || env.BETTER_AUTH_SECRET || "";
+  if (betterAuthSecret && betterAuthSecret.length < 32)
+    throw new Error("[nuxt-better-auth] Singular auth secret must be at least 32 characters for security");
+  const requestOrigin = resolveEventOrigin(event);
+  let userConfig;
+  if (!import.meta.dev && !betterAuthSecret && !env.BETTER_AUTH_SECRETS) {
+    userConfig = createServerAuth({ runtimeConfig, db, requestOrigin });
+    if (userConfig.secrets === void 0)
+      throw new Error("[nuxt-better-auth] An auth secret is required in production. Set NUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET, BETTER_AUTH_SECRETS, or defineServerAuth({ secrets }).");
+  }
+  const siteUrl = getBaseURL(event);
+  const hasExplicitSiteUrl = runtimeConfig.public.siteUrl && typeof runtimeConfig.public.siteUrl === "string";
+  const cacheKey = hasExplicitSiteUrl ? "__explicit__" : siteUrl;
+  const requestContext = event ? getRequestAuthContext(event) : void 0;
+  if (requestContext?.[requestAuthKey])
+    return requestContext[requestAuthKey];
+  userConfig ??= createServerAuth({ runtimeConfig, db, requestOrigin });
+  const database = createDatabase(event);
+  const trustedOrigins = withDevTrustedOrigins(userConfig.trustedOrigins);
+  const hubSecondaryStorage = runtimeConfig.auth?.hubSecondaryStorage;
+  const customSecondaryStorage = resolveCustomSecondaryStorageRequirement(hubSecondaryStorage, userConfig.secondaryStorage != null, Boolean(import.meta.dev));
+  if (customSecondaryStorage?.shouldThrow)
+    throw new Error(customSecondaryStorage.message);
+  if (customSecondaryStorage?.shouldWarn && !_customSecondaryStorageMisconfigWarned) {
+    _customSecondaryStorageMisconfigWarned = true;
+    console.warn(customSecondaryStorage.message);
+  }
+  if (!database) {
+    const cached = _authCache.get(cacheKey);
+    if (cached) {
+      if (requestContext)
+        requestContext[requestAuthKey] = cached;
+      return cached;
+    }
+  }
+  const authOptions = {
+    ...userConfig,
+    ...database ? { database } : {},
+    ...hubSecondaryStorage === true ? { secondaryStorage: createSecondaryStorage() } : {},
+    secret: betterAuthSecret,
+    baseURL: siteUrl,
+    trustedOrigins
+  };
+  const auth = betterAuth(authOptions);
+  if (requestContext)
+    requestContext[requestAuthKey] = auth;
+  if (!database)
+    _authCache.set(cacheKey, auth);
+  return auth;
+}

package/dist/runtime/server/utils/custom-secondary-storage.d.ts

@@ -0,0 +1,6 @@
+export type HubSecondaryStorageMode = boolean | 'custom' | undefined;
+export declare function resolveCustomSecondaryStorageRequirement(hubSecondaryStorage: HubSecondaryStorageMode, userHasSecondaryStorage: boolean, isDev: boolean): {
+    shouldThrow: boolean;
+    shouldWarn: boolean;
+    message: string;
+} | null;

package/dist/runtime/server/utils/custom-secondary-storage.js

@@ -0,0 +1,8 @@
+export function resolveCustomSecondaryStorageRequirement(hubSecondaryStorage, userHasSecondaryStorage, isDev) {
+  if (hubSecondaryStorage !== "custom")
+    return null;
+  if (userHasSecondaryStorage)
+    return null;
+  const message = '[nuxt-better-auth] hubSecondaryStorage: "custom" requires secondaryStorage in defineServerAuth().';
+  return { shouldThrow: !isDev, shouldWarn: isDev, message };
+}

package/dist/runtime/server/utils/session.d.ts

@@ -0,0 +1,8 @@
+import type { AppSession, AuthSession, RequireSessionOptions } from '#nuxt-better-auth';
+import type { ServerEvent } from '../internal/nitro-compat.js';
+export declare function getRequestSession(event: ServerEvent): Promise<AppSession | null>;
+export declare function getUserSession(event: ServerEvent): Promise<AppSession | null>;
+export declare function refreshSessionCookieCache(event: ServerEvent): Promise<AppSession | null>;
+export declare function setSessionCookie(event: ServerEvent, token: string): Promise<void>;
+export declare function createSession(event: ServerEvent, userId: string): Promise<AuthSession>;
+export declare function requireUserSession(event: ServerEvent, options?: RequireSessionOptions): Promise<AppSession>;