@onmax/nuxt-better-auth 0.0.2-alpha.26 → 0.0.2-alpha.29

package/dist/module.d.mts

@@ -5,12 +5,13 @@ export { BetterAuthModuleOptions, defineClientAuth, defineServerAuth } from '../
 import { BetterAuthOptions } from 'better-auth';
 export { AppSession, Auth, AuthActionError, AuthMeta, AuthMode, AuthRouteRules, AuthSession, AuthUser, InferSession, InferUser, RequireSessionOptions, ServerAuthContext, UserMatch } from '../dist/runtime/types.js';
 
-interface DefineServerAuthFn {
+interface RuntimeDefineServerAuthFn {
     (...args: unknown[]): unknown;
     _count: number;
 }
 declare global {
-    var defineServerAuth: DefineServerAuthFn | undefined;
+    var __nuxtBetterAuthDefineServerAuth: RuntimeDefineServerAuthFn | undefined;
+    var defineServerAuth: RuntimeDefineServerAuthFn | undefined;
 }
 
 type DbDialect = 'sqlite' | 'postgresql' | 'mysql';

package/dist/module.json

@@ -1,6 +1,6 @@
 {
   "name": "@onmax/nuxt-better-auth",
-  "version": "0.0.2-alpha.26",
+  "version": "0.0.2-alpha.29",
   "configKey": "auth",
   "compatibility": {
     "nuxt": ">=4.0.0"

package/dist/module.mjs

@@ -10,7 +10,7 @@ import { randomBytes } from 'node:crypto';
 import { isCI, isTest } from 'std-env';
 export { defineClientAuth, defineServerAuth } from '../dist/runtime/config.js';
 
-const version = "0.0.2-alpha.26";
+const version = "0.0.2-alpha.29";
 
 function resolveDatabaseProvider(input) {
   const enabledProviders = Object.entries(input.providers).filter(([_id, provider]) => provider.isEnabled?.(input.context) ?? true);
@@ -122,26 +122,33 @@ function getHubCasing(hub) {
   return hub.db.casing;
 }
 
-function resolveSecondaryStorageEnabled(input) {
-  const { options, clientOnly, hasNuxtHub, hub, consola } = input;
-  let secondaryStorageEnabled = options.secondaryStorage ?? false;
+function resolveSecondaryStorage(input) {
+  const { options, clientOnly, hasNuxtHub, hub } = input;
+  const opt = options.hubSecondaryStorage ?? false;
+  const useHubKV = opt === true;
+  const secondaryStorageEnabled = opt === true || opt === "custom";
   if (secondaryStorageEnabled && clientOnly) {
-    consola.warn("secondaryStorage is not available in clientOnly mode. Disabling.");
-    secondaryStorageEnabled = false;
-  } else if (secondaryStorageEnabled && (!hasNuxtHub || !hub?.kv)) {
-    consola.warn("secondaryStorage requires @nuxthub/core with hub.kv: true. Disabling.");
-    secondaryStorageEnabled = false;
+    throw new Error("[nuxt-better-auth] hubSecondaryStorage is not available in clientOnly mode. Either disable clientOnly or remove auth.hubSecondaryStorage.");
   }
-  return secondaryStorageEnabled;
+  if (useHubKV && (!hasNuxtHub || !hub?.kv)) {
+    throw new Error("[nuxt-better-auth] hubSecondaryStorage: true requires @nuxthub/core with hub.kv: true. Either add hub.kv: true to your nuxt.config or remove auth.hubSecondaryStorage.");
+  }
+  return { useHubKV, secondaryStorageEnabled };
 }
 function setupRuntimeConfig(input) {
   const { nuxt, options, clientOnly, databaseProvider, consola } = input;
-  const secondaryStorageEnabled = resolveSecondaryStorageEnabled(input);
+  const { useHubKV, secondaryStorageEnabled } = resolveSecondaryStorage(input);
   nuxt.options.runtimeConfig.public = nuxt.options.runtimeConfig.public || {};
   const configuredSiteUrl = nuxt.options.runtimeConfig.public.siteUrl;
   if (!configuredSiteUrl && process.env.NUXT_PUBLIC_SITE_URL)
     nuxt.options.runtimeConfig.public.siteUrl = process.env.NUXT_PUBLIC_SITE_URL;
   nuxt.options.runtimeConfig.public.auth = defu(nuxt.options.runtimeConfig.public.auth, {
+    redirects: {
+      login: options.redirects?.login ?? "/login",
+      guest: options.redirects?.guest ?? "/",
+      authenticated: options.redirects?.authenticated,
+      logout: options.redirects?.logout
+    },
     preserveRedirect: options.preserveRedirect ?? true,
     redirectQueryKey: options.redirectQueryKey ?? "redirect",
     useDatabase: databaseProvider !== "none",
@@ -156,7 +163,7 @@ function setupRuntimeConfig(input) {
     if (!siteUrl)
       consola.warn("clientOnly mode: set runtimeConfig.public.siteUrl (or NUXT_PUBLIC_SITE_URL) to your frontend URL");
     consola.info("clientOnly mode enabled - server utilities (serverAuth, getAppSession, getUserSession, requireUserSession) are not available");
-    return { secondaryStorageEnabled };
+    return { useHubKV, secondaryStorageEnabled };
   }
   const currentSecret = nuxt.options.runtimeConfig.betterAuthSecret;
   nuxt.options.runtimeConfig.betterAuthSecret = currentSecret || process.env.BETTER_AUTH_SECRET || "";
@@ -168,9 +175,9 @@ function setupRuntimeConfig(input) {
     throw new Error("[nuxt-better-auth] BETTER_AUTH_SECRET must be at least 32 characters for security");
   }
   nuxt.options.runtimeConfig.auth = defu(nuxt.options.runtimeConfig.auth, {
-    secondaryStorage: secondaryStorageEnabled
+    hubSecondaryStorage: options.hubSecondaryStorage ?? false
   });
-  return { secondaryStorageEnabled };
+  return { useHubKV, secondaryStorageEnabled };
 }
 
 function dialectToProvider(dialect) {
@@ -204,13 +211,16 @@ async function generateDrizzleSchema(authOptions, dialect, schemaOptions) {
 }
 async function loadUserAuthConfig(configPath, throwOnError = false) {
   const { createJiti } = await import('jiti');
-  const { defineServerAuth } = await import('../dist/runtime/config.js');
+  const { defineServerAuth: runtimeDefineServerAuth } = await import('../dist/runtime/config.js');
   const jiti = createJiti(import.meta.url, { interopDefault: true, moduleCache: false });
+  if (!globalThis.__nuxtBetterAuthDefineServerAuth) {
+    runtimeDefineServerAuth._count = 0;
+    globalThis.__nuxtBetterAuthDefineServerAuth = runtimeDefineServerAuth;
+  }
   if (!globalThis.defineServerAuth) {
-    defineServerAuth._count = 0;
-    globalThis.defineServerAuth = defineServerAuth;
+    globalThis.defineServerAuth = globalThis.__nuxtBetterAuthDefineServerAuth;
   }
-  globalThis.defineServerAuth._count++;
+  globalThis.__nuxtBetterAuthDefineServerAuth._count++;
   try {
     const mod = await jiti.import(configPath);
     const configFn = mod.default;
@@ -229,13 +239,31 @@ async function loadUserAuthConfig(configPath, throwOnError = false) {
     consola$1.error("[@onmax/nuxt-better-auth] Failed to load auth config for schema generation. Schema may be incomplete:", error);
     return {};
   } finally {
-    globalThis.defineServerAuth._count--;
-    if (!globalThis.defineServerAuth._count) {
-      globalThis.defineServerAuth = void 0;
+    const sharedDefineServerAuth = globalThis.__nuxtBetterAuthDefineServerAuth;
+    if (sharedDefineServerAuth) {
+      sharedDefineServerAuth._count--;
+      if (!sharedDefineServerAuth._count) {
+        globalThis.__nuxtBetterAuthDefineServerAuth = void 0;
+        if (globalThis.defineServerAuth === sharedDefineServerAuth) {
+          globalThis.defineServerAuth = void 0;
+        }
+      }
     }
   }
 }
 
+function resolveSchemaSecondaryStorageInjection(hubSecondaryStorage, userHasSecondaryStorage, isProduction) {
+  if (hubSecondaryStorage === true)
+    return { inject: true };
+  if (hubSecondaryStorage !== "custom")
+    return { inject: false };
+  if (userHasSecondaryStorage)
+    return { inject: true };
+  const message = '[nuxt-better-auth] hubSecondaryStorage: "custom" requires secondaryStorage in defineServerAuth() to omit the session table from the generated schema.';
+  if (isProduction)
+    return { inject: false, error: message };
+  return { inject: false, warn: message };
+}
 function isInsideNodeModules(path) {
   return path.split(/[\\/]/).includes("node_modules");
 }
@@ -260,7 +288,7 @@ async function loadAuthOptions(context) {
   const plugins = [...userConfig.plugins || [], ...extendedConfig.plugins || []];
   return { userConfig, plugins };
 }
-async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola) {
+async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, hubSecondaryStorage) {
   const hub = nuxt.options.hub;
   const dialect = getHubDialect(hub);
   if (!dialect || !["sqlite", "postgresql", "mysql"].includes(dialect)) {
@@ -270,10 +298,16 @@ async function setupBetterAuthSchema(nuxt, serverConfigPath, options, consola) {
   const context = { nuxt, serverConfigPath };
   try {
     const { userConfig, plugins } = await loadAuthOptions(context);
+    const userHasSecondaryStorage = userConfig.secondaryStorage != null;
+    const secondaryStorageResolution = resolveSchemaSecondaryStorageInjection(hubSecondaryStorage, userHasSecondaryStorage, !nuxt.options.dev);
+    if (secondaryStorageResolution.error)
+      throw new Error(secondaryStorageResolution.error);
+    if (secondaryStorageResolution.warn)
+      consola.warn(secondaryStorageResolution.warn);
     const authOptions = {
       ...userConfig,
       plugins,
-      secondaryStorage: options.secondaryStorage ? { get: async (_key) => null, set: async (_key, _value, _ttl) => {
+      secondaryStorage: secondaryStorageResolution.inject ? { get: async (_key) => null, set: async (_key, _value, _ttl) => {
       }, delete: async (_key) => {
       } } : void 0
     };
@@ -328,13 +362,21 @@ function appendSecretToEnv(rootDir, secret) {
 `;
   writeFileSync(envPath, content, "utf-8");
 }
-async function promptForSecret(rootDir, consola) {
+async function promptForSecret(rootDir, consola, options = {}) {
+  const configuredSecret = options.configuredSecret?.trim();
+  if (configuredSecret)
+    return void 0;
   if (process.env.BETTER_AUTH_SECRET || hasEnvSecret(rootDir))
     return void 0;
+  const hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  if (options.prepare || !hasTty) {
+    consola.warn("[nuxt-better-auth] Skipping BETTER_AUTH_SECRET prompt (non-interactive). Set BETTER_AUTH_SECRET or NUXT_BETTER_AUTH_SECRET.");
+    return void 0;
+  }
   if (isCI || isTest) {
     const secret2 = generateSecret();
     appendSecretToEnv(rootDir, secret2);
-    consola.info("Generated BETTER_AUTH_SECRET and added to .env (CI mode)");
+    consola.info("Generated BETTER_AUTH_SECRET and added to .env (CI/test mode)");
     return secret2;
   }
   consola.box("BETTER_AUTH_SECRET is required for authentication.\nThis will be appended to your .env file.");
@@ -375,8 +417,8 @@ Proceed?`, { type: "confirm", initial: true, cancel: "null" });
   return secret;
 }
 
-function buildSecondaryStorageCode(enabled) {
-  if (!enabled)
+function buildSecondaryStorageCode(useHubKV) {
+  if (!useHubKV)
     return "export function createSecondaryStorage() { return undefined }";
   return `import { kv } from '@nuxthub/kv'
 export function createSecondaryStorage() {
@@ -587,12 +629,14 @@ const module$1 = defineNuxtModule({
     clientOnly: false,
     serverConfig: "server/auth.config",
     clientConfig: "app/auth.config",
+    redirects: { login: "/login", guest: "/" },
     preserveRedirect: true,
     redirectQueryKey: "redirect",
-    secondaryStorage: false
+    hubSecondaryStorage: false
   },
   async onInstall(nuxt) {
-    const generatedSecret = await promptForSecret(nuxt.options.rootDir, consola);
+    const configuredSecret = nuxt.options.runtimeConfig?.betterAuthSecret;
+    const generatedSecret = await promptForSecret(nuxt.options.rootDir, consola, { configuredSecret, prepare: Boolean(nuxt.options._prepare) });
     if (generatedSecret)
       process.env.BETTER_AUTH_SECRET = generatedSecret;
     await createDefaultAuthConfigFiles(nuxt.options.rootDir, nuxt.options.srcDir);
@@ -666,7 +710,7 @@ const module$1 = defineNuxtModule({
       const resolvedProvider = resolveDatabaseProvider({ providers, context: enabledCtx });
       databaseProvider = resolvedProvider.id;
       hasHubDb = databaseProvider === "nuxthub";
-      const { secondaryStorageEnabled } = setupRuntimeConfig({
+      const { useHubKV } = setupRuntimeConfig({
         nuxt,
         options,
         clientOnly,
@@ -675,12 +719,12 @@ const module$1 = defineNuxtModule({
         hub,
         consola
       });
-      if (secondaryStorageEnabled && !nuxt.options.alias["hub:kv"]) {
+      if (useHubKV && !nuxt.options.alias["hub:kv"]) {
         throw new Error("[nuxt-better-auth] hub:kv not found. Ensure @nuxthub/core is loaded before this module and hub.kv is enabled.");
       }
       const secondaryStorageTemplate = addTemplate({
         filename: "better-auth/secondary-storage.mjs",
-        getContents: () => buildSecondaryStorageCode(secondaryStorageEnabled),
+        getContents: () => buildSecondaryStorageCode(useHubKV),
         write: true
       });
       nuxt.options.alias["#auth/secondary-storage"] = secondaryStorageTemplate.dst;
@@ -715,7 +759,7 @@ export { schema }
         runtimeTypesPath: resolver.resolve("./runtime/types")
       });
       if (hasHubDb)
-        await setupBetterAuthSchema(nuxt, serverConfigPath, options, consola);
+        await setupBetterAuthSchema(nuxt, serverConfigPath, options, consola, options.hubSecondaryStorage ?? false);
     }
     registerSharedTypeTemplates({
       runtimeTypesAugmentPath: resolver.resolve("./runtime/types/augment"),

package/dist/runtime/app/composables/useUserSession.js

@@ -1,5 +1,5 @@
 import createAppAuthClient from "#auth/client";
-import { computed, nextTick, useNuxtApp, useRequestHeaders, useRequestURL, useRuntimeConfig, useState, watch } from "#imports";
+import { computed, navigateTo, nextTick, useNuxtApp, useRequestHeaders, useRequestURL, useRuntimeConfig, useState, watch } from "#imports";
 import { normalizeAuthActionError } from "../internal/auth-action-error.js";
 let _sessionSignalListenerBound = false;
 let _client = null;
@@ -128,6 +128,30 @@ export function useUserSession() {
       }, 5e3);
     });
   }
+  function isSafeLocalRedirect(redirect) {
+    if (typeof redirect !== "string")
+      return;
+    if (!redirect.startsWith("/") || redirect.startsWith("//"))
+      return;
+    return redirect;
+  }
+  function resolvePostAuthRedirect() {
+    const authConfig = runtimeConfig.public.auth;
+    const redirectQueryKey = authConfig?.redirectQueryKey ?? "redirect";
+    const queryRedirect = requestURL.searchParams?.get(redirectQueryKey);
+    const safeQueryRedirect = isSafeLocalRedirect(queryRedirect);
+    if (safeQueryRedirect)
+      return safeQueryRedirect;
+    return isSafeLocalRedirect(authConfig?.redirects?.authenticated);
+  }
+  function resolvePostAuthSuccessRedirect() {
+    const target = resolvePostAuthRedirect();
+    if (!target)
+      return;
+    return async () => {
+      await navigateTo(target);
+    };
+  }
   function wrapOnSuccess(cb) {
     return async (ctx) => {
       await fetchSession({ force: true });
@@ -146,6 +170,12 @@ export function useUserSession() {
       const fetchOptions = isRecord(dataRecord?.fetchOptions) ? dataRecord.fetchOptions : void 0;
       const nestedOnSuccess = fetchOptions?.onSuccess;
       const topLevelOnSuccess = optionsRecord?.onSuccess;
+      const fallbackOnSuccess = resolvePostAuthSuccessRedirect();
+      const wrappedFallbackOnSuccess = fallbackOnSuccess && wrapOnSuccess(async () => {
+        if (!loggedIn.value)
+          return;
+        await fallbackOnSuccess();
+      });
       if (typeof nestedOnSuccess === "function") {
         const nextData = {
           ...dataRecord,
@@ -163,6 +193,23 @@ export function useUserSession() {
         };
         return method(data, nextOptions);
       }
+      if (wrappedFallbackOnSuccess) {
+        if (fetchOptions) {
+          const nextData = {
+            ...dataRecord,
+            fetchOptions: {
+              ...fetchOptions,
+              onSuccess: wrappedFallbackOnSuccess
+            }
+          };
+          return method(nextData, options);
+        }
+        const nextOptions = {
+          ...optionsRecord,
+          onSuccess: wrappedFallbackOnSuccess
+        };
+        return method(data, nextOptions);
+      }
       return method(data, options);
     });
   }
@@ -229,8 +276,14 @@ export function useUserSession() {
       throw new Error("signOut can only be called on client-side");
     await client.signOut();
     clearSession();
-    if (options?.onSuccess)
+    if (options?.onSuccess) {
       await options.onSuccess();
+      return;
+    }
+    const authConfig = runtimeConfig.public.auth;
+    const logoutRedirect = authConfig?.redirects?.logout;
+    if (logoutRedirect)
+      await navigateTo(logoutRedirect);
   }
   return {
     client,

package/dist/runtime/app/composables/useUserSignIn.d.ts

@@ -1,3 +1,5 @@
 import type { AppAuthClient } from '#nuxt-better-auth';
-import type { ActionHandleMap } from '../internal/auth-action-handles.js';
-export declare function useUserSignIn(): ActionHandleMap<NonNullable<AppAuthClient>['signIn']>;
+import type { ActionHandleFor } from '../internal/auth-action-handles.js';
+type SignIn = NonNullable<AppAuthClient>['signIn'];
+export declare function useUserSignIn<MethodKey extends keyof SignIn>(method: MethodKey): ActionHandleFor<SignIn[MethodKey]>;
+export {};

package/dist/runtime/app/composables/useUserSignIn.js

@@ -1,5 +1,8 @@
 import { useUserSession } from "#imports";
 import { createActionHandles } from "../internal/auth-action-handles.js";
-export function useUserSignIn() {
-  return createActionHandles(() => useUserSession().signIn, "signIn");
+export function useUserSignIn(method) {
+  if (method === void 0 || method === null)
+    throw new TypeError("useUserSignIn(method) requires a sign-in method key");
+  const handles = createActionHandles(() => useUserSession().signIn, "signIn");
+  return handles[method];
 }

package/dist/runtime/app/composables/useUserSignUp.d.ts

@@ -1,3 +1,5 @@
 import type { AppAuthClient } from '#nuxt-better-auth';
-import type { ActionHandleMap } from '../internal/auth-action-handles.js';
-export declare function useUserSignUp(): ActionHandleMap<NonNullable<AppAuthClient>['signUp']>;
+import type { ActionHandleFor } from '../internal/auth-action-handles.js';
+type SignUp = NonNullable<AppAuthClient>['signUp'];
+export declare function useUserSignUp<MethodKey extends keyof SignUp>(method: MethodKey): ActionHandleFor<SignUp[MethodKey]>;
+export {};

package/dist/runtime/app/composables/useUserSignUp.js

@@ -1,5 +1,8 @@
 import { useUserSession } from "#imports";
 import { createActionHandles } from "../internal/auth-action-handles.js";
-export function useUserSignUp() {
-  return createActionHandles(() => useUserSession().signUp, "signUp");
+export function useUserSignUp(method) {
+  if (method === void 0 || method === null)
+    throw new TypeError("useUserSignUp(method) requires a sign-up method key");
+  const handles = createActionHandles(() => useUserSession().signUp, "signUp");
+  return handles[method];
 }

package/dist/runtime/app/internal/auth-action-handles.d.ts

@@ -1,13 +1,11 @@
-import type { ComputedRef, Ref } from 'vue';
+import type { Ref } from 'vue';
 import type { AuthActionError } from '../../types.js';
 export type UserAuthActionStatus = 'idle' | 'pending' | 'success' | 'error';
 export interface UserAuthActionHandle<TArgs extends unknown[], TResult> {
     execute: (...args: TArgs) => Promise<void>;
     status: Ref<UserAuthActionStatus>;
-    pending: ComputedRef<boolean>;
     data: Ref<TResult | null>;
     error: Ref<AuthActionError | null>;
-    errorMessage: ComputedRef<string | null>;
 }
 export type ActionHandleFor<T> = T extends (...args: infer A) => Promise<infer R> ? UserAuthActionHandle<A, R> : never;
 export type ActionHandleMap<T> = {

package/dist/runtime/app/internal/auth-action-handles.js

@@ -1,4 +1,4 @@
-import { computed, ref } from "#imports";
+import { ref } from "#imports";
 import { normalizeAuthActionError } from "./auth-action-error.js";
 function isRecord(value) {
   return Boolean(value && typeof value === "object");
@@ -14,8 +14,6 @@ function createActionHandle(getMethod) {
   const status = ref("idle");
   const data = ref(null);
   const error = ref(null);
-  const pending = computed(() => status.value === "pending");
-  const errorMessage = computed(() => error.value?.message ?? null);
   let latestCallId = 0;
   const run = async (...args) => {
     const callId = ++latestCallId;
@@ -53,10 +51,8 @@ function createActionHandle(getMethod) {
   return {
     execute,
     status,
-    pending,
     data,
-    error,
-    errorMessage
+    error
   };
 }
 export function createActionHandles(getTarget, targetName) {

package/dist/runtime/app/middleware/auth.global.js

@@ -25,13 +25,13 @@ export default defineNuxtRouteMiddleware(async (to) => {
   const redirectTo = typeof auth === "object" ? auth.redirectTo : void 0;
   if (mode === "guest") {
     if (loggedIn.value)
-      return navigateTo(redirectTo ?? "/");
+      return navigateTo(redirectTo ?? config?.redirects?.guest ?? "/");
     return;
   }
   if (!loggedIn.value) {
     const resolved = resolveLoginRedirect({
       route: to,
-      loginTarget: redirectTo ?? "/login",
+      loginTarget: redirectTo ?? config?.redirects?.login ?? "/login",
       config
     });
     return resolved.external ? navigateTo(resolved.to, { external: true }) : navigateTo(resolved.to);

package/dist/runtime/app/pages/__better-auth-devtools.vue

@@ -379,8 +379,8 @@ function getAccountActions(row) {
                   </UBadge>
                 </div>
                 <div class="config-row">
-                  <span class="config-label">KV</span><UBadge :color="configData.config.module?.secondaryStorage ? 'success' : 'neutral'" variant="subtle" size="sm">
-                    {{ configData.config.module?.secondaryStorage ? "On" : "Off" }}
+                  <span class="config-label">KV</span><UBadge :color="configData.config.module?.hubSecondaryStorage ? 'success' : 'neutral'" variant="subtle" size="sm">
+                    {{ configData.config.module?.hubSecondaryStorage ? configData.config.module.hubSecondaryStorage === "custom" ? "Custom" : "On" : "Off" }}
                   </UBadge>
                 </div>
               </div>

package/dist/runtime/config.d.ts

@@ -24,6 +24,16 @@ export interface BetterAuthModuleOptions {
     serverConfig?: string;
     /** Client config path relative to rootDir. Default: 'app/auth.config' */
     clientConfig?: string;
+    redirects?: {
+        /** Where to redirect unauthenticated users. Default: '/login' */
+        login?: string;
+        /** Where to redirect authenticated users on guest-only routes. Default: '/' */
+        guest?: string;
+        /** Where to navigate after successful signIn/signUp when no onSuccess is provided. Default: no automatic navigation */
+        authenticated?: string;
+        /** Where to navigate after logout. Default: no automatic navigation */
+        logout?: string;
+    };
     /**
      * When redirecting unauthenticated users to the login route, append a query param
      * containing the originally requested path (for safe "return-to" redirects).
@@ -47,8 +57,13 @@ export interface BetterAuthModuleOptions {
          */
         skipHydratedSsrGetSession?: boolean;
     };
-    /** Enable KV secondary storage for sessions. Requires hub.kv: true */
-    secondaryStorage?: boolean;
+    /**
+     * Enable secondary storage for sessions.
+     * - `true`: Use NuxtHub KV (requires hub.kv: true)
+     * - `'custom'`: User provides own secondaryStorage in defineServerAuth()
+     * - `false` (default): No secondary storage from module
+     */
+    hubSecondaryStorage?: boolean | 'custom';
     /** Schema generation options. Must match drizzleAdapter config. */
     schema?: {
         /** Plural table names: user → users. Default: false */
@@ -58,6 +73,12 @@ export interface BetterAuthModuleOptions {
     };
 }
 export interface AuthRuntimeConfig {
+    redirects: {
+        login: string;
+        guest: string;
+        authenticated?: string;
+        logout?: string;
+    };
     preserveRedirect: boolean;
     redirectQueryKey: string;
     useDatabase: boolean;
@@ -68,7 +89,7 @@ export interface AuthRuntimeConfig {
     };
 }
 export interface AuthPrivateRuntimeConfig {
-    secondaryStorage: boolean;
+    hubSecondaryStorage: boolean | 'custom';
 }
 export declare function defineServerAuth<const R>(config: (ctx: ServerAuthContext) => R & ServerAuthConfig): (ctx: ServerAuthContext) => R;
 export declare function defineServerAuth<const R>(config: R & ServerAuthConfig): (ctx: ServerAuthContext) => R;

package/dist/runtime/server/api/_better-auth/config.get.d.ts

@@ -1,29 +1,35 @@
 declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
     config: {
         module: {
+            redirects: {
+                login: string;
+                guest: string;
+                authenticated: string | undefined;
+                logout: string | undefined;
+            };
             preserveRedirect: boolean;
             redirectQueryKey: string;
-            secondaryStorage: boolean;
+            hubSecondaryStorage: boolean | "custom";
             useDatabase: boolean;
             databaseProvider: "none" | "nuxthub";
         };
         server: {
-            baseURL: any;
-            basePath: any;
+            baseURL: string | undefined;
+            basePath: string;
             socialProviders: string[];
-            plugins: any;
-            trustedOrigins: any;
-            configuredTrustedOrigins: any;
+            plugins: string[];
+            trustedOrigins: string[];
+            configuredTrustedOrigins: string[];
             session: {
                 expiresIn: string;
                 updateAge: string;
-                cookieCache: any;
+                cookieCache: boolean;
             };
             emailAndPassword: boolean;
-            rateLimit: any;
+            rateLimit: boolean;
             advanced: {
-                useSecureCookies: any;
-                disableCSRFCheck: any;
+                useSecureCookies: string | boolean;
+                disableCSRFCheck: boolean;
             };
         };
     };

package/dist/runtime/server/api/_better-auth/config.get.js

@@ -18,9 +18,15 @@ export default defineEventHandler(async (event) => {
       config: {
         // Module config (nuxt.config.ts)
         module: {
+          redirects: {
+            login: publicAuth?.redirects?.login ?? "/login",
+            guest: publicAuth?.redirects?.guest ?? "/",
+            authenticated: publicAuth?.redirects?.authenticated,
+            logout: publicAuth?.redirects?.logout
+          },
           preserveRedirect: publicAuth?.preserveRedirect ?? true,
           redirectQueryKey: publicAuth?.redirectQueryKey ?? "redirect",
-          secondaryStorage: privateAuth?.secondaryStorage ?? false,
+          hubSecondaryStorage: privateAuth?.hubSecondaryStorage ?? false,
           useDatabase: publicAuth?.useDatabase ?? false,
           databaseProvider: publicAuth?.databaseProvider ?? "none"
         },

package/dist/runtime/server/utils/auth.d.ts

@@ -1,7 +1,6 @@
-import type { Auth } from 'better-auth';
 import type { H3Event } from 'h3';
-import createServerAuth from '#auth/server';
-type AuthInstance = Auth<ReturnType<typeof createServerAuth>>;
+import { betterAuth } from 'better-auth';
+type AuthInstance = ReturnType<typeof betterAuth>;
 /** Returns Better Auth instance. Caches per resolved host (or single instance when siteUrl is explicit). */
 export declare function serverAuth(event?: H3Event): AuthInstance;
 export {};

package/dist/runtime/server/utils/auth.js

@@ -5,8 +5,10 @@ import { betterAuth } from "better-auth";
 import { getRequestHost, getRequestProtocol } from "h3";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { withoutProtocol } from "ufo";
+import { resolveCustomSecondaryStorageRequirement } from "./custom-secondary-storage.js";
 const _authCache = /* @__PURE__ */ new Map();
 let _baseURLInferenceLogged = false;
+let _customSecondaryStorageMisconfigWarned = false;
 function normalizeLoopbackOrigin(origin) {
   if (!import.meta.dev)
     return origin;
@@ -189,10 +191,18 @@ export function serverAuth(event) {
   const database = createDatabase();
   const userConfig = createServerAuth({ runtimeConfig, db });
   const trustedOrigins = withDevTrustedOrigins(userConfig.trustedOrigins, Boolean(hasExplicitSiteUrl));
+  const hubSecondaryStorage = runtimeConfig.auth?.hubSecondaryStorage;
+  const customSecondaryStorage = resolveCustomSecondaryStorageRequirement(hubSecondaryStorage, userConfig.secondaryStorage != null, Boolean(import.meta.dev));
+  if (customSecondaryStorage?.shouldThrow)
+    throw new Error(customSecondaryStorage.message);
+  if (customSecondaryStorage?.shouldWarn && !_customSecondaryStorageMisconfigWarned) {
+    _customSecondaryStorageMisconfigWarned = true;
+    console.warn(customSecondaryStorage.message);
+  }
   const auth = betterAuth({
     ...userConfig,
     ...database && { database },
-    secondaryStorage: createSecondaryStorage(),
+    ...hubSecondaryStorage === true && { secondaryStorage: createSecondaryStorage() },
     secret: runtimeConfig.betterAuthSecret,
     baseURL: siteUrl,
     trustedOrigins

package/dist/runtime/server/utils/custom-secondary-storage.d.ts

@@ -0,0 +1,6 @@
+export type HubSecondaryStorageMode = boolean | 'custom' | undefined;
+export declare function resolveCustomSecondaryStorageRequirement(hubSecondaryStorage: HubSecondaryStorageMode, userHasSecondaryStorage: boolean, isDev: boolean): {
+    shouldThrow: boolean;
+    shouldWarn: boolean;
+    message: string;
+} | null;

package/dist/runtime/server/utils/custom-secondary-storage.js

@@ -0,0 +1,8 @@
+export function resolveCustomSecondaryStorageRequirement(hubSecondaryStorage, userHasSecondaryStorage, isDev) {
+  if (hubSecondaryStorage !== "custom")
+    return null;
+  if (userHasSecondaryStorage)
+    return null;
+  const message = '[nuxt-better-auth] hubSecondaryStorage: "custom" requires secondaryStorage in defineServerAuth().';
+  return { shouldThrow: !isDev, shouldWarn: isDev, message };
+}

package/dist/runtime/types.d.ts

@@ -1,5 +1,5 @@
+import type { AuthUser, UserMatch } from '#nuxt-better-auth';
 import type { NitroRouteRules } from 'nitropack/types';
-import type { AuthUser, UserMatch } from './types/augment.js';
 export type { AppSession, AuthSession, AuthUser, RequireSessionOptions, ServerAuthContext, UserMatch, UserSessionComposable } from './types/augment.js';
 export type { Auth, InferPluginTypes, InferSessionFromClient as InferSession, InferUserFromClient as InferUser } from 'better-auth';
 export interface AuthActionError {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@onmax/nuxt-better-auth",
   "type": "module",
-  "version": "0.0.2-alpha.26",
+  "version": "0.0.2-alpha.29",
   "packageManager": "pnpm@10.15.1",
   "description": "Nuxt module for Better Auth integration with NuxtHub, route protection, session management, and role-based access",
   "author": "onmax",
@@ -56,7 +56,7 @@
     "lint:fix": "eslint . --fix",
     "typecheck": "vue-tsc --noEmit",
     "typecheck:runtime-server": "tsc --noEmit --pretty false -p src/runtime/server/tsconfig.json",
-    "typecheck:playground": "cd playground && vue-tsc --noEmit",
+    "typecheck:playground": "pnpm -C playground exec nuxi prepare && pnpm -C playground exec vue-tsc --noEmit -p .nuxt/tsconfig.app.json",
     "test": "vitest run",
     "test:watch": "vitest watch"
   },
@@ -116,8 +116,7 @@
       "workerd"
     ],
     "patchedDependencies": {
-      "@peculiar/x509@1.14.2": "patches/@peculiar__x509@1.14.2.patch",
-      "unenv@2.0.0-rc.24": "patches/unenv@2.0.0-rc.24.patch"
+      "@peculiar/x509@1.14.2": "patches/@peculiar__x509@1.14.2.patch"
     },
     "overrides": {
       "reka-ui": "^2.6.1"