@nuxtjs/better-auth 0.3.6 → 0.3.8

package/dist/module.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxtjs/better-auth",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "configKey": "auth",
   "compatibility": {
     "nuxt": ">=4.0.0"

package/dist/module.mjs

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { mkdir, writeFile } from 'node:fs/promises';
-import { getLayerDirectories, updateTemplates, addServerImports, addServerHandler, addImports, addPlugin, addComponentsDir, addRouteMiddleware, extendPages, addTemplate, hasNuxtModule, addTypeTemplate, defineNuxtModule, createResolver } from '@nuxt/kit';
+import { getLayerDirectories, resolveServerVariant, hasNuxtCompatibility, updateTemplates, addServerImports, addServerHandler, addNitroPlugin, addImports, addPlugin, addComponentsDir, addRouteMiddleware, extendPages, addTemplate, hasNuxtModule, addTypeTemplate, defineNuxtModule, createResolver, getNitroVersion } from '@nuxt/kit';
 import { consola as consola$1 } from 'consola';
 import { defineDiagnostics, Diagnostic, formatDiagnostic } from 'nostics';
 import { isAbsolute, join, resolve, relative, dirname } from 'pathe';
@@ -13,7 +13,7 @@ import { isCI, isTest } from 'std-env';
 import { isInternalAssetPath } from '../dist/runtime/internal/auth-route-rules.js';
 export { defineClientAuth, defineServerAuth } from '../dist/runtime/config.js';
 
-const version = "0.3.6";
+const version = "0.3.8";
 
 const CONFIG_EXTENSIONS = [".ts", ".js", ".mts", ".cts", ".mjs", ".cjs"];
 const CONFIG_EXTENSION_RE = /\.[cm]?[jt]s$/;
@@ -198,13 +198,26 @@ function resolveNitro3RouteRulesTarget(nuxtRootDir) {
     return fallback;
   }
 }
-function resolveNitroCompatibilityImports(nuxtVersion) {
-  const major = Number.parseInt(nuxtVersion, 10);
-  const nitroV3 = Number.isFinite(major) && major >= 5;
-  return {
-    h3: nitroV3 ? "nitro/h3" : "h3",
-    runtime: nitroV3 ? "nitro3" : "nitro2"
-  };
+function resolveServerRuntimeShim(resolve) {
+  const nitro2 = resolve("./runtime/server/internal/nitro2");
+  return resolveServerVariant({
+    nuxt: resolve("./runtime/server/internal/portable"),
+    nitro2
+  }) ?? nitro2;
+}
+function resolveH3TypesPath(nitroMajor) {
+  return nitroMajor === 3 ? "nitro/h3" : "h3";
+}
+async function resolveAppSecretShim(resolve) {
+  const canDeriveAppSecret = await hasNuxtCompatibility({ nuxt: ">=4.6.0-0" });
+  return resolve(`./runtime/server/internal/${canDeriveAppSecret ? "app-secret" : "app-secret-unavailable"}`);
+}
+async function resolveAuthSecretPlugin(resolve) {
+  if (!await hasNuxtCompatibility({ nuxt: ">=4.6.0-0" }))
+    return;
+  if (!resolveServerVariant({ nitro2: true, nitro3: true, nuxt: false }))
+    return;
+  return resolve("./runtime/server/plugins/auth-secret");
 }
 
 function configFilename(file) {
@@ -286,15 +299,18 @@ function registerTemplateHmrHook(nuxt) {
   });
 }
 function registerServerRuntime(input) {
-  const { clientOnly, resolve } = input;
+  const { authSecretPlugin, clientOnly, resolve } = input;
   if (!clientOnly) {
     addServerImports([
       { name: "defineServerAuth", from: resolve("./runtime/config") },
       { name: "serverAuth", from: resolve("./runtime/server/utils/auth") },
+      { name: "ensureServerAuth", from: resolve("./runtime/server/utils/auth") },
       ...["getRequestSession", "getUserSession", "setRequestSession", "refreshSessionCookieCache", "setSessionCookie", "createSession", "requireUserSession"].map((name) => ({ name, from: resolve("./runtime/server/utils/session") }))
     ]);
     addServerHandler({ middleware: true, handler: resolve("./runtime/server/middleware/route-access") });
     addServerHandler({ route: "/api/auth/**", handler: resolve("./runtime/server/api/auth/[...all]") });
+    if (authSecretPlugin)
+      addNitroPlugin({ nitro2: authSecretPlugin, nitro3: authSecretPlugin });
   }
   addImports([
     "runWithSessionRefresh",
@@ -607,6 +623,18 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, h
     const hubCasing = getHubCasing(hub);
     const schemaOptions = { ...options.schema, useUuid: userConfig.advanced?.database?.generateId === "uuid", casing: options.schema?.casing ?? hubCasing };
     const schemaCode = await generateDrizzleSchema(authOptions, dialect, schemaOptions);
+    const { getAuthTables } = await import('better-auth/db');
+    const { initGetModelName } = await import('better-auth/adapters');
+    const authTables = getAuthTables(authOptions);
+    const getModelName = initGetModelName({
+      schema: authTables,
+      usePlural: schemaOptions.usePlural ?? false
+    });
+    const modelNames = {};
+    for (const name of ["user", "session", "account", "verification"]) {
+      if (authTables[name])
+        modelNames[name] = getModelName(name);
+    }
     const schemaDir = join(nuxt.options.buildDir, "better-auth");
     const schemaPathTs = join(schemaDir, `schema.${dialect}.ts`);
     const schemaPathMjs = join(schemaDir, `schema.${dialect}.mjs`);
@@ -622,6 +650,7 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, h
     addTemplate({ filename: `better-auth/schema.${dialect}.ts`, getContents: () => schemaCode, write: true });
     addTemplate({ filename: `better-auth/schema.${dialect}.mjs`, getContents: () => schemaCode, write: true });
     consola.info(`Generated ${dialect} schema (.ts + .mjs)`);
+    return modelNames;
   } catch (error) {
     throw error instanceof Diagnostic ? error : diagnostics.NUXT_AUTH_SCHEMA_GENERATION_FAILED({ cause: error });
   }
@@ -630,45 +659,62 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, h
 const DEFAULT_SECRET_ENV = "NUXT_BETTER_AUTH_SECRET";
 const FALLBACK_SECRET_ENV = "BETTER_AUTH_SECRET";
 const VERSIONED_SECRET_ENV = "BETTER_AUTH_SECRETS";
+const APP_SECRET_ENV = "NUXT_APP_SECRET";
 const generateSecret = () => randomBytes(32).toString("hex");
 function readEnvFile(rootDir) {
   const envPath = join(rootDir, ".env");
   return existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
 }
-function hasEnvSecret(rootDir) {
+function hasEnvSecret(rootDir, names) {
   const envFile = readEnvFile(rootDir);
-  return [DEFAULT_SECRET_ENV, FALLBACK_SECRET_ENV, VERSIONED_SECRET_ENV].some((name) => {
+  return names.some((name) => {
     const match = envFile.match(new RegExp(`^${name}=(.+)$`, "m"));
     return !!match && !!match[1] && match[1].trim().length > 0;
   });
 }
-function appendSecretToEnv(rootDir, secret) {
+function appendSecretToEnv(rootDir, name, secret) {
   const envPath = join(rootDir, ".env");
   let content = readEnvFile(rootDir);
   if (content.length > 0 && !content.endsWith("\n"))
     content += "\n";
-  content += `${DEFAULT_SECRET_ENV}=${secret}
+  content += `${name}=${secret}
 `;
   writeFileSync(envPath, content, "utf-8");
 }
+function getSecretEnvName(appSecret) {
+  return appSecret ? APP_SECRET_ENV : DEFAULT_SECRET_ENV;
+}
+function applyPromptedAppSecret(secret) {
+  process.env[APP_SECRET_ENV] = secret;
+  delete process.env.NUXT_APP_SECRET_GENERATED;
+}
 async function promptForSecret(rootDir, consola, options = {}) {
   const configuredSecret = options.configuredSecret?.trim();
   if (configuredSecret)
     return void 0;
-  if (process.env.NUXT_BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRETS || hasEnvSecret(rootDir))
+  if (process.env.NUXT_BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRET || process.env.BETTER_AUTH_SECRETS)
+    return void 0;
+  const secretEnvNames = [DEFAULT_SECRET_ENV, FALLBACK_SECRET_ENV, VERSIONED_SECRET_ENV];
+  if (options.appSecret)
+    secretEnvNames.push(APP_SECRET_ENV);
+  if (hasEnvSecret(rootDir, secretEnvNames))
+    return void 0;
+  const generatedAppSecret = process.env.NUXT_APP_SECRET_GENERATED === "1";
+  if (options.appSecret && !generatedAppSecret && (process.env.NUXT_APP_SECRET || options.configuredAppSecret?.trim()))
     return void 0;
   const hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
   if (options.prepare || !hasTty) {
-    consola.warn("[nuxt-better-auth] Skipping auth secret prompt (non-interactive). Set NUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET, or BETTER_AUTH_SECRETS.");
+    consola.warn(options.appSecret ? "[nuxt-better-auth] Skipping auth secret prompt (non-interactive). Set NUXT_APP_SECRET, or NUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET, or BETTER_AUTH_SECRETS." : "[nuxt-better-auth] Skipping auth secret prompt (non-interactive). Set NUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET, or BETTER_AUTH_SECRETS.");
     return void 0;
   }
+  const envName = getSecretEnvName(options.appSecret);
   if (isCI || isTest) {
     const secret2 = generateSecret();
-    appendSecretToEnv(rootDir, secret2);
-    consola.info("Generated NUXT_BETTER_AUTH_SECRET and added to .env (CI/test mode)");
+    appendSecretToEnv(rootDir, envName, secret2);
+    consola.info(`Generated ${envName} and added to .env (CI/test mode)`);
     return secret2;
   }
-  consola.box("An auth secret is required for authentication.\nThis will add NUXT_BETTER_AUTH_SECRET to your .env file.\nBETTER_AUTH_SECRET and BETTER_AUTH_SECRETS are also supported.");
+  consola.box(options.appSecret ? "An auth secret is required for authentication.\nThis will add NUXT_APP_SECRET to your .env file. The auth secret is derived from it.\nNUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET and BETTER_AUTH_SECRETS are also supported." : "An auth secret is required for authentication.\nThis will add NUXT_BETTER_AUTH_SECRET to your .env file.\nBETTER_AUTH_SECRET and BETTER_AUTH_SECRETS are also supported.");
   const choice = await consola.prompt("How do you want to set it?", {
     type: "select",
     options: [
@@ -695,14 +741,14 @@ async function promptForSecret(rootDir, consola, options = {}) {
   }
   const preview = `${secret.slice(0, 8)}...${secret.slice(-4)}`;
   const confirm = await consola.prompt(`Add to .env:
-${DEFAULT_SECRET_ENV}=${preview}
+${envName}=${preview}
 Proceed?`, { type: "confirm", initial: true, cancel: "null" });
   if (typeof confirm === "symbol" || !confirm) {
     consola.info("Cancelled. Secret not written.");
     return void 0;
   }
-  appendSecretToEnv(rootDir, secret);
-  consola.success("Added NUXT_BETTER_AUTH_SECRET to .env");
+  appendSecretToEnv(rootDir, envName, secret);
+  consola.success(`Added ${envName} to .env`);
   return secret;
 }
 
@@ -755,7 +801,7 @@ function setupRuntimeConfig(input) {
   if (clientOnly) {
     const siteUrl = nuxt.options.runtimeConfig.public.siteUrl;
     if (!siteUrl)
-      consola.warn("clientOnly mode: set runtimeConfig.public.siteUrl (or NUXT_PUBLIC_SITE_URL) to your frontend URL");
+      consola.warn("clientOnly mode: set runtimeConfig.public.siteUrl (or NUXT_PUBLIC_SITE_URL) to your auth backend URL, or set baseURL in defineClientAuth()");
     consola.info("clientOnly mode enabled - server utilities (serverAuth, getRequestSession, getUserSession, requireUserSession) are not available");
     return { secondaryStorageEnabled };
   }
@@ -914,7 +960,7 @@ export { db }`;
   return `export function createDatabase() { return undefined }
 export const db = undefined`;
 }
-function buildSchemaExportCode(hasHubDb, hubDialect) {
+function buildSchemaExportCode(hasHubDb, hubDialect, modelNames = {}) {
   if (!hasHubDb) {
     return `export const user = undefined
 export const session = undefined
@@ -927,14 +973,14 @@ export const schema = undefined
 import * as generatedSchema from './schema.${hubDialect}.mjs'
 
 const getGeneratedTable = name => generatedSchema[name] ?? generatedSchema[\`\${name}s\`]
-export const user = getGeneratedTable('user')
-export const session = getGeneratedTable('session')
-export const account = getGeneratedTable('account')
-export const verification = getGeneratedTable('verification')
+export const user = getGeneratedTable(${JSON.stringify(modelNames.user ?? "user")})
+export const session = getGeneratedTable(${JSON.stringify(modelNames.session ?? "session")})
+export const account = getGeneratedTable(${JSON.stringify(modelNames.account ?? "account")})
+export const verification = getGeneratedTable(${JSON.stringify(modelNames.verification ?? "verification")})
 export const schema = { ...generatedSchema, user, session, account, verification }
 `;
 }
-function buildSchemaExportTypes(hasHubDb, hubDialect) {
+function buildSchemaExportTypes(hasHubDb, hubDialect, modelNames = {}) {
   if (!hasHubDb) {
     return `export declare const user: undefined
 export declare const session: undefined
@@ -952,10 +998,10 @@ type GeneratedTable<Name extends string> = Name extends keyof GeneratedSchema
     ? GeneratedSchema[\`\${Name}s\`]
     : undefined
 
-export declare const user: GeneratedTable<'user'>
-export declare const session: GeneratedTable<'session'>
-export declare const account: GeneratedTable<'account'>
-export declare const verification: GeneratedTable<'verification'>
+export declare const user: GeneratedTable<${JSON.stringify(modelNames.user ?? "user")}>
+export declare const session: GeneratedTable<${JSON.stringify(modelNames.session ?? "session")}>
+export declare const account: GeneratedTable<${JSON.stringify(modelNames.account ?? "account")}>
+export declare const verification: GeneratedTable<${JSON.stringify(modelNames.verification ?? "verification")}>
 export declare const schema: GeneratedSchema & {
   user: typeof user
   session: typeof session
@@ -1632,16 +1678,25 @@ const module$1 = defineNuxtModule({
   },
   async onInstall(nuxt) {
     const configuredSecret = nuxt.options.runtimeConfig?.betterAuthSecret;
-    const generatedSecret = await promptForSecret(nuxt.options.rootDir, consola, { configuredSecret, prepare: Boolean(nuxt.options._prepare) });
-    if (generatedSecret)
+    const appSecret = await hasNuxtCompatibility({ nuxt: ">=4.6.0-0" }, nuxt);
+    const generatedSecret = await promptForSecret(nuxt.options.rootDir, consola, {
+      configuredSecret,
+      prepare: Boolean(nuxt.options._prepare),
+      appSecret,
+      configuredAppSecret: nuxt.options.runtimeConfig?.appSecret
+    });
+    if (generatedSecret && appSecret)
+      applyPromptedAppSecret(generatedSecret);
+    else if (generatedSecret)
       process.env.NUXT_BETTER_AUTH_SECRET = generatedSecret;
     await createDefaultAuthConfigFiles(nuxt);
   },
   setup(options, nuxt) {
     const finishSetup = async () => {
       const resolver = createResolver(import.meta.url);
-      const nitroImports = resolveNitroCompatibilityImports(nuxt._version);
-      nuxt.options.alias["#better-auth/nitro-compat"] = resolver.resolve(`./runtime/server/internal/${nitroImports.runtime}`);
+      const h3TypesPath = resolveH3TypesPath(getNitroVersion(nuxt));
+      nuxt.options.alias["#better-auth/nitro-compat"] = resolveServerRuntimeShim(resolver.resolve);
+      nuxt.options.alias["#better-auth/app-secret"] = await resolveAppSecretShim(resolver.resolve);
       const registeredPluginSources = {};
       await nuxt.callHook("better-auth:plugins:extend", registeredPluginSources);
       for (const source of [...registeredPluginSources.server || [], ...registeredPluginSources.client || []]) {
@@ -1657,6 +1712,7 @@ const module$1 = defineNuxtModule({
       });
       let serverConfigPath = setup.aliases["#auth/server"];
       let clientConfigPath = setup.aliases["#auth/client"];
+      let schemaModelNames;
       if (serverConfigPath && setup.pluginSources.server.length) {
         const serverConfigCode = buildExtendedServerAuthCode(setup.configs.server.path, setup.pluginSources.server);
         serverConfigPath = addTemplate({
@@ -1686,13 +1742,13 @@ const module$1 = defineNuxtModule({
         nuxt.options.alias["#auth/database"] = databaseTemplate.dst;
         const schemaTemplate = addTemplate({
           filename: "better-auth/schema.mjs",
-          getContents: () => buildSchemaExportCode(setup.database.hasHubDb, setup.database.buildContext?.hubDialect ?? "sqlite"),
+          getContents: () => buildSchemaExportCode(setup.database.hasHubDb, setup.database.buildContext?.hubDialect ?? "sqlite", schemaModelNames),
           write: true
         });
         nuxt.options.alias["#auth/schema"] = schemaTemplate.dst;
         addTemplate({
           filename: "better-auth/schema.d.ts",
-          getContents: () => buildSchemaExportTypes(setup.database.hasHubDb, setup.database.buildContext?.hubDialect ?? "sqlite"),
+          getContents: () => buildSchemaExportTypes(setup.database.hasHubDb, setup.database.buildContext?.hubDialect ?? "sqlite", schemaModelNames),
           write: true
         });
         if (setup.schemaGeneration)
@@ -1726,14 +1782,14 @@ const module$1 = defineNuxtModule({
           hasHubDb: setup.serverTypes.hasHubDb,
           runtimeTypesPath: resolver.resolve("./runtime/types"),
           sharedServerConfigSafe: [setup.configs.server.path, ...setup.pluginSources.server].every(isServerConfigSharedTypeSafe),
-          h3TypesPath: nitroImports.h3,
-          nitro3RouteRulesTarget: nitroImports.runtime === "nitro3" ? resolveNitro3RouteRulesTarget(nuxt.options.rootDir) : void 0
+          h3TypesPath,
+          nitro3RouteRulesTarget: h3TypesPath === "nitro/h3" ? resolveNitro3RouteRulesTarget(nuxt.options.rootDir) : void 0
         });
       }
       if (setup.schemaGeneration) {
         if (setup.schemaGeneration.externalizeNuxtHubDatabase)
           registerNuxtHubDatabaseExternalHook(nuxt);
-        await setupBetterAuthSchema(
+        schemaModelNames = await setupBetterAuthSchema(
           nuxt,
           serverConfigPath,
           options,
@@ -1745,11 +1801,15 @@ const module$1 = defineNuxtModule({
         runtimeTypesAugmentPath: setup.sharedTypes.runtimeTypesAugmentPath,
         runtimeTypesPath: resolver.resolve("./runtime/types"),
         clientConfigPath,
-        h3TypesPath: nitroImports.h3,
+        h3TypesPath,
         clientOnly: setup.clientOnly
       });
       registerTemplateHmrHook(nuxt);
-      registerServerRuntime({ clientOnly: setup.clientOnly, resolve: resolver.resolve });
+      registerServerRuntime({
+        clientOnly: setup.clientOnly,
+        resolve: resolver.resolve,
+        authSecretPlugin: setup.clientOnly ? void 0 : await resolveAuthSecretPlugin(resolver.resolve)
+      });
       registerAuthMiddleware(resolver.resolve);
       await registerDevtools({ nuxt, clientOnly: setup.clientOnly, hasHubDb: setup.database.hasHubDb, resolve: resolver.resolve });
       registerRouteRulesMetaHook(nuxt);

package/dist/runtime/app/composables/useAuthRequestFetch.js

@@ -11,14 +11,30 @@ export function useAuthRequestFetch() {
   const clientOptions = createAppAuthClient.resolveOptions(siteUrl);
   const configuredBaseURL = clientOptions.baseURL ?? siteUrl;
   const baseURL = configuredBaseURL && new URL(configuredBaseURL).pathname.replace(/\/+$/, "") ? configuredBaseURL : joinURL(configuredBaseURL || "/", clientOptions.basePath ?? "/api/auth");
-  const externalRequestFetch = requestFetch;
-  return ((request, opts) => {
-    if (typeof request !== "string" || !/^\/api\/auth(?=\/|$)/.test(request))
-      return externalRequestFetch(request, opts);
-    return externalRequestFetch(request.slice("/api/auth".length), {
-      ...opts,
-      baseURL,
-      credentials: "include"
+  function wrapRequestFetch(fetch) {
+    const methods = /* @__PURE__ */ new Map();
+    return new Proxy(fetch, {
+      apply(target, thisArg, args) {
+        const [request, opts] = args;
+        if (typeof request !== "string" || !/^\/api\/auth(?=\/|$)/.test(request))
+          return Reflect.apply(target, thisArg, args);
+        return Reflect.apply(target, thisArg, [request.slice("/api/auth".length), {
+          ...opts,
+          baseURL,
+          credentials: "include"
+        }]);
+      },
+      get(target, prop, receiver) {
+        if (methods.has(prop))
+          return methods.get(prop);
+        const value = Reflect.get(target, prop, receiver);
+        if (typeof value !== "function" || prop !== "raw" && prop !== "create")
+          return value;
+        const method = prop === "raw" ? wrapRequestFetch(value) : (...args) => wrapRequestFetch(Reflect.apply(value, target, args));
+        methods.set(prop, method);
+        return method;
+      }
     });
-  });
+  }
+  return wrapRequestFetch(requestFetch);
 }

package/dist/runtime/app/composables/useUserSession.js

@@ -74,6 +74,7 @@ export function useUserSession() {
       return;
     const previousUser = user.value;
     user.value = { ...user.value, ...updates };
+    const optimisticUser = user.value;
     if (!rawClient)
       return;
     try {
@@ -86,7 +87,8 @@ export function useUserSession() {
         throw new Error(normalizedError.message);
       }
     } catch (error) {
-      user.value = previousUser;
+      if (user.value === optimisticUser)
+        user.value = previousUser;
       if (!(error instanceof Error)) {
         const normalizedError = normalizeAuthActionError(error);
         throw new Error(normalizedError.message);

package/dist/runtime/app/middleware/auth.global.js

@@ -1,5 +1,6 @@
 import { defu } from "defu";
 import { createRouter, toRouteMatcher } from "radix3";
+import { parsePath, parseQuery } from "ufo";
 import { createError, defineNuxtRouteMiddleware, getRouteRules, navigateTo, useNuxtApp, useRequestHeaders, useRuntimeConfig } from "#imports";
 import { shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
 import { matchesUser } from "../../utils/match-user.js";
@@ -64,11 +65,11 @@ function resolveLoginRedirect(input) {
     return { to: loginTarget, external: false };
   if (!loginTarget.startsWith("/") || loginTarget.startsWith("//"))
     return { to: loginTarget, external: false };
-  const [beforeHash, hash = ""] = loginTarget.split("#", 2);
-  const [path, query = ""] = beforeHash.split("?", 2);
+  const { pathname: path, search, hash } = parsePath(loginTarget);
+  const query = search.slice(1);
   try {
-    const params2 = new URLSearchParams(query);
-    if (params2.has(redirectQueryKey))
+    const params = new URLSearchParams(query);
+    if (params.has(redirectQueryKey))
       return { to: loginTarget, external: false };
   } catch {
     return { to: loginTarget, external: false };
@@ -76,15 +77,13 @@ function resolveLoginRedirect(input) {
   if (import.meta.server) {
     const separator = query ? "&" : "";
     const encodedRedirect = encodeURIComponent(route.fullPath);
-    const url = `${path}?${query}${separator}${redirectQueryKey}=${encodedRedirect}${hash ? `#${hash}` : ""}`;
+    const encodedKey = encodeURIComponent(redirectQueryKey);
+    const url = `${path}?${query}${separator}${encodedKey}=${encodedRedirect}${hash}`;
     return { to: url, external: true };
   }
-  const params = new URLSearchParams(query);
-  const queryObj = {};
-  for (const [k, v] of params.entries())
-    queryObj[k] = v;
+  const queryObj = parseQuery(query);
   queryObj[redirectQueryKey] = route.fullPath;
-  return { to: { path, query: queryObj, ...hash ? { hash: `#${hash}` } : {} }, external: false };
+  return { to: { path, query: queryObj, ...hash ? { hash } : {} }, external: false };
 }
 async function getAuthRouteRules() {
   if (!authRouteRulesPromise) {

package/dist/runtime/server/api/_better-auth/accounts.get.js

@@ -21,7 +21,14 @@ export default defineEventHandler(async (event) => {
       dbQuery.orderBy(desc(schema.account.createdAt)).limit(limit).offset(offset),
       countQuery
     ]);
-    return { accounts, total: totalResult[0]?.count ?? 0, page, limit };
+    const safeAccounts = accounts.map((account) => ({
+      id: account.id,
+      userId: account.userId,
+      providerId: account.providerId,
+      accountId: account.accountId,
+      createdAt: account.createdAt
+    }));
+    return { accounts: safeAccounts, total: totalResult[0]?.count ?? 0, page, limit };
   } catch (error) {
     console.error("[DevTools] Fetch accounts failed:", error);
     return { accounts: [], total: 0, error: "Failed to fetch accounts" };

package/dist/runtime/server/api/auth/[...all].js

@@ -1,6 +1,8 @@
+import { prepareAuthSecret } from "../../internal/auth-secret.js";
 import { defineEventHandler, toWebRequest } from "../../internal/nitro-compat.js";
 import { serverAuth } from "../../utils/auth.js";
 export default defineEventHandler(async (event) => {
+  await prepareAuthSecret();
   const auth = serverAuth(event);
   return auth.handler(toWebRequest(event));
 });

package/dist/runtime/server/internal/app-secret-compat.d.ts

@@ -0,0 +1 @@
+export * from '#better-auth/app-secret';

package/dist/runtime/server/internal/app-secret-compat.js

@@ -0,0 +1 @@
+export * from "#better-auth/app-secret";

package/dist/runtime/server/internal/app-secret-unavailable.d.ts

@@ -0,0 +1,2 @@
+/** Nuxt < 4.6 has no `appSecret` to derive the Better Auth secret from. */
+export declare const deriveAuthSecret: (() => Promise<string>) | undefined;

package/dist/runtime/server/internal/app-secret-unavailable.js

@@ -0,0 +1 @@
+export const deriveAuthSecret = void 0;

package/dist/runtime/server/internal/app-secret.d.ts

@@ -0,0 +1,4 @@
+/** The `deriveSecret()` purpose for the Better Auth secret. Changing it rotates every derived secret. */
+export declare const AUTH_SECRET_PURPOSE = "better-auth:secret";
+/** Derives the Better Auth secret from Nuxt's `appSecret` (`NUXT_APP_SECRET`), on Nuxt 4.6+. */
+export declare const deriveAuthSecret: (() => Promise<string>) | undefined;

package/dist/runtime/server/internal/app-secret.js

@@ -0,0 +1,3 @@
+import { deriveSecret } from "nuxt/server";
+export const AUTH_SECRET_PURPOSE = "better-auth:secret";
+export const deriveAuthSecret = () => deriveSecret(AUTH_SECRET_PURPOSE);

package/dist/runtime/server/internal/auth-secret.d.ts

@@ -0,0 +1,25 @@
+/** The singular secret configured for the module: runtime config (`NUXT_BETTER_AUTH_SECRET`) or `BETTER_AUTH_SECRET`. */
+export declare function getConfiguredAuthSecret(runtimeConfig: object): string;
+/** Whether a secret source that predates `appSecret` derivation is configured. These always win. */
+export declare function hasExplicitAuthSecret(runtimeConfig: object): boolean;
+/**
+ * Whether the auth secret is derived from `appSecret`: Nuxt provides `deriveSecret()` (4.6+) and
+ * the `appSecret` is the user's. In development Nuxt generates an `appSecret` when none is set
+ * (`NUXT_APP_SECRET_GENERATED`); deriving from that would replace Better Auth's development
+ * default secret and sign out existing development sessions, so the default is kept.
+ */
+export declare function canDeriveAuthSecret(): boolean;
+/**
+ * Derives the Better Auth secret from Nuxt's `appSecret` once per server process, when no auth
+ * secret is configured and the `appSecret` is the user's (see `canDeriveAuthSecret`).
+ * `serverAuth()` is synchronous, so request entry points and the startup plugin start this, and
+ * the request entry points await it before they create the auth instance.
+ */
+export declare function prepareAuthSecret(): Promise<void> | undefined;
+export interface DerivedAuthSecretState {
+    /** The secret is derived from the user's `appSecret` (Nuxt 4.6+). */
+    available: boolean;
+    secret?: string;
+    error?: unknown;
+}
+export declare function getDerivedAuthSecret(): DerivedAuthSecretState;

package/dist/runtime/server/internal/auth-secret.js

@@ -0,0 +1,40 @@
+import { env } from "better-auth";
+import { deriveAuthSecret } from "./app-secret-compat.js";
+import { useRuntimeConfig } from "./nitro-compat.js";
+let derivedSecret;
+let derivedSecretPromise;
+let derivedSecretError;
+export function getConfiguredAuthSecret(runtimeConfig) {
+  const secret = runtimeConfig.betterAuthSecret;
+  return typeof secret === "string" && secret || env.BETTER_AUTH_SECRET || "";
+}
+export function hasExplicitAuthSecret(runtimeConfig) {
+  return Boolean(getConfiguredAuthSecret(runtimeConfig) || env.BETTER_AUTH_SECRETS || env.AUTH_SECRET);
+}
+export function canDeriveAuthSecret() {
+  if (!deriveAuthSecret)
+    return false;
+  return !(import.meta.dev && globalThis.process?.env?.NUXT_APP_SECRET_GENERATED === "1");
+}
+export function prepareAuthSecret() {
+  if (derivedSecret !== void 0 || derivedSecretError !== void 0 || !canDeriveAuthSecret())
+    return;
+  if (hasExplicitAuthSecret(useRuntimeConfig()))
+    return;
+  derivedSecretPromise ||= deriveAuthSecret().then(
+    (secret) => {
+      derivedSecret = secret;
+    },
+    (error) => {
+      derivedSecretError = error ?? new Error("deriveSecret failed");
+    }
+  );
+  return derivedSecretPromise;
+}
+export function getDerivedAuthSecret() {
+  return {
+    available: canDeriveAuthSecret(),
+    secret: derivedSecret,
+    error: derivedSecretError
+  };
+}

package/dist/runtime/server/internal/cookie-headers.d.ts

@@ -1,3 +1,4 @@
 import type { ServerEvent } from './nitro-compat.js';
 export declare function appendCookieHeader(event: ServerEvent, header: string): void;
+export declare function getSetCookieHeaders(headers: Headers): string[];
 export declare function appendSetCookieHeaders(event: ServerEvent, headers: Headers): void;

package/dist/runtime/server/internal/cookie-headers.js

@@ -14,7 +14,7 @@ export function appendCookieHeader(event, header) {
   const responseHeaders = eventWithResponse.res?.headers ?? eventWithResponse.response?.headers;
   responseHeaders?.append("set-cookie", header);
 }
-function getSetCookieHeaders(headers) {
+export function getSetCookieHeaders(headers) {
   const cookieHeaders = headers;
   const getSetCookie = cookieHeaders.getSetCookie;
   if (getSetCookie)

package/dist/runtime/server/internal/{nitro3.d.ts → portable.d.ts}

@@ -1,10 +1,9 @@
-import type { H3Event } from 'nitro/h3';
+import type { RequestEvent } from 'nuxt/server';
 import type { AuthRouteRules } from '../../types.js';
 import { splitSetCookieString } from 'cookie-es';
-import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody } from 'nitro/h3';
-import { useRuntimeConfig } from 'nitro/runtime-config';
+import { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, useRuntimeConfig } from 'nuxt/server';
 export { defineEventHandler, getQuery, getRequestHost, getRequestProtocol, getRequestURL, readBody, useRuntimeConfig, };
-export type ServerEvent = H3Event;
+export type ServerEvent = RequestEvent;
 export { splitSetCookieString as splitCookiesString };
 export declare function getAuthRouteRules(event: ServerEvent): AuthRouteRules;
 export declare function createAuthError(status: number, statusText: string): Error;

package/dist/runtime/server/internal/{nitro3.js → portable.js}

@@ -1,15 +1,15 @@
 import { splitSetCookieString } from "cookie-es";
-import { getRouteRules } from "nitro/app";
 import {
+  createError,
   defineEventHandler,
   getQuery,
   getRequestHost,
   getRequestProtocol,
   getRequestURL,
-  HTTPError,
-  readBody
-} from "nitro/h3";
-import { useRuntimeConfig } from "nitro/runtime-config";
+  getRouteRules,
+  readBody,
+  useRuntimeConfig
+} from "nuxt/server";
 import { normalizeAuthRouteRule } from "../../internal/auth-route-rules.js";
 export {
   defineEventHandler,
@@ -22,11 +22,11 @@ export {
 };
 export { splitSetCookieString as splitCookiesString };
 export function getAuthRouteRules(event) {
-  const auth = getRouteRules(event.req.method, getRequestURL(event).pathname).routeRules?.auth;
-  return { auth: normalizeAuthRouteRule(auth) };
+  const rules = getRouteRules(event);
+  return { auth: normalizeAuthRouteRule(rules.auth) };
 }
 export function createAuthError(status, statusText) {
-  return HTTPError.status(status, statusText);
+  return createError({ status, statusText });
 }
 export function toWebRequest(event) {
   return event.req;

package/dist/runtime/server/middleware/route-access.js

@@ -1,8 +1,10 @@
 import { normalizeAuthRoutePath, shouldSkipAuthRouteRules } from "../../internal/auth-route-rules.js";
 import { matchesUser } from "../../utils/match-user.js";
+import { prepareAuthSecret } from "../internal/auth-secret.js";
 import { createAuthError, defineEventHandler, getAuthRouteRules, getRequestURL, useRuntimeConfig } from "../internal/nitro-compat.js";
 import { getUserSession, requireUserSession } from "../utils/session.js";
 export default defineEventHandler(async (event) => {
+  await prepareAuthSecret();
   const path = normalizeAuthRoutePath(
     getRequestURL(event).pathname,
     useRuntimeConfig().app?.baseURL

package/dist/runtime/server/plugins/auth-secret.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Starts deriving the auth secret from Nuxt's `appSecret` when the server starts, so a
+ * `serverAuth()` call made before the first request, such as from a task, can use it.
+ * Nitro does not await plugins: startup code that needs the secret right away awaits
+ * `ensureServerAuth()` instead.
+ */
+export default function authSecretPlugin(): void;

package/dist/runtime/server/plugins/auth-secret.js

@@ -0,0 +1,4 @@
+import { prepareAuthSecret } from "../internal/auth-secret.js";
+export default function authSecretPlugin() {
+  void prepareAuthSecret();
+}

package/dist/runtime/server/tsconfig.json

@@ -4,6 +4,7 @@
     "module": "ESNext",
     "moduleResolution": "bundler",
     "paths": {
+      "#better-auth/app-secret": ["./internal/app-secret"],
       "#better-auth/nitro-compat": ["./internal/nitro2"],
       "#nuxt-better-auth": ["../types/augment"]
     },

package/dist/runtime/server/utils/auth.d.ts

@@ -16,6 +16,12 @@ type ResolvedAuthOptions = Omit<UserAuthConfig, 'secret' | 'baseURL' | 'trustedO
     database?: BetterAuthOptions['database'];
 };
 type AuthInstance = ReturnType<typeof betterAuth<ResolvedAuthOptions>>;
+/**
+ * Returns the Better Auth instance like `serverAuth()`, after waiting for the auth secret that
+ * Nuxt 4.6+ derives from `appSecret` (`NUXT_APP_SECRET`). Use it in code that can run before the
+ * first request, such as a Nitro plugin or task at server startup.
+ */
+export declare function ensureServerAuth(event?: ServerEvent): Promise<AuthInstance>;
 /** Returns Better Auth instance. Caches per resolved host (or single instance when siteUrl is explicit). */
 export declare function serverAuth(event?: ServerEvent): AuthInstance;
 export {};

package/dist/runtime/server/utils/auth.js

@@ -1,7 +1,7 @@
 import { betterAuth, env } from "better-auth";
-import { withoutProtocol } from "ufo";
 import { createDatabase, db } from "#auth/database";
 import createServerAuth from "#auth/server";
+import { getConfiguredAuthSecret, getDerivedAuthSecret, hasExplicitAuthSecret, prepareAuthSecret } from "../internal/auth-secret.js";
 import { getRequestHost, getRequestProtocol, useRuntimeConfig } from "../internal/nitro-compat.js";
 import { resolveAuthBaseURL } from "../../internal/auth-base-url.js";
 import { resolveCustomSecondaryStorageRequirement } from "./custom-secondary-storage.js";
@@ -11,6 +11,7 @@ let _baseURLInferenceLogged = false;
 let _customSecondaryStorageMisconfigWarned = false;
 let _unsupportedHubSecondaryStorageWarned = false;
 let _secondaryStorageRateLimitFallbackWarned = false;
+let _derivedSecretFallbackWarned = false;
 const fallbackRequestAuthContext = /* @__PURE__ */ new WeakMap();
 function getRequestAuthContext(event) {
   const eventWithContext = event;
@@ -83,33 +84,25 @@ function getNitroOrigin() {
   let port;
   if (import.meta.dev)
     port = process.env.NITRO_PORT || process.env.PORT || "3000";
-  let protocol = cert && key || !import.meta.dev ? "https" : "http";
+  const protocol = cert && key || !import.meta.dev ? "https" : "http";
   try {
     if ((import.meta.dev || import.meta.prerender) && process.env.__NUXT_DEV__) {
-      const origin = JSON.parse(process.env.__NUXT_DEV__).proxy.url;
-      host = withoutProtocol(origin);
-      protocol = origin.includes("https") ? "https" : "http";
+      const url = new URL(JSON.parse(process.env.__NUXT_DEV__).proxy.url);
+      if (url.protocol === "http:" || url.protocol === "https:")
+        return url.origin;
     } else if ((import.meta.dev || import.meta.prerender) && process.env.NUXT_VITE_NODE_OPTIONS) {
-      const origin = JSON.parse(process.env.NUXT_VITE_NODE_OPTIONS).baseURL.replace("/__nuxt_vite_node__", "");
-      host = withoutProtocol(origin);
-      protocol = origin.includes("https") ? "https" : "http";
+      const url = new URL(JSON.parse(process.env.NUXT_VITE_NODE_OPTIONS).baseURL);
+      if (url.protocol === "http:" || url.protocol === "https:")
+        return url.origin;
     }
   } catch {
   }
   if (!host)
     return void 0;
-  if (host.startsWith("[") && host.includes("]:")) {
-    const lastBracketColon = host.lastIndexOf("]:");
-    const extractedPort = host.slice(lastBracketColon + 2);
-    host = host.slice(0, lastBracketColon + 1);
-    if (extractedPort)
-      port = extractedPort;
-  } else if (host.includes(":") && !host.startsWith("[")) {
-    const hostParts = host.split(":");
-    port = hostParts.pop();
-    host = hostParts.join(":");
-  }
-  const portSuffix = port ? `:${port}` : "";
+  if (!host.startsWith("[") && host.indexOf(":") !== host.lastIndexOf(":"))
+    host = `[${host}]`;
+  const hasExplicitPort = host.startsWith("[") ? host.includes("]:") : host.includes(":");
+  const portSuffix = !hasExplicitPort && port ? `:${port}` : "";
   return `${protocol}://${host}${portSuffix}`;
 }
 function resolveEnvironmentOrigin() {
@@ -162,8 +155,7 @@ function getDevTrustedOrigins() {
   try {
     const url = new URL(nitroOrigin);
     const protocol = url.protocol === "https:" ? "https" : "http";
-    const port = url.port || "3000";
-    const localhostOrigin = `${protocol}://localhost:${port}`;
+    const localhostOrigin = `${protocol}://localhost${url.port ? `:${url.port}` : ""}`;
     return dedupeOrigins([localhostOrigin, url.origin]);
   } catch {
     return [fallbackOrigin];
@@ -203,17 +195,39 @@ function withDevTrustedOrigins(trustedOrigins) {
     return mergeOrigins([], request);
   };
 }
+function missingAuthSecretMessage(derived) {
+  const message = "[nuxt-better-auth] An auth secret is required in production. Set NUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET, BETTER_AUTH_SECRETS, or defineServerAuth({ secrets })";
+  if (!derived.available)
+    return `${message}.`;
+  if (derived.error !== void 0)
+    return `${message}, or set NUXT_APP_SECRET (at least 32 characters) to derive one from Nuxt's appSecret.`;
+  return `${message}. The secret derived from NUXT_APP_SECRET is resolved asynchronously, and serverAuth() was called before it was ready, outside a request. Use \`await ensureServerAuth()\` in code that runs at server startup.`;
+}
+function warnDerivedSecretFallback(derived) {
+  if (_derivedSecretFallbackWarned)
+    return;
+  _derivedSecretFallbackWarned = true;
+  const reason = derived.error !== void 0 ? "could not be derived from NUXT_APP_SECRET. Set NUXT_APP_SECRET (at least 32 characters) or NUXT_BETTER_AUTH_SECRET." : "derived from NUXT_APP_SECRET was not ready yet. Use `await ensureServerAuth()` in code that runs at server startup.";
+  console.warn(`[nuxt-better-auth] Better Auth's development default secret is used for this call: the auth secret ${reason}`);
+}
+export async function ensureServerAuth(event) {
+  await prepareAuthSecret();
+  return serverAuth(event);
+}
 export function serverAuth(event) {
   const runtimeConfig = useRuntimeConfig();
-  const betterAuthSecret = runtimeConfig.betterAuthSecret || env.BETTER_AUTH_SECRET || "";
-  if (betterAuthSecret && betterAuthSecret.length < 32)
+  const configuredSecret = getConfiguredAuthSecret(runtimeConfig);
+  if (configuredSecret && configuredSecret.length < 32)
     throw new Error("[nuxt-better-auth] Singular auth secret must be at least 32 characters for security");
+  const derived = getDerivedAuthSecret();
   const requestOrigin = resolveEventOrigin(event);
   let userConfig;
-  if (!import.meta.dev && !betterAuthSecret && !env.BETTER_AUTH_SECRETS) {
+  if (!import.meta.dev && !configuredSecret && !env.BETTER_AUTH_SECRETS && !derived.secret) {
     userConfig = createServerAuth({ runtimeConfig, db, requestOrigin });
-    if (userConfig.secrets === void 0)
-      throw new Error("[nuxt-better-auth] An auth secret is required in production. Set NUXT_BETTER_AUTH_SECRET, BETTER_AUTH_SECRET, BETTER_AUTH_SECRETS, or defineServerAuth({ secrets }).");
+    if (userConfig.secrets === void 0) {
+      void prepareAuthSecret();
+      throw new Error(missingAuthSecretMessage(derived));
+    }
   }
   const siteUrl = getBaseURL(event);
   const hasExplicitSiteUrl = runtimeConfig.public.siteUrl && typeof runtimeConfig.public.siteUrl === "string";
@@ -222,6 +236,13 @@ export function serverAuth(event) {
   if (requestContext?.[requestAuthKey])
     return requestContext[requestAuthKey];
   userConfig ??= createServerAuth({ runtimeConfig, db, requestOrigin });
+  const usesDerivedSecret = derived.available && userConfig.secrets === void 0 && !hasExplicitAuthSecret(runtimeConfig);
+  const derivedSecretMissing = usesDerivedSecret && !derived.secret;
+  if (derivedSecretMissing) {
+    void prepareAuthSecret();
+    warnDerivedSecretFallback(derived);
+  }
+  const betterAuthSecret = configuredSecret || (usesDerivedSecret ? derived.secret ?? "" : "");
   const database = createDatabase(event);
   const trustedOrigins = withDevTrustedOrigins(userConfig.trustedOrigins);
   const hubSecondaryStorage = runtimeConfig.auth?.hubSecondaryStorage;
@@ -242,7 +263,8 @@ export function serverAuth(event) {
     console.warn('[nuxt-better-auth] rateLimit.storage: "secondary-storage" requires secondaryStorage. Falling back to process-local memory. Set rateLimit.storage to "database" or provide rateLimit.customStorage for shared limits.');
   }
   const rateLimit = useMemoryRateLimit ? { ...userConfig.rateLimit, storage: "memory" } : userConfig.rateLimit;
-  if (!database) {
+  const cacheable = !database && !derivedSecretMissing;
+  if (cacheable) {
     const cached = _authCache.get(cacheKey);
     if (cached) {
       if (requestContext)
@@ -261,7 +283,7 @@ export function serverAuth(event) {
   const auth = betterAuth(authOptions);
   if (requestContext)
     requestContext[requestAuthKey] = auth;
-  if (!database)
+  if (cacheable)
     _authCache.set(cacheKey, auth);
   return auth;
 }

package/dist/runtime/server/utils/session.js

@@ -1,6 +1,7 @@
 import { matchesUser } from "../../utils/match-user.js";
 import { createAuthError } from "../internal/nitro-compat.js";
-import { appendCookieHeader, appendSetCookieHeaders } from "../internal/cookie-headers.js";
+import { prepareAuthSecret } from "../internal/auth-secret.js";
+import { appendCookieHeader, appendSetCookieHeaders, getSetCookieHeaders } from "../internal/cookie-headers.js";
 import { serverAuth } from "./auth.js";
 const requestSessionLoadKey = Symbol.for("nuxt-better-auth.requestSessionLoad");
 const requestSessionMutationKey = Symbol.for("nuxt-better-auth.requestSessionMutation");
@@ -26,6 +27,9 @@ function getRequestHeaders(event) {
   return getRequestSessionContext(event).requestHeaders ?? getIncomingRequestHeaders(event);
 }
 async function loadSession(event) {
+  const pendingSecret = prepareAuthSecret();
+  if (pendingSecret)
+    await pendingSecret;
   const auth = serverAuth(event);
   const result = await auth.api.getSession({
     headers: getRequestHeaders(event),
@@ -36,6 +40,9 @@ async function loadSession(event) {
   return { headers: new Headers(), response: result };
 }
 function loadFreshSession(event) {
+  const pendingSecret = prepareAuthSecret();
+  if (pendingSecret)
+    return pendingSecret.then(() => loadFreshSession(event));
   const auth = serverAuth(event);
   return auth.api.getSession({
     headers: getRequestHeaders(event),
@@ -44,6 +51,9 @@ function loadFreshSession(event) {
   });
 }
 function getServerAuthContext(event) {
+  const pendingSecret = prepareAuthSecret();
+  if (pendingSecret)
+    return pendingSecret.then(() => getServerAuthContext(event));
   const auth = serverAuth(event);
   return auth.$context;
 }
@@ -162,6 +172,30 @@ function expireCookies(event, cookie) {
   for (const cookieName of getChunkedCookieNames(event, cookie.name))
     expireCookie(event, cookieName, cookie.attributes);
 }
+function isCookieOrChunk(name, cookieName) {
+  if (name === cookieName)
+    return true;
+  if (!name.startsWith(`${cookieName}.`))
+    return false;
+  const suffix = name.slice(cookieName.length + 1);
+  const index = Number(suffix);
+  return Number.isSafeInteger(index) && index >= 0 && String(index) === suffix;
+}
+function expireUnrefreshedSessionCookieCache(event, headers, cookie) {
+  const cookieName = getCookieName(cookie.name, cookie.attributes.prefix);
+  if (!cookieName)
+    return;
+  const responseHandlesCache = getSetCookieHeaders(headers).some((header) => {
+    const name = header.slice(0, header.indexOf("="));
+    return isCookieOrChunk(name, cookieName);
+  });
+  if (responseHandlesCache)
+    return;
+  for (const name of parseRequestCookies(getRequestHeaders(event).get("cookie")).keys()) {
+    if (isCookieOrChunk(name, cookieName))
+      expireCookie(event, name, cookie.attributes);
+  }
+}
 function updateRequestHeaders(event, sessionCookie, clearedCookieNames) {
   const requestContext = getRequestSessionContext(event);
   const incomingHeaders = getIncomingRequestHeaders(event);
@@ -227,10 +261,14 @@ export async function refreshSessionCookieCache(event) {
     if (context[requestSessionLoadKey] !== load)
       return context.requestSession ?? null;
     delete context.requestSession;
-    const { headers, response } = await loadFreshSession(event);
+    const [{ headers, response }, authContext] = await Promise.all([
+      loadFreshSession(event),
+      getServerAuthContext(event)
+    ]);
     if (context[requestSessionLoadKey] !== load)
       return context.requestSession ?? null;
     appendSetCookieHeaders(event, headers);
+    expireUnrefreshedSessionCookieCache(event, headers, authContext.authCookies.sessionData);
     context.requestSession = response;
     return response;
   });

package/dist/runtime/test-utils/e2e.js

@@ -1,9 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
-import { url } from "@nuxt/test-utils/e2e";
+import { url, useTestContext } from "@nuxt/test-utils/e2e";
 import { parseJSON } from "better-auth/client";
 import { getRandomPort } from "get-port-please";
 import { defu } from "defu";
+import { joinURL } from "ufo";
 export async function createAuthTestContext(options = {}) {
   if (options.host || options.dev || options.build === false || options.server === false)
     throw new Error("[nuxt-better-auth] Auth E2E helpers require a local test build. Use setup() with build and server enabled, without dev or host.");
@@ -22,7 +23,8 @@ export async function createAuthTestContext(options = {}) {
     }
   }, options);
   async function call(action, data = {}) {
-    const response = await fetch(url(endpoint), {
+    const baseURL = useTestContext().nuxt?.options.app.baseURL ?? "/";
+    const response = await fetch(url(joinURL(baseURL, endpoint)), {
       method: "POST",
       headers: { "content-type": "application/json", "x-nuxt-auth-test": token },
       body: JSON.stringify({ action, data })

package/dist/runtime/test-utils/server/handler.js

@@ -9,7 +9,7 @@ const requestSchema = z.discriminatedUnion("action", [
 ]);
 const ownedUsers = /* @__PURE__ */ new Set();
 export default defineEventHandler(async (event) => {
-  const token = useRuntimeConfig(event).betterAuthTestToken;
+  const token = useRuntimeConfig().betterAuthTestToken;
   if (!token || toWebRequest(event).headers.get("x-nuxt-auth-test") !== token)
     throw createAuthError(404, "Not found");
   const body = requestSchema.parse(parseJSON(await toWebRequest(event).text()));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nuxtjs/better-auth",
   "type": "module",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Nuxt module for Better Auth integration with NuxtHub, route protection, session management, and role-based access",
   "author": "onmax",
   "license": "MIT",
@@ -73,9 +73,9 @@
   },
   "dependencies": {
     "@nuxt/devtools-kit": "^3.4.1",
-    "@nuxt/kit": "^4.5.2",
+    "@nuxt/kit": "^4.6.0",
     "@types/node": "^24.13.3",
-    "auth": "1.7.3",
+    "auth": "1.7.7",
     "consola": "^3.4.2",
     "cookie-es": "^3.1.1",
     "defu": "^6.1.7",
@@ -91,36 +91,36 @@
   },
   "devDependencies": {
     "@antfu/eslint-config": "^9.3.0",
-    "@libsql/client": "^0.17.4",
+    "@libsql/client": "^0.18.0",
     "@libsql/linux-x64-gnu": "0.5.29",
     "@nuxt/devtools": "^3.4.1",
     "@nuxt/fonts": "0.14.0",
     "@nuxt/module-builder": "^1.0.3",
-    "@nuxt/schema": "^4.5.2",
-    "@nuxt/test-utils": "^4.1.0",
+    "@nuxt/schema": "^4.6.0",
+    "@nuxt/test-utils": "^4.3.3",
     "@nuxthub/core": "^0.10.8",
     "@pinia/nuxt": "^1.0.2",
     "@types/better-sqlite3": "^9.6.0",
     "@vue/test-utils": "^2.4.6",
-    "better-auth": "1.7.3",
+    "better-auth": "1.7.7",
     "better-call": "1.4.0",
-    "better-sqlite3": "^12.11.1",
+    "better-sqlite3": "^13.0.0",
     "drizzle-kit": "^0.31.10",
     "drizzle-orm": "^0.45.2",
     "eslint": "^10.8.1",
     "happy-dom": "^20.8.9",
     "nitropack": "2.13.4",
-    "nuxt": "^4.5.2",
+    "nuxt": "^4.6.0",
     "pinia": "^4.0.3",
     "pkg-pr-new": "0.0.88",
-    "playwright-core": "1.58.2",
+    "playwright-core": "1.63.0",
     "postgres": "^3.4.9",
     "typescript": "~5.9.3",
     "unstorage": "^1.17.5",
-    "vitest": "^4.1.11",
-    "vue": "3.5.41",
+    "vitest": "^5.0.0",
+    "vue": "3.5.43",
     "vue-tsc": "^3.3.10",
-    "wrangler": "4.124.0",
+    "wrangler": "4.147.0",
     "yaml": "^2.9.0"
   },
   "scripts": {