@nuxtjs/better-auth 0.3.0 → 0.3.2

package/dist/module.mjs

@@ -1,19 +1,21 @@
-import { existsSync, statSync, writeFileSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
-import { getLayerDirectories, updateTemplates, addServerImports, addServerScanDir, addServerHandler, addImports, addPlugin, addComponentsDir, extendPages, addTemplate, hasNuxtModule, addTypeTemplate, defineNuxtModule, createResolver } from '@nuxt/kit';
+import { getLayerDirectories, updateTemplates, addServerImports, addServerHandler, addImports, addPlugin, addComponentsDir, addRouteMiddleware, extendPages, addTemplate, hasNuxtModule, addTypeTemplate, defineNuxtModule, createResolver } from '@nuxt/kit';
 import { consola as consola$1 } from 'consola';
+import { defineDiagnostics, Diagnostic, formatDiagnostic } from 'nostics';
 import { isAbsolute, join, resolve, relative, dirname } from 'pathe';
+import { createRequire } from 'node:module';
+import { join as join$1 } from 'node:path';
 import { defu } from 'defu';
 import { toRouteMatcher, createRouter } from 'radix3';
-import { generateDrizzleSchema as generateDrizzleSchema$1 } from 'auth/api';
 import { randomBytes } from 'node:crypto';
 import { isCI, isTest } from 'std-env';
 export { defineClientAuth, defineServerAuth } from '../dist/runtime/config.js';
 
-const version = "0.3.0";
+const version = "0.3.2";
 
-const CONFIG_EXTENSIONS = [".ts", ".js"];
-const CONFIG_EXTENSION_RE$1 = /\.(?:ts|js)$/;
+const CONFIG_EXTENSIONS = [".ts", ".js", ".mts", ".cts", ".mjs", ".cjs"];
+const CONFIG_EXTENSION_RE = /\.[cm]?[jt]s$/;
 const DEFAULT_CONFIG_FILES = {
   server: "server/auth.config",
   client: "app/auth.config"
@@ -27,10 +29,12 @@ const PLUGIN_OPTION_KEY_BY_KIND = {
   client: "clientPluginSources"
 };
 function stripConfigExtension(path) {
-  return path.replace(CONFIG_EXTENSION_RE$1, "");
+  return path.replace(CONFIG_EXTENSION_RE, "");
 }
-function defaultConfigExists(path) {
-  return CONFIG_EXTENSIONS.some((ext) => existsSync(`${path}${ext}`));
+function resolveAuthConfigFile(path, exists = existsSync) {
+  if (CONFIG_EXTENSION_RE.test(path))
+    return exists(path) ? path : void 0;
+  return CONFIG_EXTENSIONS.map((extension) => `${path}${extension}`).find(exists);
 }
 function getLayerDirectoriesWithConfigs(nuxt) {
   const directories = getLayerDirectories(nuxt);
@@ -47,9 +51,10 @@ function getDefaultConfigPath(nuxt, kind) {
 function getLayerDefaultConfigPath(nuxt, kind, configExists) {
   for (const { directory } of getLayerDirectoriesWithConfigs(nuxt)) {
     const candidate = kind === "server" ? join(directory.server, "auth.config") : join(directory.app, "auth.config");
-    if (configExists(candidate)) {
+    const path = resolveAuthConfigFile(candidate, configExists);
+    if (path) {
       return {
-        path: candidate,
+        path,
         declaringLayerRoot: directory.root
       };
     }
@@ -73,16 +78,18 @@ function getEffectiveModuleConfigFile(nuxt, kind) {
   return authOptions?.[optionKey] ?? DEFAULT_CONFIG_FILES[kind];
 }
 function resolveAuthConfigDescriptor(nuxt, kind, file = getEffectiveModuleConfigFile(nuxt, kind), dependencies = {}) {
-  const configExists = dependencies.configExists ?? defaultConfigExists;
-  const configuredFile = stripConfigExtension(file);
+  const configExists = dependencies.configExists ?? existsSync;
+  const configuredFile = file;
   if (isAbsolute(configuredFile)) {
-    const declaringLayerRoot2 = resolveDeclaringLayerRoot(nuxt, kind, configuredFile);
-    const exists2 = configExists(configuredFile);
+    const declaringLayerRoot2 = resolveDeclaringLayerRoot(nuxt, kind, stripConfigExtension(configuredFile));
+    const resolvedPath2 = resolveAuthConfigFile(configuredFile, configExists);
+    const path2 = resolvedPath2 ?? configuredFile;
+    const exists2 = resolvedPath2 !== void 0;
     return {
       kind,
       configuredFile,
-      file: configuredFile,
-      path: configuredFile,
+      file: path2,
+      path: path2,
       declaringLayerRoot: declaringLayerRoot2,
       isDefault: false,
       isExplicit: true,
@@ -95,7 +102,7 @@ function resolveAuthConfigDescriptor(nuxt, kind, file = getEffectiveModuleConfig
     const discovered = getLayerDefaultConfigPath(nuxt, kind, configExists);
     const path2 = discovered?.path ?? getDefaultConfigPath(nuxt, kind);
     const declaringLayerRoot2 = discovered?.declaringLayerRoot ?? project.root;
-    const exists2 = configExists(path2);
+    const exists2 = discovered !== void 0;
     return {
       kind,
       configuredFile,
@@ -108,9 +115,11 @@ function resolveAuthConfigDescriptor(nuxt, kind, file = getEffectiveModuleConfig
       shouldCreateDefaultFile: !exists2
     };
   }
-  const declaringLayerRoot = resolveDeclaringLayerRoot(nuxt, kind, configuredFile);
-  const path = join(declaringLayerRoot, configuredFile);
-  const exists = configExists(path);
+  const declaringLayerRoot = resolveDeclaringLayerRoot(nuxt, kind, stripConfigExtension(configuredFile));
+  const candidate = join(declaringLayerRoot, configuredFile);
+  const resolvedPath = resolveAuthConfigFile(candidate, configExists);
+  const path = resolvedPath ?? candidate;
+  const exists = resolvedPath !== void 0;
   return {
     kind,
     configuredFile,
@@ -142,16 +151,114 @@ function resolveAuthPluginSources(nuxt) {
   return resolved;
 }
 
+function selectNitro3RouteRulesTarget(nitroTypesDeclaration, resolveH3Rules) {
+  if (/\binterface\s+NitroRouteConfig\b/.test(nitroTypesDeclaration)) {
+    return {
+      moduleName: "nitro/types",
+      configInterface: "NitroRouteConfig",
+      rulesInterface: "NitroRouteRules"
+    };
+  }
+  return {
+    moduleName: resolveH3Rules(),
+    configInterface: "RouteRuleConfig",
+    rulesInterface: "RouteRules"
+  };
+}
+function resolveNitro3RouteRulesTarget(nuxtRootDir) {
+  const fallback = {
+    moduleName: "nitro/types",
+    configInterface: "NitroRouteConfig",
+    rulesInterface: "NitroRouteRules"
+  };
+  try {
+    const projectRequire = createRequire(join$1(nuxtRootDir, "package.json"));
+    const nuxtRequire = createRequire(projectRequire.resolve("nuxt/package.json"));
+    let nitroTypesPath;
+    try {
+      const integrationRequire = createRequire(nuxtRequire.resolve("@nuxt/nitro-server"));
+      nitroTypesPath = integrationRequire.resolve("nitro/types");
+    } catch {
+      nitroTypesPath = nuxtRequire.resolve("nitro/types");
+    }
+    const declarationCandidates = [
+      nitroTypesPath.replace(/\.mjs$/, ".d.mts"),
+      nitroTypesPath.replace(/\.js$/, ".d.ts"),
+      nitroTypesPath
+    ];
+    const declarationPath = declarationCandidates.find((path) => existsSync(path));
+    if (!declarationPath)
+      return fallback;
+    return selectNitro3RouteRulesTarget(
+      readFileSync(declarationPath, "utf8"),
+      () => createRequire(nitroTypesPath).resolve("h3/rules")
+    );
+  } catch {
+    return fallback;
+  }
+}
 function resolveNitroCompatibilityImports(nuxtVersion) {
   const major = Number.parseInt(nuxtVersion, 10);
   const nitroV3 = Number.isFinite(major) && major >= 5;
   return {
     h3: nitroV3 ? "nitro/h3" : "h3",
-    runtime: nitroV3 ? "nitro3" : "nitro2",
-    types: nitroV3 ? "nitro/types" : "nitropack/types"
+    runtime: nitroV3 ? "nitro3" : "nitro2"
   };
 }
 
+function configFilename(file) {
+  return /\.[cm]?[jt]s$/.test(file) ? file : `${file}.ts`;
+}
+const diagnostics = defineDiagnostics({
+  docsBase: (code) => `https://better-auth.nuxt.dev/errors/${code.toLowerCase().replaceAll("_", "-")}`,
+  codes: {
+    NUXT_AUTH_MISSING_CONFIG: {
+      why: (p) => `Missing ${configFilename(p.file)}`,
+      fix: (p) => `Create ${configFilename(p.file)} with export default ${p.factory}(...).`
+    },
+    NUXT_AUTH_NO_DATABASE_PROVIDER: {
+      why: "No database provider is enabled.",
+      fix: "Register an enabled provider with the better-auth:database:providers hook."
+    },
+    NUXT_AUTH_MISSING_HUB_DB: {
+      why: "hub:db not found.",
+      fix: "Load @nuxthub/core before @nuxtjs/better-auth and configure hub.db."
+    },
+    NUXT_AUTH_INVALID_PLUGIN_SOURCE: {
+      why: (p) => `Modules must register absolute plugin source paths. Received: ${p.source}`,
+      fix: "Resolve the plugin source with createResolver(import.meta.url).resolve(...) before registering it."
+    },
+    NUXT_AUTH_STORAGE_CLIENT_ONLY: {
+      why: "hubSecondaryStorage is not available in clientOnly mode.",
+      fix: "Either disable clientOnly or remove auth.hubSecondaryStorage."
+    },
+    NUXT_AUTH_SCHEMA_STORAGE_REQUIRED: {
+      why: 'hubSecondaryStorage: "custom" requires secondaryStorage in defineServerAuth() to omit the session table from the generated schema.',
+      fix: "Provide an atomic secondaryStorage in defineServerAuth(), or set auth.hubSecondaryStorage to false to keep database-backed sessions."
+    },
+    NUXT_AUTH_UNSUPPORTED_DIALECT: {
+      why: (p) => `Unsupported database dialect: ${p.dialect}`,
+      fix: "Configure hub.db with a supported dialect: sqlite, postgresql, or mysql."
+    },
+    NUXT_AUTH_INVALID_CONFIG_EXPORT: {
+      why: (p) => `${p.configPath} must export default defineServerAuth(...).`,
+      fix: "Wrap the server auth options in defineServerAuth(...) and export the result as default."
+    },
+    NUXT_AUTH_CONFIG_LOAD_FAILED: {
+      why: (p) => `Failed to load auth config at ${p.configPath}: ${p.cause instanceof Error ? p.cause.message : String(p.cause)}`,
+      fix: "Check the config imports and required environment variables, then restart Nuxt to regenerate the schema."
+    },
+    NUXT_AUTH_EMPTY_SCHEMA: {
+      why: (p) => `Schema generation returned empty result for ${p.dialect}`,
+      fix: "Check the Better Auth plugins and database options in defineServerAuth(), then regenerate the schema."
+    },
+    NUXT_AUTH_SCHEMA_GENERATION_FAILED: {
+      why: (p) => `Failed to generate schema: ${p.cause instanceof Error ? p.cause.message : String(p.cause)}`,
+      fix: "Check the underlying error, auth configuration, and write access to the Nuxt build directory, then regenerate the schema."
+    }
+  }
+});
+
 function setupDevTools(nuxt) {
   const hookable = nuxt;
   hookable.hook("devtools:customTabs", (tabs) => {
@@ -170,8 +277,11 @@ function setupDevTools(nuxt) {
 
 function registerTemplateHmrHook(nuxt) {
   nuxt.hook("builder:watch", async (_event, relativePath) => {
-    if (relativePath.includes("auth.config"))
-      await updateTemplates({ filter: (t) => t.filename.includes("nuxt-better-auth") });
+    if (relativePath.includes("auth.config")) {
+      await updateTemplates({
+        filter: (template) => template.filename.startsWith("better-auth/") || template.filename.startsWith("types/nuxt-better-auth")
+      });
+    }
   });
 }
 function registerServerRuntime(input) {
@@ -182,7 +292,7 @@ function registerServerRuntime(input) {
       { name: "serverAuth", from: resolve("./runtime/server/utils/auth") },
       ...["getRequestSession", "getUserSession", "setRequestSession", "refreshSessionCookieCache", "setSessionCookie", "createSession", "requireUserSession"].map((name) => ({ name, from: resolve("./runtime/server/utils/session") }))
     ]);
-    addServerScanDir(resolve("./runtime/server/middleware"));
+    addServerHandler({ middleware: true, handler: resolve("./runtime/server/middleware/route-access") });
     addServerHandler({ route: "/api/auth/**", handler: resolve("./runtime/server/api/auth/[...all]") });
   }
   addImports([
@@ -207,9 +317,11 @@ function registerServerRuntime(input) {
   addPlugin({ src: resolve("./runtime/app/plugins/session.client"), mode: "client" });
   addComponentsDir({ path: resolve("./runtime/app/components") });
 }
-function registerAuthMiddlewareHook(nuxt, resolve) {
-  nuxt.hook("app:resolve", (app) => {
-    app.middleware.push({ name: "auth", path: resolve("./runtime/app/middleware/auth.global"), global: true });
+function registerAuthMiddleware(resolve) {
+  addRouteMiddleware({
+    name: "auth",
+    path: resolve("./runtime/app/middleware/auth.global"),
+    global: true
   });
 }
 function registerPrepareTypesHook(input) {
@@ -306,6 +418,7 @@ function dialectToProvider(dialect) {
   return dialect === "postgresql" ? "pg" : dialect;
 }
 async function generateDrizzleSchema(authOptions, dialect, schemaOptions) {
+  const { generateDrizzleSchema: generateDrizzleSchema2 } = await import('auth/api');
   const provider = dialectToProvider(dialect);
   const options = {
     ...authOptions,
@@ -326,12 +439,12 @@ async function generateDrizzleSchema(authOptions, dialect, schemaOptions) {
       adapterConfig: { usePlural: schemaOptions?.usePlural ?? false }
     }
   };
-  const result = await generateDrizzleSchema$1({
+  const result = await generateDrizzleSchema2({
     adapter,
     options
   });
   if (!result.code) {
-    throw new Error(`Schema generation returned empty result for ${dialect}`);
+    throw diagnostics.NUXT_AUTH_EMPTY_SCHEMA({ dialect });
   }
   return result.code;
 }
@@ -343,7 +456,6 @@ function loadLocalEnv(rootDir) {
     return;
   process.loadEnvFile(envPath);
 }
-const NO_DEFAULT_EXPORT_MESSAGE = "[@nuxtjs/better-auth] auth.config.ts does not export default. Expected: export default defineServerAuth(...)";
 const SCHEMA_NOT_REGENERATED_MESSAGE = "The schema was not regenerated and any existing generated schema file was left unchanged.";
 async function loadUserAuthConfig(configPath, throwOnError = false, alias, runtimeConfig = {}, rootDir) {
   const { createJiti } = await import('jiti');
@@ -365,17 +477,17 @@ async function loadUserAuthConfig(configPath, throwOnError = false, alias, runti
     if (typeof configFn === "function") {
       return configFn({ runtimeConfig, db: null });
     }
-    if (throwOnError) {
-      consola$1.warn(NO_DEFAULT_EXPORT_MESSAGE);
-      throw new Error("auth.config.ts must export default defineServerAuth(...)");
-    }
-    consola$1.error(`${NO_DEFAULT_EXPORT_MESSAGE}. ${SCHEMA_NOT_REGENERATED_MESSAGE}`);
-    return null;
+    throw diagnostics.NUXT_AUTH_INVALID_CONFIG_EXPORT({ configPath });
   } catch (error) {
-    if (throwOnError) {
-      throw new Error(`Failed to load auth config: ${error instanceof Error ? error.message : error}`);
-    }
-    consola$1.error(`[@nuxtjs/better-auth] Failed to load auth config for schema generation. ${SCHEMA_NOT_REGENERATED_MESSAGE}`, error);
+    const diagnostic = error instanceof Diagnostic ? error : diagnostics.NUXT_AUTH_CONFIG_LOAD_FAILED({ configPath, cause: error });
+    if (throwOnError)
+      throw diagnostic;
+    const message = `${formatDiagnostic(diagnostic)}
+${SCHEMA_NOT_REGENERATED_MESSAGE}`;
+    if (diagnostic.cause === void 0)
+      consola$1.error(message);
+    else
+      consola$1.error(message, diagnostic.cause);
     return null;
   } finally {
     const sharedDefineServerAuth = schemaGlobals.__nuxtBetterAuthDefineServerAuth;
@@ -407,7 +519,6 @@ function getHubCasing(hub) {
 }
 
 const NODE_MODULES_SEGMENT_RE = /[\\/]/;
-const CONFIG_EXTENSION_RE = /\.[cm]?[jt]s$/;
 function resolveSchemaSecondaryStorageInjection(hubSecondaryStorage, userHasSecondaryStorage, isProduction) {
   if (hubSecondaryStorage === true)
     return { inject: false };
@@ -415,10 +526,10 @@ function resolveSchemaSecondaryStorageInjection(hubSecondaryStorage, userHasSeco
     return { inject: false };
   if (userHasSecondaryStorage)
     return { inject: true };
-  const message = '[nuxt-better-auth] hubSecondaryStorage: "custom" requires secondaryStorage in defineServerAuth() to omit the session table from the generated schema.';
+  const diagnostic = diagnostics.NUXT_AUTH_SCHEMA_STORAGE_REQUIRED();
   if (isProduction)
-    return { inject: false, error: message };
-  return { inject: false, warn: message };
+    return { inject: false, error: diagnostic };
+  return { inject: false, warn: diagnostic };
 }
 function isInsideNodeModules(path) {
   return path.split(NODE_MODULES_SEGMENT_RE).includes("node_modules");
@@ -448,7 +559,7 @@ function registerNuxtHubSchemaHook(nuxt, finishSetup) {
 }
 async function loadAuthOptions(context) {
   const isProduction = !context.nuxt.options.dev;
-  const configFile = CONFIG_EXTENSION_RE.test(context.serverConfigPath) ? context.serverConfigPath : `${context.serverConfigPath}.ts`;
+  const configFile = resolveAuthConfigFile(context.serverConfigPath) ?? context.serverConfigPath;
   const alias = Object.fromEntries(
     Object.entries(context.nuxt.options.alias).filter(([, value]) => typeof value === "string").map(([key, value]) => [key, value])
   );
@@ -464,7 +575,7 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, h
   const hub = nuxt.options.hub;
   const dialect = getHubDialect(hub);
   if (!dialect || !["sqlite", "postgresql", "mysql"].includes(dialect)) {
-    consola.warn(`Unsupported database dialect: ${dialect}`);
+    consola.warn(formatDiagnostic(diagnostics.NUXT_AUTH_UNSUPPORTED_DIALECT({ dialect })));
     return;
   }
   const context = { nuxt, serverConfigPath };
@@ -476,9 +587,9 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, h
     const userHasSecondaryStorage = userConfig.secondaryStorage != null;
     const secondaryStorageResolution = resolveSchemaSecondaryStorageInjection(hubSecondaryStorage, userHasSecondaryStorage, !nuxt.options.dev);
     if (secondaryStorageResolution.error)
-      throw new Error(secondaryStorageResolution.error);
+      throw secondaryStorageResolution.error;
     if (secondaryStorageResolution.warn)
-      consola.warn(secondaryStorageResolution.warn);
+      consola.warn(formatDiagnostic(secondaryStorageResolution.warn));
     const authOptions = {
       ...userConfig,
       plugins,
@@ -511,11 +622,7 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, h
     addTemplate({ filename: `better-auth/schema.${dialect}.mjs`, getContents: () => schemaCode, write: true });
     consola.info(`Generated ${dialect} schema (.ts + .mjs)`);
   } catch (error) {
-    const isProduction = !nuxt.options.dev;
-    if (isProduction)
-      throw error;
-    consola.error("Failed to generate schema:", error);
-    throw error;
+    throw error instanceof Diagnostic ? error : diagnostics.NUXT_AUTH_SCHEMA_GENERATION_FAILED({ cause: error });
   }
 }
 
@@ -601,7 +708,7 @@ Proceed?`, { type: "confirm", initial: true, cancel: "null" });
 function resolveDatabaseProvider(input) {
   const enabledProviders = Object.entries(input.providers).filter(([_id, provider]) => provider.isEnabled?.(input.context) ?? true);
   if (!enabledProviders.length) {
-    throw new Error("[nuxt-better-auth] No database provider is enabled. Register one with the better-auth:database:providers hook.");
+    throw diagnostics.NUXT_AUTH_NO_DATABASE_PROVIDER();
   }
   enabledProviders.sort((a, b) => (b[1].priority ?? 0) - (a[1].priority ?? 0));
   const [id, definition] = enabledProviders[0];
@@ -620,7 +727,7 @@ function resolveSecondaryStorage(input) {
   }
   const secondaryStorageEnabled = opt === "custom";
   if (secondaryStorageEnabled && clientOnly) {
-    throw new Error("[nuxt-better-auth] hubSecondaryStorage is not available in clientOnly mode. Either disable clientOnly or remove auth.hubSecondaryStorage.");
+    throw diagnostics.NUXT_AUTH_STORAGE_CLIENT_ONLY();
   }
   return { hubSecondaryStorage: opt, secondaryStorageEnabled };
 }
@@ -832,9 +939,9 @@ function buildAuthRouteRulesCode(authRouteRules) {
 
 function assertConfigPresence(configs, clientOnly) {
   if (!clientOnly && !configs.server.exists)
-    throw new Error(`[nuxt-better-auth] Missing ${configs.server.file}.ts - export default defineServerAuth(...)`);
+    throw diagnostics.NUXT_AUTH_MISSING_CONFIG({ file: configs.server.file, factory: "defineServerAuth" });
   if (!configs.client.exists)
-    throw new Error(`[nuxt-better-auth] Missing ${configs.client.file}.ts - export default defineClientAuth(...)`);
+    throw diagnostics.NUXT_AUTH_MISSING_CONFIG({ file: configs.client.file, factory: "defineClientAuth" });
 }
 function createDefaultDatabaseProviders(buildContext) {
   return {
@@ -856,7 +963,7 @@ function createDefaultDatabaseProviders(buildContext) {
   };
 }
 function collectAuthRouteRules(nuxt) {
-  const runtimeRouteRulesSource = nuxt.options.nitro?.routeRules || nuxt.options.routeRules || {};
+  const runtimeRouteRulesSource = getRuntimeRouteRules(nuxt);
   return Object.fromEntries(
     Object.entries(runtimeRouteRulesSource).flatMap(([path, rule]) => {
       if (!rule || typeof rule !== "object" || !("auth" in rule))
@@ -865,6 +972,63 @@ function collectAuthRouteRules(nuxt) {
     })
   );
 }
+const authIncompatibleRouteRuleKeys = ["cache", "swr", "isr", "static", "prerender", "proxy"];
+function getRuntimeRouteRules(nuxt) {
+  return nuxt.options.nitro?.routeRules || nuxt.options.routeRules || {};
+}
+function registerAuthRouteRulesValidation(nuxt) {
+  nuxt.hook("nitro:init", (nitro) => {
+    assertSafeAuthRouteRules(nitro.options.routeRules);
+  });
+}
+function assertSafeAuthRouteRules(routeRules) {
+  if (!Object.keys(routeRules).length)
+    return;
+  const matcher = toRouteMatcher(createRouter({ routes: routeRules }));
+  const paths = new Set(Object.keys(routeRules));
+  const patterns = [...collectRouteRulePatterns(matcher.ctx.table)];
+  for (const path of collectRouteRulePaths(patterns, ""))
+    paths.add(path);
+  const conflicts = [...paths].flatMap((path) => {
+    const matches = matcher.matchAll(path);
+    const effectiveRule = defu({}, ...matches.reverse());
+    if (effectiveRule.auth === void 0 || effectiveRule.auth === false)
+      return [];
+    const incompatibleKeys = authIncompatibleRouteRuleKeys.filter((key) => {
+      const value = effectiveRule[key];
+      return value !== void 0 && value !== false && value !== 0;
+    });
+    return incompatibleKeys.length ? [{ path, incompatibleKeys }] : [];
+  });
+  if (!conflicts.length)
+    return;
+  const details = conflicts.map(({ path, incompatibleKeys }) => `${path} (${incompatibleKeys.join(", ")})`).join(", ");
+  throw new Error(
+    `[nuxt-better-auth] Auth route rules cannot be combined with cache, swr, isr, static, prerender, or proxy rules. These rules can run before authentication or share user-specific responses. Conflicts: ${details}`
+  );
+}
+function* collectRouteRulePatterns(table, prefix = []) {
+  const segments = (path) => path && path !== "/" ? path.slice(1).split("/") : [];
+  for (const path of [...table.static.keys(), ...table.wildcard.keys()])
+    yield [...prefix, ...segments(path)];
+  for (const [path, child] of table.dynamic)
+    yield* collectRouteRulePatterns(child, [...prefix, ...segments(path), null]);
+}
+function* collectRouteRulePaths(patterns, prefix) {
+  yield prefix || "/";
+  const literals = new Set(patterns.flatMap((pattern) => typeof pattern[0] === "string" ? [pattern[0]] : []));
+  let other = "_";
+  while (literals.has(other))
+    other += "_";
+  for (const segment of [...literals, other]) {
+    const path = `${prefix}/${segment}`;
+    const next = patterns.filter((pattern) => pattern[0] === null || pattern[0] === segment).map((pattern) => pattern.slice(1));
+    if (next.length)
+      yield* collectRouteRulePaths(next, path);
+    else
+      yield path;
+  }
+}
 async function resolveAuthModuleSetup(input, dependencies = {}) {
   const { nuxt, options, runtimeTypesAugmentPath, consola } = input;
   const hasNuxtModuleFn = dependencies.hasNuxtModule ?? hasNuxtModule;
@@ -911,7 +1075,7 @@ async function resolveAuthModuleSetup(input, dependencies = {}) {
     providerId = resolvedProvider.id;
     providerDefinition = resolvedProvider.definition;
   }
-  const runtime = setupRuntimeConfig({
+  setupRuntimeConfig({
     nuxt,
     options,
     clientOnly,
@@ -920,39 +1084,29 @@ async function resolveAuthModuleSetup(input, dependencies = {}) {
   });
   const hasHubDb = providerId === "nuxthub";
   if (hasHubDb && !nuxt.options.alias["hub:db"]) {
-    throw new Error("[nuxt-better-auth] hub:db not found. Ensure @nuxthub/core is loaded before this module and hub.db is configured.");
+    throw diagnostics.NUXT_AUTH_MISSING_HUB_DB();
   }
   return {
     clientOnly,
     configs,
     aliases,
     pluginSources,
-    hub: {
-      hasNuxtHub,
-      options: hub,
-      hasHubDbAvailable
-    },
     database: {
-      providerId,
       hasHubDb,
       providerDefinition,
       buildContext: clientOnly ? void 0 : { hubDialect, usePlural, camelCase }
     },
-    runtime,
     prepareTypes: clientOnly ? void 0 : {
       serverDir: dirname(configs.server.path),
       hasHubDb
     },
     serverTypes: clientOnly ? void 0 : {
-      serverConfigPath: configs.server.path,
       hasHubDb
     },
     sharedTypes: {
-      runtimeTypesAugmentPath,
-      clientConfigPath: configs.client.path
+      runtimeTypesAugmentPath
     },
     schemaGeneration: hasHubDb ? {
-      serverConfigPath: configs.server.path,
       hubSecondaryStorage: options.hubSecondaryStorage ?? false,
       externalizeNuxtHubDatabase: true
     } : void 0
@@ -975,8 +1129,22 @@ function buildNuxtFetchFallback(name) {
 `).join("");
 }
 function registerServerTypeTemplates(input) {
-  const { serverConfigPath, hasHubDb, runtimeTypesPath, sharedServerConfigSafe, h3TypesPath, nitroTypesPath } = input;
-  const routeRuleAugmentations = (nitroTypesPath === "nitro/types" ? [nitroTypesPath] : ["nitropack", nitroTypesPath]).map((moduleName) => `declare module '${moduleName}' {
+  const { serverConfigPath, hasHubDb, runtimeTypesPath, sharedServerConfigSafe, h3TypesPath, nitro3RouteRulesTarget } = input;
+  const fetchRoutingTypeDeclarations = h3TypesPath === "nitro/h3" ? `type NitroFetchRequest = string & {}
+type AvailableRouterMethod<_ReqT extends NitroFetchRequest> = 'get' | 'head' | 'patch' | 'post' | 'put' | 'delete' | 'connect' | 'options' | 'trace'` : `import type { AvailableRouterMethod, NitroFetchRequest } from 'nitropack/types'`;
+  const resolvedNitro3RouteRulesTarget = nitro3RouteRulesTarget ?? {
+    moduleName: "nitro/types",
+    configInterface: "NitroRouteConfig",
+    rulesInterface: "NitroRouteRules"
+  };
+  const routeRuleAugmentations = h3TypesPath === "nitro/h3" ? `declare module ${JSON.stringify(resolvedNitro3RouteRulesTarget.moduleName)} {
+  interface ${resolvedNitro3RouteRulesTarget.configInterface} {
+    auth?: import('${runtimeTypesPath}').AuthMeta
+  }
+  interface ${resolvedNitro3RouteRulesTarget.rulesInterface} {
+    auth?: import('${runtimeTypesPath}').AuthMeta
+  }
+}` : ["nitropack", "nitropack/types"].map((moduleName) => `declare module '${moduleName}' {
   interface NitroRouteRules {
     auth?: import('${runtimeTypesPath}').AuthMeta
   }
@@ -1112,11 +1280,38 @@ declare module '#nuxt-better-auth' {
 import type createServerAuth from '${serverConfigPath}'
 import type { BetterAuthOptions } from 'better-auth'
 import type { getEndpoints } from 'better-auth/api'
-import type { AvailableRouterMethod, NitroFetchRequest, Serialize, Simplify } from '${nitroTypesPath}'
 import type { useFetch as _NuxtUseFetch } from '#app/composables/fetch'
+${fetchRoutingTypeDeclarations}
 
 type _NuxtFetchError = NonNullable<ReturnType<typeof _NuxtUseFetch<void>>['error']['value']>
 
+type _JsonPrimitive = string | number | boolean | null
+type _NonJsonPrimitive = undefined | Function | symbol
+type _IsAny<T> = 0 extends 1 & T ? true : false
+type _FilterKeys<TObj extends object, TFilter> = {
+  [TKey in keyof TObj]: TObj[TKey] extends TFilter ? TKey : never
+}[keyof TObj]
+type _Serialize<T> = _IsAny<T> extends true
+  ? any
+  : T extends _JsonPrimitive | undefined
+    ? T
+    : T extends Map<any, any> | Set<any>
+      ? Record<string, never>
+      : T extends _NonJsonPrimitive
+        ? never
+        : T extends { toJSON: () => infer U }
+          ? U
+          : T extends []
+            ? []
+            : T extends [unknown, ...unknown[]]
+              ? { [K in keyof T]: T[K] extends _NonJsonPrimitive ? null : _Serialize<T[K]> }
+              : T extends ReadonlyArray<infer U>
+                ? (U extends _NonJsonPrimitive ? null : _Serialize<U>)[]
+                : T extends object
+                  ? { [K in keyof Omit<T, _FilterKeys<T, _NonJsonPrimitive>>]: _Serialize<T[K]> }
+                  : never
+type _Simplify<T> = T extends any[] | Date ? T : { [K in keyof T]: _Simplify<T[K]> }
+
 type _RawConfig = ReturnType<typeof createServerAuth>
 type _RawPlugins = _RawConfig extends { plugins: infer P } ? P : _RawConfig extends { plugins?: infer P } ? P : []
 type _Config = Omit<BetterAuthOptions, 'plugins'> & Omit<_RawConfig, 'plugins'> & {
@@ -1136,7 +1331,7 @@ type _RoutePathFromEndpoint<E> = E extends { path: infer P extends string }
       ? never
       : \`/api/auth\${P}\`
   : never
-type _RouteResponseFromEndpoint<E> = E extends (...args: any[]) => Promise<infer R> ? Simplify<Serialize<Awaited<R>>> : never
+type _RouteResponseFromEndpoint<E> = E extends (...args: any[]) => Promise<infer R> ? _Simplify<_Serialize<Awaited<R>>> : never
 type _RouteDefaultResponse<E> = never
 type _UnionToIntersection<U> = (U extends unknown ? (value: U) => void : never) extends (value: infer I) => void ? I : never
 
@@ -1253,10 +1448,20 @@ export {}
 ${routeRuleAugmentations}
 export {}
 `
-  }, { nitro: true, node: true });
+  }, { nuxt: h3TypesPath === "nitro/h3", nitro: true, node: true });
 }
 function registerSharedTypeTemplates(input) {
   const nitroV3 = input.h3TypesPath === "nitro/h3";
+  const clientOnlyAuthApiTypes = input.clientOnly ? `
+  export type AuthApiInternalRoutes = Record<string, Record<string, unknown>>
+  export type AuthApiEndpointPatternPath = string
+  export type AuthApiEndpointPath = string
+  export type AuthApiEndpointMethod<Path extends AuthApiEndpointPath> = string
+  export type AuthApiEndpointResponse<
+    Path extends AuthApiEndpointPath,
+    Method extends AuthApiEndpointMethod<Path> = AuthApiEndpointMethod<Path>,
+  > = unknown
+` : "";
   addTypeTemplate({
     filename: "types/nuxt-better-auth.d.ts",
     getContents: () => `
@@ -1293,7 +1498,8 @@ declare module '#nuxt-better-auth' {
   }
 
   export interface AuthSocialProviderRegistry {}
-  export type AuthSocialProviderId = AuthSocialProviderRegistry extends { ids: infer T } ? Extract<T, string> : never
+  export type AuthSocialProviderId = AuthSocialProviderRegistry extends { ids: infer T } ? Extract<T, string> : string
+${clientOnlyAuthApiTypes}
 
   export interface AuthUserUpdateInput {
     name?: string
@@ -1360,15 +1566,7 @@ const dbIdentifierRE = /\bdb\b/;
 const sessionHookAfterIdentifierRE = /\bsessionHookAfter\b/;
 const nuxtHubDbImportRE = /@nuxthub\/db/;
 function isServerConfigSharedTypeSafe(serverConfigPath) {
-  const resolvedPath = [
-    serverConfigPath,
-    `${serverConfigPath}.ts`,
-    `${serverConfigPath}.mts`,
-    `${serverConfigPath}.cts`,
-    `${serverConfigPath}.js`,
-    `${serverConfigPath}.mjs`,
-    `${serverConfigPath}.cjs`
-  ].find((path) => existsSync(path));
+  const resolvedPath = resolveAuthConfigFile(serverConfigPath);
   if (!resolvedPath)
     return false;
   const contents = readFileSync(resolvedPath, "utf8");
@@ -1433,7 +1631,7 @@ const module$1 = defineNuxtModule({
       await nuxt.callHook("better-auth:plugins:extend", registeredPluginSources);
       for (const source of [...registeredPluginSources.server || [], ...registeredPluginSources.client || []]) {
         if (!isAbsolute(source))
-          throw new Error(`[nuxt-better-auth] Modules must register absolute plugin source paths. Received: ${source}`);
+          throw diagnostics.NUXT_AUTH_INVALID_PLUGIN_SOURCE({ source });
       }
       const setup = await resolveAuthModuleSetup({
         nuxt,
@@ -1495,6 +1693,7 @@ const module$1 = defineNuxtModule({
         };
         await setup.database.providerDefinition.setup?.(setupCtx);
       }
+      registerAuthRouteRulesValidation(nuxt);
       const authRouteRulesTemplate = addTemplate({
         filename: "better-auth/route-rules.mjs",
         getContents: () => buildAuthRouteRulesCode(collectAuthRouteRules(nuxt)),
@@ -1508,7 +1707,7 @@ const module$1 = defineNuxtModule({
           runtimeTypesPath: resolver.resolve("./runtime/types"),
           sharedServerConfigSafe: [setup.configs.server.path, ...setup.pluginSources.server].every(isServerConfigSharedTypeSafe),
           h3TypesPath: nitroImports.h3,
-          nitroTypesPath: nitroImports.types
+          nitro3RouteRulesTarget: nitroImports.runtime === "nitro3" ? resolveNitro3RouteRulesTarget(nuxt.options.rootDir) : void 0
         });
       }
       if (setup.schemaGeneration) {
@@ -1526,18 +1725,23 @@ const module$1 = defineNuxtModule({
         runtimeTypesAugmentPath: setup.sharedTypes.runtimeTypesAugmentPath,
         runtimeTypesPath: resolver.resolve("./runtime/types"),
         clientConfigPath,
-        h3TypesPath: nitroImports.h3
+        h3TypesPath: nitroImports.h3,
+        clientOnly: setup.clientOnly
       });
       registerTemplateHmrHook(nuxt);
       registerServerRuntime({ clientOnly: setup.clientOnly, resolve: resolver.resolve });
-      registerAuthMiddlewareHook(nuxt, resolver.resolve);
+      registerAuthMiddleware(resolver.resolve);
       await registerDevtools({ nuxt, clientOnly: setup.clientOnly, hasHubDb: setup.database.hasHubDb, resolve: resolver.resolve });
       registerRouteRulesMetaHook(nuxt);
       return Boolean(setup.schemaGeneration);
     };
     let setupPromise;
     const finishSetupOnce = () => {
-      setupPromise ||= finishSetup();
+      setupPromise ||= finishSetup().catch((error) => {
+        if (error instanceof Diagnostic)
+          throw new Error(formatDiagnostic(error), { cause: error });
+        throw error;
+      });
       return setupPromise;
     };
     registerNuxtHubSchemaHook(nuxt, finishSetupOnce);