@onmax/nuxt-better-auth 0.0.2-alpha.8 → 0.0.2

package/dist/runtime/app/internal/auth-action-handles.js

@@ -0,0 +1,105 @@
+import { ref } from "#imports";
+import { normalizeAuthActionError } from "./auth-action-error.js";
+import { isRecord } from "./utils.js";
+function isErrorResult(value) {
+  if (!isRecord(value))
+    return false;
+  if (!("error" in value))
+    return false;
+  return Boolean(value.error);
+}
+function isRedirectResult(value) {
+  if (!isRecord(value))
+    return false;
+  return value.redirect === true && typeof value.url === "string" && value.url.length > 0;
+}
+function getRedirectResult(value) {
+  if (isRedirectResult(value))
+    return value;
+  if (!isRecord(value))
+    return null;
+  const nested = value.data;
+  if (isRedirectResult(nested))
+    return nested;
+  return null;
+}
+const REDIRECT_PENDING_FALLBACK_MS = 1e4;
+export function createActionHandle(getMethod, options = {}) {
+  const status = ref("idle");
+  const data = ref(null);
+  const error = ref(null);
+  let latestCallId = 0;
+  const run = async (...args) => {
+    const callId = ++latestCallId;
+    status.value = "pending";
+    data.value = null;
+    error.value = null;
+    try {
+      const result = await getMethod()(...args);
+      if (isErrorResult(result)) {
+        const normalizedError = normalizeAuthActionError(result.error);
+        if (callId === latestCallId) {
+          status.value = "error";
+          data.value = null;
+          error.value = normalizedError;
+        }
+        return;
+      }
+      if (callId === latestCallId) {
+        if (options.keepPendingOnRedirect !== false) {
+          const redirectResult = getRedirectResult(result);
+          if (redirectResult) {
+            status.value = "pending";
+            data.value = result;
+            error.value = null;
+            setTimeout(() => {
+              if (callId !== latestCallId || status.value !== "pending")
+                return;
+              status.value = "success";
+            }, REDIRECT_PENDING_FALLBACK_MS);
+            return;
+          }
+        }
+        status.value = "success";
+        data.value = result;
+        error.value = null;
+      }
+    } catch (thrown) {
+      const normalizedError = normalizeAuthActionError(thrown);
+      if (callId === latestCallId) {
+        status.value = "error";
+        data.value = null;
+        error.value = normalizedError;
+      }
+    }
+  };
+  const execute = (async (...args) => {
+    await run(...args);
+  });
+  return {
+    execute,
+    status,
+    data,
+    error
+  };
+}
+export function createActionHandles(getTarget, targetName) {
+  const handles = /* @__PURE__ */ new Map();
+  return new Proxy({}, {
+    get(_target, prop) {
+      if (prop === "then")
+        return void 0;
+      if (handles.has(prop))
+        return handles.get(prop);
+      const handle = createActionHandle(() => {
+        const target = getTarget();
+        const method = target[prop];
+        if (typeof method !== "function")
+          throw new TypeError(`${targetName}.${String(prop)}() is not a function`);
+        return method;
+      });
+      handles.set(prop, handle);
+      return handle;
+    }
+  });
+}

package/dist/runtime/app/internal/redirect-helpers.d.ts

@@ -0,0 +1,4 @@
+export declare function isSafeLocalRedirect(redirect: unknown): string | undefined;
+export declare function resolvePostAuthRedirect(requestURL: URL): string | undefined;
+export declare function resolvePostAuthSuccessRedirect(requestURL: URL): (() => Promise<void>) | undefined;
+export declare function withFallbackSocialCallbackURL(data: unknown, requestURL: URL): unknown;

package/dist/runtime/app/internal/redirect-helpers.js

@@ -0,0 +1,37 @@
+import { navigateTo, useRuntimeConfig } from "#imports";
+import { isRecord } from "./utils.js";
+export function isSafeLocalRedirect(redirect) {
+  if (typeof redirect !== "string")
+    return;
+  if (!redirect.startsWith("/") || redirect.startsWith("//"))
+    return;
+  return redirect;
+}
+export function resolvePostAuthRedirect(requestURL) {
+  const runtimeConfig = useRuntimeConfig();
+  const authConfig = runtimeConfig.public.auth;
+  const redirectQueryKey = authConfig?.redirectQueryKey ?? "redirect";
+  const queryRedirect = requestURL.searchParams?.get(redirectQueryKey);
+  const safeQueryRedirect = isSafeLocalRedirect(queryRedirect);
+  if (safeQueryRedirect)
+    return safeQueryRedirect;
+  return isSafeLocalRedirect(authConfig?.redirects?.authenticated);
+}
+export function resolvePostAuthSuccessRedirect(requestURL) {
+  const target = resolvePostAuthRedirect(requestURL);
+  if (!target)
+    return;
+  return async () => {
+    await navigateTo(target);
+  };
+}
+export function withFallbackSocialCallbackURL(data, requestURL) {
+  const callbackURL = resolvePostAuthRedirect(requestURL);
+  if (!callbackURL)
+    return data;
+  if (!isRecord(data))
+    return { callbackURL };
+  if (typeof data.callbackURL === "string")
+    return data;
+  return { ...data, callbackURL };
+}

package/dist/runtime/app/internal/session-fetch.d.ts

@@ -0,0 +1,12 @@
+import type { Ref } from 'vue';
+import type { AppAuthClient, AuthSession, AuthUser } from '#nuxt-better-auth';
+export declare function stripToken(session: AuthSession & {
+    token?: string;
+}): AuthSession;
+export declare function fetchSessionServer(session: Ref<AuthSession | null>, user: Ref<AuthUser | null>, authReady: Ref<boolean>, options?: {
+    headers?: HeadersInit;
+}): Promise<void>;
+export declare function fetchSessionClient(client: AppAuthClient, session: Ref<AuthSession | null>, user: Ref<AuthUser | null>, authReady: Ref<boolean>, options?: {
+    headers?: HeadersInit;
+    force?: boolean;
+}): Promise<void>;

package/dist/runtime/app/internal/session-fetch.js

@@ -0,0 +1,56 @@
+import { useRequestFetch, useRequestHeaders } from "#imports";
+import { normalizeAuthActionError } from "./auth-action-error.js";
+export function stripToken(session) {
+  const { token: _, ...safe } = session;
+  return safe;
+}
+function isExpectedSignedOutSessionError(error) {
+  const normalizedError = normalizeAuthActionError(error);
+  if (normalizedError.status === 401)
+    return true;
+  return normalizedError.code === "UNAUTHORIZED";
+}
+export async function fetchSessionServer(session, user, authReady, options = {}) {
+  try {
+    const headers = options.headers || useRequestHeaders(["cookie"]);
+    const requestFetch = useRequestFetch();
+    const data = await requestFetch("/api/auth/get-session", { headers });
+    if (data?.session && data?.user) {
+      session.value = stripToken(data.session);
+      user.value = data.user;
+    } else {
+      session.value = null;
+      user.value = null;
+    }
+  } catch {
+    session.value = null;
+    user.value = null;
+  } finally {
+    if (!authReady.value)
+      authReady.value = true;
+  }
+}
+export async function fetchSessionClient(client, session, user, authReady, options = {}) {
+  try {
+    const headers = options.headers || useRequestHeaders(["cookie"]);
+    const fetchOptions = headers ? { headers } : void 0;
+    const query = options.force ? { disableCookieCache: true } : void 0;
+    const result = await client.getSession({ query }, fetchOptions);
+    const data = result.data;
+    if (data?.session && data?.user) {
+      session.value = stripToken(data.session);
+      user.value = data.user;
+    } else {
+      session.value = null;
+      user.value = null;
+    }
+  } catch (error) {
+    session.value = null;
+    user.value = null;
+    if (!isExpectedSignedOutSessionError(error))
+      console.error("[nuxt-better-auth] Failed to fetch session:", error);
+  } finally {
+    if (!authReady.value)
+      authReady.value = true;
+  }
+}

package/dist/runtime/app/internal/utils.d.ts

@@ -0,0 +1 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;

package/dist/runtime/app/internal/utils.js

@@ -0,0 +1,3 @@
+export function isRecord(value) {
+  return Boolean(value && typeof value === "object");
+}

package/dist/runtime/app/internal/vue-safe-auth-proxy.d.ts

@@ -0,0 +1,3 @@
+export declare function isAuthProxyProbeKey(prop: PropertyKey): boolean;
+export declare function createVueSafeAuthFacade<T extends object>(resolve: (prop: PropertyKey, receiver: object) => unknown): T;
+export declare function createVueSafeAuthProxy<T>(target: T): T;

package/dist/runtime/app/internal/vue-safe-auth-proxy.js

@@ -0,0 +1,68 @@
+const promiseProbeKeys = /* @__PURE__ */ new Set(["then", "catch", "finally"]);
+export function isAuthProxyProbeKey(prop) {
+  return typeof prop !== "string" || promiseProbeKeys.has(prop) || prop.startsWith("__v");
+}
+function isObjectLike(value) {
+  return typeof value === "object" && value !== null || typeof value === "function";
+}
+export function createVueSafeAuthFacade(resolve) {
+  const propertyCache = /* @__PURE__ */ new Map();
+  const facadeTarget = {};
+  Object.defineProperty(facadeTarget, "__v_skip", {
+    value: true,
+    configurable: true
+  });
+  return new Proxy(facadeTarget, {
+    get(_target, prop, receiver) {
+      if (prop === "__v_skip")
+        return true;
+      if (isAuthProxyProbeKey(prop))
+        return void 0;
+      if (propertyCache.has(prop))
+        return propertyCache.get(prop);
+      const value = resolve(prop, receiver);
+      propertyCache.set(prop, value);
+      return value;
+    }
+  });
+}
+export function createVueSafeAuthProxy(target) {
+  if (!isObjectLike(target))
+    return target;
+  const cache = /* @__PURE__ */ new WeakMap();
+  const wrap = (value) => {
+    if (!isObjectLike(value))
+      return value;
+    const cached = cache.get(value);
+    if (cached)
+      return cached;
+    const propertyCache = /* @__PURE__ */ new Map();
+    const handler = {
+      get(target2, prop, receiver) {
+        if (prop === "__v_skip")
+          return true;
+        if (isAuthProxyProbeKey(prop))
+          return void 0;
+        if (propertyCache.has(prop))
+          return propertyCache.get(prop);
+        const wrapped = wrap(Reflect.get(target2, prop, receiver));
+        propertyCache.set(prop, wrapped);
+        return wrapped;
+      }
+    };
+    if (typeof value === "function") {
+      handler.apply = (target2, thisArg, args) => Reflect.apply(target2, thisArg, args);
+    }
+    const proxy = new Proxy(value, handler);
+    cache.set(value, proxy);
+    return proxy;
+  };
+  const createRootFacade = (value) => {
+    if (!isObjectLike(value))
+      return value;
+    const proxy = createVueSafeAuthFacade((prop, receiver) => wrap(Reflect.get(value, prop, receiver)));
+    cache.set(value, proxy);
+    return proxy;
+  };
+  return createRootFacade(target);
+}

package/dist/runtime/app/internal/wrap-auth-method.d.ts

@@ -0,0 +1,15 @@
+import type { ComputedRef } from 'vue';
+export declare function wrapOnSuccess(fetchSession: (options?: {
+    force?: boolean;
+}) => Promise<void>, loggedIn: ComputedRef<boolean>, waitForSession: () => Promise<void>, cb: (ctx: unknown) => void | Promise<void>): (ctx: unknown) => Promise<void>;
+export declare function wrapAuthMethod<T extends (...args: unknown[]) => Promise<unknown>>(method: T, deps: {
+    fetchSession: (options?: {
+        force?: boolean;
+    }) => Promise<void>;
+    loggedIn: ComputedRef<boolean>;
+    waitForSession: () => Promise<void>;
+    resolvePostAuthSuccessRedirect: () => (() => Promise<void>) | undefined;
+}, wrapOptions?: {
+    shouldSkipSessionSync?: (data: unknown, options: unknown) => boolean;
+    transformData?: (data: unknown, options: unknown) => unknown;
+}): T;

package/dist/runtime/app/internal/wrap-auth-method.js

@@ -0,0 +1,66 @@
+import { nextTick } from "#imports";
+import { isRecord } from "./utils.js";
+export function wrapOnSuccess(fetchSession, loggedIn, waitForSession, cb) {
+  return async (ctx) => {
+    await fetchSession({ force: true });
+    if (!loggedIn.value)
+      await waitForSession();
+    await nextTick();
+    await cb(ctx);
+  };
+}
+export function wrapAuthMethod(method, deps, wrapOptions = {}) {
+  return (async (...args) => {
+    const originalData = args[0];
+    const options = args[1];
+    const data = wrapOptions.transformData?.(originalData, options) ?? originalData;
+    const dataRecord = isRecord(data) ? data : void 0;
+    const optionsRecord = isRecord(options) ? options : void 0;
+    if (wrapOptions.shouldSkipSessionSync?.(data, options))
+      return method(data, options);
+    const fetchOptions = isRecord(dataRecord?.fetchOptions) ? dataRecord.fetchOptions : void 0;
+    const nestedOnSuccess = fetchOptions?.onSuccess;
+    const topLevelOnSuccess = optionsRecord?.onSuccess;
+    const fallbackOnSuccess = deps.resolvePostAuthSuccessRedirect();
+    const wrappedFallbackOnSuccess = fallbackOnSuccess && wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, async () => {
+      if (!deps.loggedIn.value)
+        return;
+      await fallbackOnSuccess();
+    });
+    if (typeof nestedOnSuccess === "function") {
+      const nextData = {
+        ...dataRecord,
+        fetchOptions: {
+          ...fetchOptions,
+          onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, nestedOnSuccess)
+        }
+      };
+      return method(nextData, options);
+    }
+    if (typeof topLevelOnSuccess === "function") {
+      const nextOptions = {
+        ...optionsRecord,
+        onSuccess: wrapOnSuccess(deps.fetchSession, deps.loggedIn, deps.waitForSession, topLevelOnSuccess)
+      };
+      return method(data, nextOptions);
+    }
+    if (wrappedFallbackOnSuccess) {
+      if (fetchOptions) {
+        const nextData = {
+          ...dataRecord,
+          fetchOptions: {
+            ...fetchOptions,
+            onSuccess: wrappedFallbackOnSuccess
+          }
+        };
+        return method(nextData, options);
+      }
+      const nextOptions = {
+        ...optionsRecord,
+        onSuccess: wrappedFallbackOnSuccess
+      };
+      return method(data, nextOptions);
+    }
+    return method(data, options);
+  });
+}

package/dist/runtime/app/middleware/auth.global.js

@@ -1,37 +1,99 @@
-import { createError, defineNuxtRouteMiddleware, getRouteRules, navigateTo, useNuxtApp, useRequestHeaders, useRuntimeConfig, useUserSession } from "#imports";
+import { defu } from "defu";
+import { createRouter, toRouteMatcher } from "radix3";
+import { createError, defineNuxtRouteMiddleware, getRouteRules, navigateTo, useNuxtApp, useRequestHeaders, useRuntimeConfig } from "#imports";
 import { matchesUser } from "../../utils/match-user.js";
+import { useUserSession } from "../composables/useUserSession.js";
+let authRouteRulesPromise = null;
+let routeRulesMatcherPromise = null;
 export default defineNuxtRouteMiddleware(async (to) => {
   const nuxtApp = useNuxtApp();
-  if (import.meta.client) {
-    const isPrerendered = nuxtApp.payload.prerenderedAt || nuxtApp.payload.isCached;
-    if (isPrerendered && nuxtApp.isHydrating)
-      return;
-  }
   if (to.meta.auth === void 0) {
-    const rules = await getRouteRules({ path: to.path });
-    if (rules.auth !== void 0)
-      to.meta.auth = rules.auth;
+    const routeRulesMatcher = await getRouteRulesMatcher();
+    const matches = routeRulesMatcher?.matchAll(to.path);
+    if (matches?.length) {
+      const merged = defu({}, ...matches.reverse());
+      if (merged.auth !== void 0)
+        to.meta.auth = merged.auth;
+    }
+    if (to.meta.auth === void 0) {
+      const rules = await getRouteRules({ path: to.path });
+      if (rules.auth !== void 0)
+        to.meta.auth = rules.auth;
+    }
   }
   const auth = to.meta.auth;
   if (auth === void 0 || auth === false)
     return;
   const config = useRuntimeConfig().public.auth;
   const { fetchSession, user, loggedIn } = useUserSession();
-  if (!loggedIn.value) {
-    const headers = import.meta.server ? useRequestHeaders(["cookie"]) : void 0;
-    await fetchSession({ headers });
-  }
   const mode = typeof auth === "string" ? auth : auth?.only ?? "user";
   const redirectTo = typeof auth === "object" ? auth.redirectTo : void 0;
+  if (!loggedIn.value || mode === "guest") {
+    const headers = import.meta.server ? useRequestHeaders(["cookie"]) : void 0;
+    const isHydratedPrerenderPayload = (import.meta.client || !import.meta.server) && nuxtApp.isHydrating && Boolean(nuxtApp.payload.prerenderedAt || nuxtApp.payload.isCached);
+    await fetchSession({ headers, ...isHydratedPrerenderPayload ? { force: true } : {} });
+  }
   if (mode === "guest") {
     if (loggedIn.value)
       return navigateTo(redirectTo ?? config?.redirects?.guest ?? "/");
     return;
   }
-  if (!loggedIn.value)
-    return navigateTo(redirectTo ?? config?.redirects?.login ?? "/login");
+  if (!loggedIn.value) {
+    const resolved = resolveLoginRedirect({
+      route: to,
+      loginTarget: redirectTo ?? config?.redirects?.login ?? "/login",
+      config
+    });
+    return resolved.external ? navigateTo(resolved.to, { external: true }) : navigateTo(resolved.to);
+  }
   if (typeof auth === "object" && auth.user) {
     if (!user.value || !matchesUser(user.value, auth.user))
       throw createError({ statusCode: 403, statusMessage: "Access denied" });
   }
 });
+function resolveLoginRedirect(input) {
+  const { route, loginTarget, config } = input;
+  const preserveRedirect = config?.preserveRedirect ?? true;
+  const redirectQueryKey = config?.redirectQueryKey ?? "redirect";
+  if (!preserveRedirect)
+    return { to: loginTarget, external: false };
+  if (!loginTarget.startsWith("/") || loginTarget.startsWith("//"))
+    return { to: loginTarget, external: false };
+  const [beforeHash, hash = ""] = loginTarget.split("#", 2);
+  const [path, query = ""] = beforeHash.split("?", 2);
+  try {
+    const params2 = new URLSearchParams(query);
+    if (params2.has(redirectQueryKey))
+      return { to: loginTarget, external: false };
+  } catch {
+    return { to: loginTarget, external: false };
+  }
+  if (import.meta.server) {
+    const separator = query ? "&" : "";
+    const encodedRedirect = encodeURIComponent(route.fullPath);
+    const url = `${path}?${query}${separator}${redirectQueryKey}=${encodedRedirect}${hash ? `#${hash}` : ""}`;
+    return { to: url, external: true };
+  }
+  const params = new URLSearchParams(query);
+  const queryObj = {};
+  for (const [k, v] of params.entries())
+    queryObj[k] = v;
+  queryObj[redirectQueryKey] = route.fullPath;
+  return { to: { path, query: queryObj, ...hash ? { hash: `#${hash}` } : {} }, external: false };
+}
+async function getAuthRouteRules() {
+  if (!authRouteRulesPromise) {
+    authRouteRulesPromise = import("#auth/route-rules").then((mod) => mod.authRouteRules || {}).catch(() => ({}));
+  }
+  return await authRouteRulesPromise;
+}
+async function getRouteRulesMatcher() {
+  if (!routeRulesMatcherPromise) {
+    routeRulesMatcherPromise = getAuthRouteRules().then((authRouteRules) => {
+      if (!Object.keys(authRouteRules).length)
+        return null;
+      return toRouteMatcher(createRouter({ routes: authRouteRules }));
+    });
+  }
+  return await routeRulesMatcherPromise;
+}

package/dist/runtime/app/pages/__better-auth-devtools.vue

@@ -374,19 +374,13 @@ function getAccountActions(row) {
                   <UIcon name="i-lucide-settings-2" class="size-4" /><span>Module</span>
                 </div>
                 <div class="config-row">
-                  <span class="config-label">Login</span><span class="font-mono">{{ configData.config.module?.redirects?.login }}</span>
-                </div>
-                <div class="config-row">
-                  <span class="config-label">Guest</span><span class="font-mono">{{ configData.config.module?.redirects?.guest }}</span>
-                </div>
-                <div class="config-row">
-                  <span class="config-label">DB</span><UBadge :color="configData.config.module?.useDatabase ? 'success' : 'neutral'" variant="subtle" size="sm">
-                    {{ configData.config.module?.useDatabase ? "Hub" : "Off" }}
+                  <span class="config-label">DB</span><UBadge :color="configData.config.module?.databaseProvider === 'none' ? 'neutral' : 'success'" variant="subtle" size="sm">
+                    {{ configData.config.module?.databaseProvider === "nuxthub" ? "Hub" : "Off" }}
                   </UBadge>
                 </div>
                 <div class="config-row">
-                  <span class="config-label">KV</span><UBadge :color="configData.config.module?.secondaryStorage ? 'success' : 'neutral'" variant="subtle" size="sm">
-                    {{ configData.config.module?.secondaryStorage ? "On" : "Off" }}
+                  <span class="config-label">KV</span><UBadge :color="configData.config.module?.hubSecondaryStorage ? 'success' : 'neutral'" variant="subtle" size="sm">
+                    {{ configData.config.module?.hubSecondaryStorage ? configData.config.module.hubSecondaryStorage === "custom" ? "Custom" : "On" : "Off" }}
                   </UBadge>
                 </div>
               </div>

package/dist/runtime/composables.d.ts

@@ -0,0 +1,11 @@
+export { useAction } from './app/composables/useAction.js';
+export { useAuthAsyncData } from './app/composables/useAuthAsyncData.js';
+export { useAuthClient } from './app/composables/useAuthClient.js';
+export { useAuthClientAction } from './app/composables/useAuthClientAction.js';
+export { useAuthRequestFetch } from './app/composables/useAuthRequestFetch.js';
+export { useSignIn } from './app/composables/useSignIn.js';
+export { useSignUp } from './app/composables/useSignUp.js';
+export { useUserSession } from './app/composables/useUserSession.js';
+export type { SignOutOptions, UseUserSessionReturn } from './app/composables/useUserSession.js';
+export { useUserSessionState } from './app/composables/useUserSessionState.js';
+export type { UseUserSessionStateReturn } from './app/composables/useUserSessionState.js';

package/dist/runtime/composables.js

@@ -0,0 +1,9 @@
+export { useAction } from "./app/composables/useAction.js";
+export { useAuthAsyncData } from "./app/composables/useAuthAsyncData.js";
+export { useAuthClient } from "./app/composables/useAuthClient.js";
+export { useAuthClientAction } from "./app/composables/useAuthClientAction.js";
+export { useAuthRequestFetch } from "./app/composables/useAuthRequestFetch.js";
+export { useSignIn } from "./app/composables/useSignIn.js";
+export { useSignUp } from "./app/composables/useSignUp.js";
+export { useUserSession } from "./app/composables/useUserSession.js";
+export { useUserSessionState } from "./app/composables/useUserSessionState.js";

package/dist/runtime/config.d.ts

@@ -1,44 +1,98 @@
-import type { BetterAuthOptions } from 'better-auth';
-import type { ClientOptions } from 'better-auth/client';
-import type { CasingOption } from '../schema-generator.js';
-import type { ServerAuthContext } from './types/augment.js';
-export type { ServerAuthContext };
+import type { BetterAuthOptions, BetterAuthPlugin } from 'better-auth';
+import type { BetterAuthClientOptions } from 'better-auth/client';
+import type { Casing } from 'drizzle-orm/utils';
+import type { ServerAuthContext as BaseServerAuthContext } from './types/augment.js';
+import { createAuthClient } from 'better-auth/vue';
+export interface ServerAuthContextExtension {
+}
+export type ServerAuthContext = BaseServerAuthContext & ServerAuthContextExtension;
 export interface ClientAuthContext {
     siteUrl: string;
 }
-type ServerAuthConfig = Omit<BetterAuthOptions, 'database' | 'secret' | 'baseURL'>;
-type ClientAuthConfig = Omit<ClientOptions, 'baseURL'> & {
+export type ServerAuthConfig = Omit<BetterAuthOptions, 'secret' | 'baseURL'> & {
+    plugins?: readonly BetterAuthPlugin[];
+};
+export type ClientAuthConfig = Omit<BetterAuthClientOptions, 'baseURL'> & {
     baseURL?: string;
 };
 export type ServerAuthConfigFn = (ctx: ServerAuthContext) => ServerAuthConfig;
 export type ClientAuthConfigFn = (ctx: ClientAuthContext) => ClientAuthConfig;
+export type ModuleDatabaseProviderId = 'none' | 'nuxthub' | (string & {});
+export type EffectiveDatabaseProviderId = 'user' | ModuleDatabaseProviderId;
 export interface BetterAuthModuleOptions {
-    /** Server config path relative to rootDir. Default: 'server/auth.config' */
+    /** Client-only mode - skip server setup for external auth backends */
+    clientOnly?: boolean;
+    /** Server config path. Relative paths resolve from the layer that declares them. Default: 'server/auth.config' */
     serverConfig?: string;
-    /** Client config path relative to rootDir. Default: 'app/auth.config' */
+    /** Client config path. Relative paths resolve from the layer that declares them. Default: 'app/auth.config' */
     clientConfig?: string;
     redirects?: {
+        /** Where to redirect unauthenticated users. Default: '/login' */
         login?: string;
+        /** Where to redirect authenticated users on guest-only routes. Default: '/' */
         guest?: string;
+        /** Where to navigate after successful signIn/signUp when no onSuccess is provided. Default: no automatic navigation */
+        authenticated?: string;
+        /** Where to navigate after logout. Default: no automatic navigation */
+        logout?: string;
     };
-    /** Enable KV secondary storage for sessions. Requires hub.kv: true */
-    secondaryStorage?: boolean;
+    /**
+     * When redirecting unauthenticated users to the login route, append a query param
+     * containing the originally requested path (for safe "return-to" redirects).
+     *
+     * Default: true
+     */
+    preserveRedirect?: boolean;
+    /**
+     * Query param key used by preserveRedirect.
+     *
+     * Default: 'redirect'
+     */
+    redirectQueryKey?: string;
+    session?: {
+        /**
+         * When enabled, and session/user are already hydrated from SSR, skip the initial
+         * client `/api/auth/get-session` bootstrap request. This also skips Better Auth's
+         * session refresh manager on those pages.
+         *
+         * Default: false
+         */
+        skipHydratedSsrGetSession?: boolean;
+    };
+    /**
+     * Enable secondary storage for sessions.
+     * - `true`: Use NuxtHub KV (requires hub.kv: true)
+     * - `'custom'`: User provides own secondaryStorage in defineServerAuth()
+     * - `false` (default): No secondary storage from module
+     */
+    hubSecondaryStorage?: boolean | 'custom';
     /** Schema generation options. Must match drizzleAdapter config. */
     schema?: {
         /** Plural table names: user → users. Default: false */
         usePlural?: boolean;
         /** Column/table name casing. Explicit value takes precedence over hub.db.casing. */
-        casing?: CasingOption;
+        casing?: Casing;
     };
 }
 export interface AuthRuntimeConfig {
     redirects: {
         login: string;
         guest: string;
+        authenticated?: string;
+        logout?: string;
+    };
+    preserveRedirect: boolean;
+    redirectQueryKey: string;
+    useDatabase: boolean;
+    databaseProvider: EffectiveDatabaseProviderId;
+    clientOnly: boolean;
+    session: {
+        skipHydratedSsrGetSession: boolean;
     };
 }
 export interface AuthPrivateRuntimeConfig {
-    secondaryStorage: boolean;
+    hubSecondaryStorage: boolean | 'custom';
 }
-export declare function defineServerAuth<T extends ServerAuthConfig>(config: (ctx: ServerAuthContext) => T): (ctx: ServerAuthContext) => T;
-export declare function defineClientAuth(config: ClientAuthConfigFn): ClientAuthConfigFn;
+export declare function defineServerAuth<const R>(config: (ctx: ServerAuthContext) => R & ServerAuthConfig): (ctx: ServerAuthContext) => R;
+export declare function defineServerAuth<const R>(config: R & ServerAuthConfig): (ctx: ServerAuthContext) => R;
+export declare function defineClientAuth<T extends ClientAuthConfig>(config: T | ((ctx: ClientAuthContext) => T)): (baseURL: string) => ReturnType<typeof createAuthClient<T>>;