@nuxtjs/better-auth 0.3.10 → 0.3.12

package/dist/module.d.mts

@@ -30,24 +30,27 @@ interface BetterAuthDatabaseProviderDefinition {
     isEnabled?: (ctx: BetterAuthDatabaseProviderEnabledContext) => boolean;
     priority?: number;
 }
+interface BetterAuthNuxtHooks {
+    /** Register absolute plugin module paths during module setup. Sources are additive and are not deduplicated. */
+    'better-auth:plugins:extend': (sources: BetterAuthPluginSources) => void | Promise<void>;
+    /**
+     * Add plugin schemas to generated Better Auth database tables.
+     * This build-time hook does not install plugins in the runtime auth instance.
+     * @param config - Plugins to include during schema generation
+     * @param config.plugins - Better Auth plugins whose schemas should be generated
+     */
+    'better-auth:config:extend': (config: {
+        plugins?: BetterAuthPlugin[];
+    }) => void | Promise<void>;
+    /** Register or override Better Auth database providers. */
+    'better-auth:database:providers': (providers: Record<string, BetterAuthDatabaseProviderDefinition>) => void | Promise<void>;
+}
 declare module '@nuxt/schema' {
-    interface NuxtHooks {
-        /** Register absolute plugin module paths during module setup. Sources are additive and are not deduplicated. */
-        'better-auth:plugins:extend': (sources: BetterAuthPluginSources) => void | Promise<void>;
-        /**
-         * Add plugin schemas to generated Better Auth database tables.
-         * This build-time hook does not install plugins in the runtime auth instance.
-         * @param config - Plugins to include during schema generation
-         * @param config.plugins - Better Auth plugins whose schemas should be generated
-         */
-        'better-auth:config:extend': (config: {
-            plugins?: BetterAuthPlugin[];
-        }) => void | Promise<void>;
-        /**
-         * Register or override Better Auth database providers.
-         * Providers are auto-selected via `isEnabled` + `priority`.
-         */
-        'better-auth:database:providers': (providers: Record<string, BetterAuthDatabaseProviderDefinition>) => void | Promise<void>;
+    interface NuxtHooks extends BetterAuthNuxtHooks {
+    }
+}
+declare module 'nuxt/schema' {
+    interface NuxtHooks extends BetterAuthNuxtHooks {
     }
 }
 

package/dist/module.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjs/better-auth",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "configKey": "auth",
   "compatibility": {
     "nuxt": ">=4.0.0"

package/dist/module.mjs

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
-import { getLayerDirectories, resolveServerVariant, hasNuxtCompatibility, hasNuxtModuleCompatibility, updateTemplates, addServerImports, addServerHandler, addNitroPlugin, addImports, addPlugin, addComponentsDir, addRouteMiddleware, extendPages, addTemplate, hasNuxtModule, addTypeTemplate, defineNuxtModule, createResolver, getNitroVersion } from '@nuxt/kit';
+import { getLayerDirectories, resolveServerVariant, hasNuxtCompatibility, hasNuxtModuleCompatibility, addTypeTemplate, updateTemplates, addServerImports, addServerHandler, addNitroPlugin, addImports, addPlugin, addComponentsDir, addRouteMiddleware, extendPages, addTemplate, hasNuxtModule, defineNuxtModule, createResolver, getNitroVersion } from '@nuxt/kit';
 import { consola as consola$1 } from 'consola';
 import { defineDiagnostics, Diagnostic, formatDiagnostic } from 'nostics';
 import { isAbsolute, join, resolve, relative, dirname } from 'pathe';
@@ -13,7 +13,7 @@ import { isCI, isTest } from 'std-env';
 import { isInternalAssetPath } from '../dist/runtime/internal/auth-route-rules.js';
 export { defineClientAuth, defineServerAuth } from '../dist/runtime/config.js';
 
-const version = "0.3.10";
+const version = "0.3.12";
 
 const CONFIG_EXTENSIONS = [".ts", ".js", ".mts", ".cts", ".mjs", ".cjs"];
 const CONFIG_EXTENSION_RE = /\.[cm]?[jt]s$/;
@@ -284,6 +284,14 @@ const diagnostics = defineDiagnostics({
       why: (p) => `Failed to load auth config at ${p.configPath}: ${p.cause instanceof Error ? p.cause.message : String(p.cause)}`,
       fix: "Check the config imports and required environment variables, then restart Nuxt to regenerate the schema."
     },
+    NUXT_AUTH_CLI_MISSING: {
+      why: "NuxtHub schema generation needs the Better Auth CLI package (auth), which is not installed.",
+      fix: (p) => `Run ${p.command}. Keep auth on the same version as better-auth.`
+    },
+    NUXT_AUTH_CLI_VERSION_MISMATCH: {
+      why: (p) => `auth@${p.cliVersion} installs better-auth@${p.cliBetterAuthVersion}, but this app uses better-auth@${p.betterAuthVersion}. Two copies of Better Auth cause conflicting types.`,
+      fix: (p) => `Run ${p.command} so auth and better-auth use the same version.`
+    },
     NUXT_AUTH_EMPTY_SCHEMA: {
       why: (p) => `Schema generation returned empty result for ${p.dialect}`,
       fix: "Check the Better Auth plugins and database options in defineServerAuth(), then regenerate the schema."
@@ -379,6 +387,14 @@ function registerAuthMiddleware(resolve) {
 }
 function registerPrepareTypesHook(input) {
   const { nuxt, serverDir, hasHubDb, serverImportsTypesFile } = input;
+  addTypeTemplate({
+    filename: "types/auth-route-rules.d.ts",
+    getContents: () => `
+declare module '#auth/route-rules' {
+  export const authRouteRules: Record<string, { auth?: unknown }>
+}
+`
+  }, { nitro: true, node: true });
   nuxt.hook("prepare:types", ({ nodeTsConfig, nodeReferences, sharedReferences }) => {
     nodeTsConfig.compilerOptions ||= {};
     nodeTsConfig.compilerOptions.paths ||= {};
@@ -470,6 +486,40 @@ function registerRouteRulesMetaHook(nuxt) {
 function dialectToProvider(dialect) {
   return dialect === "postgresql" ? "pg" : dialect;
 }
+const EXACT_VERSION_RE = /^\d+\.\d+\.\d+(?:-[\w.]+)?$/;
+const LOCKFILES = [["pnpm-lock.yaml", "pnpm"], ["yarn.lock", "yarn"], ["bun.lock", "bun"], ["bun.lockb", "bun"], ["package-lock.json", "npm"]];
+function readInstalledPackage(name) {
+  let entry;
+  try {
+    entry = createRequire(import.meta.url).resolve(name === "auth" ? "auth/api" : name);
+  } catch {
+    return void 0;
+  }
+  for (let dir = dirname(entry); dir !== dirname(dir); dir = dirname(dir)) {
+    const file = join(dir, "package.json");
+    if (!existsSync(file))
+      continue;
+    const pkg = JSON.parse(readFileSync(file, "utf8"));
+    if (pkg.name === name)
+      return pkg;
+  }
+}
+function devInstallCommand(spec, rootDir) {
+  const agent = process.env.npm_config_user_agent?.split("/")[0];
+  const manager = LOCKFILES.find(([file]) => existsSync(join(rootDir, file)))?.[1] ?? LOCKFILES.find(([, name]) => name === agent)?.[1] ?? "npm";
+  return manager === "npm" ? `npm install -D ${spec}` : `${manager} add -D ${spec}`;
+}
+function checkBetterAuthCli(rootDir, readPackage = readInstalledPackage) {
+  const betterAuthVersion = readPackage("better-auth")?.version;
+  const spec = betterAuthVersion ? `auth@${betterAuthVersion}` : "auth";
+  const cli = readPackage("auth");
+  if (!cli)
+    return { error: diagnostics.NUXT_AUTH_CLI_MISSING({ command: devInstallCommand(spec, rootDir) }) };
+  const cliBetterAuthVersion = cli.dependencies?.["better-auth"];
+  if (betterAuthVersion && cliBetterAuthVersion && EXACT_VERSION_RE.test(cliBetterAuthVersion) && cliBetterAuthVersion !== betterAuthVersion)
+    return { warn: diagnostics.NUXT_AUTH_CLI_VERSION_MISMATCH({ cliVersion: cli.version ?? cliBetterAuthVersion, cliBetterAuthVersion, betterAuthVersion, command: devInstallCommand(spec, rootDir) }) };
+  return {};
+}
 async function generateDrizzleSchema(authOptions, dialect, schemaOptions) {
   const { generateDrizzleSchema: generateDrizzleSchema2 } = await import('auth/api');
   const provider = dialectToProvider(dialect);
@@ -631,6 +681,11 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, h
     consola.warn(formatDiagnostic(diagnostics.NUXT_AUTH_UNSUPPORTED_DIALECT({ dialect })));
     return;
   }
+  const cli = checkBetterAuthCli(nuxt.options.rootDir);
+  if (cli.error)
+    throw cli.error;
+  if (cli.warn)
+    consola.warn(formatDiagnostic(cli.warn));
   const context = { nuxt, serverConfigPath };
   try {
     const authConfig = await loadAuthOptions(context);
@@ -1092,10 +1147,10 @@ function getRuntimeRouteRules(nuxt) {
 }
 function registerAuthRouteRulesValidation(nuxt) {
   nuxt.hook("nitro:init", (nitro) => {
-    assertSafeAuthRouteRules(nitro.options.routeRules);
+    assertSafeAuthRouteRules(nitro.options.routeRules, nuxt.options.app.baseURL);
   });
 }
-function assertSafeAuthRouteRules(routeRules) {
+function assertSafeAuthRouteRules(routeRules, baseURL = "/") {
   if (!Object.keys(routeRules).length)
     return;
   const matcher = toRouteMatcher(createRouter({ routes: routeRules }));
@@ -1104,7 +1159,7 @@ function assertSafeAuthRouteRules(routeRules) {
   for (const path of collectRouteRulePaths(patterns, ""))
     paths.add(path);
   const conflicts = [...paths].flatMap((path) => {
-    if (isInternalAssetPath(path))
+    if (isInternalAssetPath(path, baseURL))
       return [];
     const matches = matcher.matchAll(path);
     const effectiveRule = defu({}, ...matches.reverse());
@@ -1573,6 +1628,8 @@ declare module '#nuxt-better-auth' {
     emailVerified: boolean
     name: string
     image?: string | null
+    /** Whether the user has enabled two-factor authentication. */
+    twoFactorEnabled?: boolean
   }
 
   export interface AuthSession {

package/dist/runtime/app/composables/useUserSession.js

@@ -2,7 +2,7 @@ import { computed, navigateTo, nextTick, useNuxtApp, useRequestURL, useRuntimeCo
 import { normalizeAuthActionError } from "../internal/auth-action-error.js";
 import { resolvePostAuthSuccessRedirect, withFallbackSocialCallbackURL } from "../internal/redirect-helpers.js";
 import { fetchSessionClient, fetchSessionServer, isExpectedSignedOutSessionError, stripToken } from "../internal/session-fetch.js";
-import { isRecord } from "../internal/utils.js";
+import { isRecord, setIfChanged } from "../internal/utils.js";
 import { createVueSafeAuthFacade, isAuthProxyProbeKey } from "../internal/vue-safe-auth-proxy.js";
 import { wrapAuthMethod } from "../internal/wrap-auth-method.js";
 import { getAuthRuntimeFlags, useRawAuthClient } from "./useAuthClient.js";
@@ -152,8 +152,8 @@ export function useUserSession() {
         if (newSession?.data?.session && newSession?.data?.user) {
           sessionExpiredRedirecting = false;
           hydrationSessionWasActive = false;
-          session.value = stripToken(newSession.data.session);
-          user.value = newSession.data.user;
+          setIfChanged(session, stripToken(newSession.data.session));
+          setIfChanged(user, newSession.data.user);
         } else if (!newSession?.isPending && !newSession?.isRefetching) {
           const isHydrationEmptySnapshot = nuxtApp.isHydrating && nuxtApp.payload.serverRendered && Boolean(session.value && user.value) && !newSession?.data?.session && !newSession?.data?.user;
           if (isHydrationEmptySnapshot) {

package/dist/runtime/app/internal/session-fetch.js

@@ -1,6 +1,7 @@
 import { parseJSON } from "better-auth/client";
 import { useRequestFetch, useRequestHeaders } from "#imports";
 import { normalizeAuthActionError } from "./auth-action-error.js";
+import { setIfChanged } from "./utils.js";
 export function stripToken(session) {
   const { token: _, ...safe } = session;
   return safe;
@@ -35,8 +36,8 @@ export async function fetchSessionServer(session, user, authReady, options = {})
       ...options.force ? { query: { disableCookieCache: true } } : {}
     });
     if (data?.session && data?.user) {
-      session.value = stripToken(data.session);
-      user.value = data.user;
+      setIfChanged(session, stripToken(data.session));
+      setIfChanged(user, data.user);
     } else {
       session.value = null;
       user.value = null;
@@ -60,8 +61,8 @@ export async function fetchSessionClient(client, session, user, authReady, optio
     }
     const data = result.data;
     if (data?.session && data?.user) {
-      session.value = stripToken(data.session);
-      user.value = data.user;
+      setIfChanged(session, stripToken(data.session));
+      setIfChanged(user, data.user);
     } else {
       session.value = null;
       user.value = null;

package/dist/runtime/app/internal/utils.d.ts

@@ -1 +1,9 @@
 export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/**
+ * Better Auth refetches the session on window focus and returns fresh objects even
+ * when nothing changed. Keeping the current object avoids retriggering every
+ * computed and watcher that depends on the session or user.
+ */
+export declare function setIfChanged<T>(target: {
+    value: T;
+}, value: T): void;

package/dist/runtime/app/internal/utils.js

@@ -1,3 +1,19 @@
 export function isRecord(value) {
   return Boolean(value && typeof value === "object");
 }
+function isSameValue(a, b) {
+  if (Object.is(a, b))
+    return true;
+  if (a instanceof Date || b instanceof Date)
+    return a instanceof Date && b instanceof Date && a.getTime() === b.getTime();
+  if (Array.isArray(a) || Array.isArray(b))
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((item, index) => isSameValue(item, b[index]));
+  if (!isRecord(a) || !isRecord(b))
+    return false;
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && isSameValue(a[key], b[key]));
+}
+export function setIfChanged(target, value) {
+  if (!isSameValue(target.value, value))
+    target.value = value;
+}

package/dist/runtime/app/middleware/auth.global.js

@@ -2,13 +2,15 @@ import { defu } from "defu";
 import { createRouter, toRouteMatcher } from "radix3";
 import { parsePath, parseQuery } from "ufo";
 import { createError, defineNuxtRouteMiddleware, getRouteRules, navigateTo, useNuxtApp, useRequestHeaders, useRuntimeConfig } from "#imports";
-import { shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
+import { normalizeAuthRoutePath, shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
 import { matchesUser } from "../../utils/match-user.js";
 import { useUserSession } from "../composables/useUserSession.js";
 let authRouteRulesPromise = null;
 let routeRulesMatcherPromise = null;
 export default defineNuxtRouteMiddleware(async (to) => {
-  if (shouldSkipAuthRouteRules(to.path))
+  const runtimeConfig = useRuntimeConfig();
+  const path = normalizeAuthRoutePath(to.path, runtimeConfig.app?.baseURL);
+  if (shouldSkipAuthRouteRules(to.path, runtimeConfig.app?.baseURL) || shouldSkipAuthRouteRules(path, runtimeConfig.app?.baseURL))
     return;
   if (to.matched?.length === 0)
     return;
@@ -30,7 +32,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
   const auth = to.meta.auth;
   if (auth === void 0 || auth === false)
     return;
-  const config = useRuntimeConfig().public.auth;
+  const config = runtimeConfig.public.auth;
   if (import.meta.server && config?.clientOnly)
     return;
   const { fetchSession, user, loggedIn } = useUserSession();

package/dist/runtime/config.d.ts

@@ -12,7 +12,7 @@ export interface ClientAuthContext {
 export type ServerAuthConfig = Omit<BetterAuthOptions, 'secret' | 'baseURL' | 'basePath'> & {
     /** The module registers its server handler at /api/auth. */
     basePath?: '/api/auth';
-    plugins?: readonly BetterAuthPlugin[];
+    plugins?: readonly unknown[];
 };
 export type ClientAuthConfig = Omit<BetterAuthClientOptions, 'baseURL'> & {
     baseURL?: string;
@@ -108,8 +108,11 @@ export interface AuthRuntimeConfig {
 export interface AuthPrivateRuntimeConfig {
     hubSecondaryStorage: boolean | 'custom';
 }
-export declare function defineServerAuth<const R>(config: (ctx: ServerAuthContext) => R & ServerAuthConfig): (ctx: ServerAuthContext) => R;
-export declare function defineServerAuth<const R>(config: R & ServerAuthConfig & (R extends (...args: never[]) => unknown ? never : unknown)): (ctx: ServerAuthContext) => R;
+export declare function defineServerAuth<const R extends ServerAuthConfig>(config: (ctx: ServerAuthContext) => R): (ctx: ServerAuthContext) => R;
+export declare function defineServerAuth<const R>(config: (ctx: ServerAuthContext) => R & ServerAuthConfig & (R extends {
+    basePath: infer B;
+} ? B extends '/api/auth' ? unknown : never : unknown)): (ctx: ServerAuthContext) => R;
+export declare function defineServerAuth<const R extends ServerAuthConfig>(config: R & (R extends (...args: never[]) => unknown ? never : unknown)): (ctx: ServerAuthContext) => R;
 export declare function extendServerAuth<const R extends ServerAuthConfig, const P extends readonly BetterAuthPlugin[]>(createConfig: (ctx: ServerAuthContext) => R, plugins: P): (ctx: ServerAuthContext) => ExtendedServerAuthConfig<R, P>;
 export declare function defineClientAuth<T extends ClientAuthConfig>(config: T | ((ctx: ClientAuthContext) => T)): ClientAuthFactory<T>;
 export declare function extendClientAuth<T extends ClientAuthConfig, const P extends BetterAuthClientPlugin[]>(createClient: ClientAuthFactory<T>, plugins: P): ClientAuthFactory<ExtendedClientAuthConfig<T, P>>;

package/dist/runtime/internal/auth-route-rules.d.ts

@@ -1,5 +1,5 @@
 import type { AuthRouteRules } from '../types.js';
-export declare function isInternalAssetPath(path: string): boolean;
+export declare function isInternalAssetPath(path: string, baseURL?: string): boolean;
 export declare function normalizeAuthRoutePath(path: string, baseURL?: string): string;
 export declare function normalizeAuthRouteRule(rule: unknown): AuthRouteRules['auth'];
-export declare function shouldSkipAuthRouteRules(path: string): boolean;
+export declare function shouldSkipAuthRouteRules(path: string, baseURL?: string): boolean;

package/dist/runtime/internal/auth-route-rules.js

@@ -1,8 +1,11 @@
 import { withoutBase } from "ufo";
-const internalAssetPaths = ["/_fonts", "/_ipx", "/_nuxt", "/api/_nuxt_icon"];
-export function isInternalAssetPath(path) {
+const internalAssetPaths = ["/_fonts", "/_ipx", "/_nuxt", "/_scripts/assets", "/api/_nuxt_icon"];
+export function isInternalAssetPath(path, baseURL = "/") {
   const pathname = path.split(/[?#]/, 1)[0] || "/";
-  return internalAssetPaths.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+  const normalizedPathname = withoutBase(pathname, baseURL) || "/";
+  return internalAssetPaths.some((prefix) => {
+    return normalizedPathname === prefix || normalizedPathname.startsWith(`${prefix}/`);
+  });
 }
 const internalRouteRuleAuthPaths = /* @__PURE__ */ new Set([
   "/__better-auth-devtools",
@@ -27,7 +30,7 @@ export function normalizeAuthRouteRule(rule) {
     return rule.options;
   return rule;
 }
-export function shouldSkipAuthRouteRules(path) {
+export function shouldSkipAuthRouteRules(path, baseURL = "/") {
   const pathname = path.split(/[?#]/, 1)[0] || "/";
-  return isInternalAssetPath(pathname) || internalRouteRuleAuthPaths.has(pathname) || internalRouteRuleAuthPrefixes.some((prefix) => pathname.startsWith(prefix));
+  return isInternalAssetPath(pathname, baseURL) || internalRouteRuleAuthPaths.has(pathname) || internalRouteRuleAuthPrefixes.some((prefix) => pathname.startsWith(prefix));
 }

package/dist/runtime/server/internal/nitro2.d.ts

@@ -1,9 +1,19 @@
 import type { H3Event } from 'h3';
 import type { AuthRouteRules } from '../../types.js';
-import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, toWebRequest } from 'h3';
+import { defineEventHandler } from 'h3';
 import { useRuntimeConfig } from 'nitropack/runtime';
-export { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, toWebRequest, useRuntimeConfig, };
+export { defineEventHandler, useRuntimeConfig, };
 export type ServerEvent = H3Event;
+export declare function getRequestHost(event: ServerEvent, options?: {
+    xForwardedHost?: boolean;
+}): string;
+export declare function getRequestProtocol(event: ServerEvent, options?: {
+    xForwardedProto?: boolean;
+}): string;
+export declare function getRequestURL(event: ServerEvent): URL;
+export declare function getQuery(event: ServerEvent): Record<string, string | string[]>;
+export declare function toWebRequest(event: ServerEvent): Request;
+export declare function readBody(event: ServerEvent): Promise<unknown>;
 export declare function splitCookiesString(cookiesString: string | string[]): string[];
 export declare function getAuthRouteRules(event: ServerEvent): AuthRouteRules;
 export declare function createAuthError(status: number, statusText: string): Error;

package/dist/runtime/server/internal/nitro2.js

@@ -1,31 +1,111 @@
 import { splitSetCookieString } from "cookie-es";
-import {
-  createError,
-  defineEventHandler,
-  getQuery,
-  getRequestHost,
-  getRequestProtocol,
-  getRequestURL,
-  readBody,
-  toWebRequest
-} from "h3";
+import { defineEventHandler } from "h3";
 import { getRouteRules, useRuntimeConfig } from "nitropack/runtime";
 export {
   defineEventHandler,
-  getQuery,
-  getRequestHost,
-  getRequestProtocol,
-  getRequestURL,
-  readBody,
-  toWebRequest,
   useRuntimeConfig
 };
+function createNitro2AuthError(status, statusText) {
+  const error = new Error(statusText);
+  const markerConstructor = function Nitro2ErrorConstructor() {
+  };
+  Object.defineProperty(markerConstructor, "__h3_error__", { value: true });
+  Object.defineProperties(error, {
+    name: { value: "HTTPError", configurable: true, enumerable: false, writable: true },
+    constructor: { value: markerConstructor, configurable: true },
+    __h3_error__: { value: true, configurable: true, enumerable: true, writable: true },
+    status: { value: status, configurable: true, enumerable: true, writable: true },
+    statusText: { value: statusText, configurable: true, enumerable: true, writable: true },
+    statusCode: { value: status, configurable: true, enumerable: true, writable: true },
+    statusMessage: { value: statusText, configurable: true, enumerable: true, writable: true },
+    toJSON: {
+      value: () => ({
+        status,
+        statusText,
+        statusCode: status,
+        statusMessage: statusText,
+        message: statusText,
+        unhandled: false,
+        fatal: false
+      }),
+      configurable: true
+    },
+    unhandled: { value: false, configurable: true, enumerable: true, writable: true },
+    fatal: { value: false, configurable: true, enumerable: true, writable: true }
+  });
+  return error;
+}
+function requestHeaders(event) {
+  return event.node?.req?.headers ?? {};
+}
+export function getRequestHost(event, options = {}) {
+  const headers = requestHeaders(event);
+  if (options.xForwardedHost) {
+    const forwarded = headers["x-forwarded-host"];
+    const host2 = Array.isArray(forwarded) ? forwarded[0] : forwarded?.split(",")[0]?.trim();
+    if (host2)
+      return host2;
+  }
+  const host = headers.host;
+  return (Array.isArray(host) ? host[0] : host) || "localhost";
+}
+export function getRequestProtocol(event, options = {}) {
+  const headers = requestHeaders(event);
+  if (options.xForwardedProto !== false && headers["x-forwarded-proto"] === "https")
+    return "https";
+  return event.node?.req?.socket && event.node.req.socket["encrypted"] ? "https" : "http";
+}
+export function getRequestURL(event) {
+  const req = event.node?.req ?? {};
+  const path = req.originalUrl || req.url || event.path || "/";
+  return new URL(path, `${getRequestProtocol(event)}://${getRequestHost(event)}`);
+}
+export function getQuery(event) {
+  const query = {};
+  for (const [key, value] of getRequestURL(event).searchParams) {
+    const previous = query[key];
+    query[key] = previous === void 0 ? value : Array.isArray(previous) ? [...previous, value] : [previous, value];
+  }
+  return query;
+}
+export function toWebRequest(event) {
+  const req = event.node?.req;
+  const webRequest = event.web?.request;
+  if (webRequest)
+    return webRequest;
+  const init = {
+    method: req?.method,
+    headers: req?.headers ? Object.fromEntries(Object.entries(req.headers).flatMap(([key, value]) => value === void 0 ? [] : [[key, Array.isArray(value) ? value.join(", ") : value]])) : void 0,
+    duplex: "half"
+  };
+  if (req?.method !== "GET" && req?.method !== "HEAD")
+    init.body = req;
+  return new Request(getRequestURL(event), init);
+}
+export async function readBody(event) {
+  const request = toWebRequest(event);
+  const contentType = request.headers.get("content-type") || "";
+  if (contentType.includes("application/json"))
+    return request.json();
+  if (contentType.includes("application/x-www-form-urlencoded"))
+    return Object.fromEntries((await request.text()).split("&").filter(Boolean).map((pair) => pair.split("=").map(decodeURIComponent)));
+  return request.text();
+}
 export function splitCookiesString(cookiesString) {
   return splitSetCookieString(cookiesString);
 }
 export function getAuthRouteRules(event) {
-  return getRouteRules(event);
+  const eventWithContext = event;
+  if (!eventWithContext.context)
+    eventWithContext.context = {};
+  if (!eventWithContext.path)
+    eventWithContext.path = getRequestURL(event).pathname;
+  try {
+    return getRouteRules(event) || {};
+  } catch {
+    return {};
+  }
 }
 export function createAuthError(status, statusText) {
-  return createError({ statusCode: status, statusMessage: statusText });
+  return createNitro2AuthError(status, statusText);
 }

package/dist/runtime/server/internal/portable.js

@@ -25,7 +25,7 @@ export function splitCookiesString(cookiesString) {
 }
 export function getAuthRouteRules(event) {
   const rules = getRouteRules(event);
-  return { auth: normalizeAuthRouteRule(rules.auth) };
+  return { auth: normalizeAuthRouteRule(rules?.auth) };
 }
 export function createAuthError(status, statusText) {
   return createError({ status, statusText });

package/dist/runtime/server/middleware/route-access.js

@@ -1,8 +1,11 @@
+import { defu } from "defu";
+import { createRouter, toRouteMatcher } from "radix3";
 import { normalizeAuthRoutePath, shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
 import { matchesUser } from "../../utils/match-user.js";
 import { prepareAuthSecret } from "../internal/auth-secret.js";
 import { createAuthError, defineEventHandler, getAuthRouteRules, getRequestURL, useRuntimeConfig } from "../internal/nitro-compat.js";
 import { getUserSession, requireUserSession } from "../utils/session.js";
+let authRouteRulesMatcherPromise = null;
 export default defineEventHandler(async (event) => {
   await prepareAuthSecret();
   const path = normalizeAuthRoutePath(
@@ -13,7 +16,7 @@ export default defineEventHandler(async (event) => {
     return;
   if (shouldSkipAuthRouteRules(path))
     return;
-  const rules = getAuthRouteRules(event);
+  const rules = await resolveAuthRouteRules(event, path);
   if (!rules.auth)
     return;
   const auth = rules.auth;
@@ -32,3 +35,19 @@ export default defineEventHandler(async (event) => {
     }
   }
 });
+async function resolveAuthRouteRules(event, path) {
+  const rules = getAuthRouteRules(event);
+  if (rules?.auth !== void 0)
+    return rules;
+  if (!authRouteRulesMatcherPromise) {
+    authRouteRulesMatcherPromise = import("#auth/route-rules").then((mod) => {
+      const routeRules = mod.authRouteRules || {};
+      return Object.keys(routeRules).length ? toRouteMatcher(createRouter({ routes: routeRules })) : null;
+    }).catch(() => null);
+  }
+  const matcher = await authRouteRulesMatcherPromise;
+  const matches = matcher?.matchAll(path);
+  if (!matches?.length)
+    return rules || {};
+  return defu({}, ...matches.reverse());
+}

package/dist/runtime/server/utils/auth.d.ts

@@ -9,13 +9,18 @@ type UserAuthConfig = AuthOptions & {
     trustedOrigins?: BetterAuthOptions['trustedOrigins'];
     secondaryStorage?: BetterAuthOptions['secondaryStorage'];
 };
-type ResolvedAuthOptions = Omit<UserAuthConfig, 'secret' | 'baseURL' | 'trustedOrigins' | 'database'> & {
+type ResolvedAuthOptions = Omit<UserAuthConfig, 'secret' | 'baseURL' | 'trustedOrigins' | 'database' | 'plugins'> & {
+    plugins?: BetterAuthOptions['plugins'];
     secret: string;
     baseURL: string;
     trustedOrigins?: BetterAuthOptions['trustedOrigins'];
     database?: BetterAuthOptions['database'];
 };
-type AuthInstance = ReturnType<typeof betterAuth<ResolvedAuthOptions>>;
+type AuthInstance = ReturnType<typeof betterAuth<ResolvedAuthOptions>> & {
+    api: ReturnType<typeof betterAuth<ResolvedAuthOptions>>['api'] & {
+        signInUsername?: (...args: unknown[]) => unknown;
+    };
+};
 /**
  * Returns the Better Auth instance like `serverAuth()`, after waiting for the auth secret that
  * Nuxt 4.6+ derives from `appSecret` (`NUXT_APP_SECRET`). Use it in code that can run before the

package/dist/runtime/server/utils/auth.js

@@ -67,8 +67,21 @@ function resolveConfiguredSiteUrl(config) {
 function resolveEventOrigin(event) {
   if (!event)
     return void 0;
-  const host = getRequestHost(event, { xForwardedHost: true });
-  const protocol = getRequestProtocol(event, { xForwardedProto: true });
+  let host;
+  let protocol;
+  try {
+    host = getRequestHost(event, { xForwardedHost: true });
+    protocol = getRequestProtocol(event, { xForwardedProto: true });
+  } catch {
+    const request = event.node?.req;
+    const headers = request?.headers ?? {};
+    const forwardedHost = headers["x-forwarded-host"];
+    const forwarded = Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost?.split(",")[0]?.trim();
+    const rawHost = forwarded || headers.host;
+    host = (Array.isArray(rawHost) ? rawHost[0] : rawHost) || "";
+    const forwardedProto = headers["x-forwarded-proto"];
+    protocol = (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto) || (request?.socket?.encrypted ? "https" : "http");
+  }
   if (!host || !protocol)
     return void 0;
   try {
@@ -274,6 +287,7 @@ export function serverAuth(event) {
   }
   const authOptions = {
     ...userConfig,
+    ...userConfig.plugins ? { plugins: [...userConfig.plugins] } : {},
     ...rateLimit ? { rateLimit } : {},
     ...database ? { database } : {},
     secret: betterAuthSecret,

package/dist/runtime/types/augment.d.ts

@@ -7,6 +7,8 @@ export interface AuthUser {
     emailVerified: boolean;
     name: string;
     image?: string | null;
+    /** Whether the user has enabled two-factor authentication. */
+    twoFactorEnabled?: boolean;
 }
 export interface AuthSession {
     id: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nuxtjs/better-auth",
   "type": "module",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "description": "Nuxt module for Better Auth integration with NuxtHub, route protection, session management, and role-based access",
   "author": "onmax",
   "license": "MIT",
@@ -61,6 +61,7 @@
   "peerDependencies": {
     "@nuxt/test-utils": "^4.1.0",
     "@nuxthub/core": ">=0.10.5",
+    "auth": "1.7.12",
     "better-auth": ">=1.7.3 <2"
   },
   "peerDependenciesMeta": {
@@ -69,18 +70,20 @@
     },
     "@nuxthub/core": {
       "optional": true
+    },
+    "auth": {
+      "optional": true
     }
   },
   "dependencies": {
     "@nuxt/devtools-kit": "^3.4.1",
     "@nuxt/kit": "^4.6.0",
     "@types/node": "^24.13.3",
-    "auth": "1.7.7",
     "consola": "^3.4.2",
     "cookie-es": "^3.1.1",
     "defu": "^6.1.7",
     "get-port-please": "^3.2.0",
-    "h3": "^1.15.11",
+    "h3": "^2.0.0",
     "jiti": "^2.7.0",
     "nostics": "^1.2.0",
     "pathe": "^2.0.3",
@@ -94,7 +97,7 @@
     "@libsql/client": "^0.18.0",
     "@libsql/linux-x64-gnu": "0.5.29",
     "@nuxt/devtools": "^3.4.1",
-    "@nuxt/fonts": "0.14.0",
+    "@nuxt/fonts": "1.0.1",
     "@nuxt/module-builder": "^1.0.3",
     "@nuxt/schema": "^4.6.0",
     "@nuxt/test-utils": "^4.3.3",
@@ -102,25 +105,26 @@
     "@pinia/nuxt": "^1.0.2",
     "@types/better-sqlite3": "^9.6.0",
     "@vue/test-utils": "^2.4.6",
-    "better-auth": "1.7.7",
-    "better-call": "1.4.0",
+    "auth": "1.7.12",
+    "better-auth": "1.7.12",
+    "better-call": "1.4.4",
     "better-sqlite3": "^13.0.0",
     "drizzle-kit": "^0.31.10",
     "drizzle-orm": "^0.45.2",
     "eslint": "^10.8.1",
     "happy-dom": "^21.0.0",
-    "nitropack": "2.13.4",
+    "nitropack": "2.13.5",
     "nuxt": "^4.6.0",
     "pinia": "^4.0.3",
-    "pkg-pr-new": "0.0.88",
-    "playwright-core": "1.63.0",
+    "pkg-pr-new": "0.0.91",
+    "playwright-core": "1.64.1",
     "postgres": "^3.4.9",
     "typescript": "~5.9.3",
     "unstorage": "^1.17.5",
     "vitest": "^5.0.0",
-    "vue": "3.5.43",
+    "vue": "3.5.44",
     "vue-tsc": "^3.3.10",
-    "wrangler": "4.147.0",
+    "wrangler": "4.151.3",
     "yaml": "^2.9.0"
   },
   "scripts": {