better-auth 1.6.11 → 1.6.12

package/dist/plugins/organization/adapter.mjs

@@ -1,6 +1,6 @@
 import { getDate } from "../../utils/date.mjs";
 import { parseJSON } from "../../client/parser.mjs";
-import { getCurrentAdapter } from "@better-auth/core/context";
+import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
 import { BetterAuthError } from "@better-auth/core/error";
 import { filterOutputFields } from "@better-auth/core/utils/db";
 //#region src/plugins/organization/adapter.ts
@@ -184,46 +184,49 @@ const getOrgAdapter = (context, options) => {
 			});
 		},
 		deleteMember: async ({ memberId, organizationId, userId: _userId }) => {
-			const adapter = await getCurrentAdapter(baseAdapter);
-			let userId;
-			if (!_userId) {
-				const member = await adapter.findOne({
+			return runWithTransaction(baseAdapter, async () => {
+				const adapter = await getCurrentAdapter(baseAdapter);
+				let userId;
+				if (!_userId) {
+					const member = await adapter.findOne({
+						model: "member",
+						where: [{
+							field: "id",
+							value: memberId
+						}]
+					});
+					if (!member) throw new BetterAuthError("Member not found");
+					userId = member.userId;
+				} else userId = _userId;
+				const member = await adapter.delete({
 					model: "member",
 					where: [{
 						field: "id",
 						value: memberId
 					}]
 				});
-				if (!member) throw new BetterAuthError("Member not found");
-				userId = member.userId;
-			} else userId = _userId;
-			const member = await adapter.delete({
-				model: "member",
-				where: [{
-					field: "id",
-					value: memberId
-				}]
+				if (options?.teams?.enabled) {
+					const teams = await adapter.findMany({
+						model: "team",
+						where: [{
+							field: "organizationId",
+							value: organizationId
+						}]
+					});
+					if (teams.length > 0) await adapter.deleteMany({
+						model: "teamMember",
+						where: [{
+							field: "userId",
+							value: userId
+						}, {
+							field: "teamId",
+							value: teams.map((team) => team.id),
+							operator: "in"
+						}]
+					});
+				}
+				return member;
 			});
-			if (options?.teams?.enabled) {
-				const teams = await adapter.findMany({
-					model: "team",
-					where: [{
-						field: "organizationId",
-						value: organizationId
-					}]
-				});
-				await Promise.all(teams.map((team) => adapter.deleteMany({
-					model: "teamMember",
-					where: [{
-						field: "teamId",
-						value: team.id
-					}, {
-						field: "userId",
-						value: userId
-					}]
-				})));
-			}
-			return member;
 		},
 		updateOrganization: async (organizationId, data) => {
 			const organization = await (await getCurrentAdapter(baseAdapter)).update({
@@ -244,29 +247,31 @@ const getOrgAdapter = (context, options) => {
 			}, orgAdditionalFields);
 		},
 		deleteOrganization: async (organizationId) => {
-			const adapter = await getCurrentAdapter(baseAdapter);
-			await adapter.deleteMany({
-				model: "member",
-				where: [{
-					field: "organizationId",
-					value: organizationId
-				}]
-			});
-			await adapter.deleteMany({
-				model: "invitation",
-				where: [{
-					field: "organizationId",
-					value: organizationId
-				}]
-			});
-			await adapter.delete({
-				model: "organization",
-				where: [{
-					field: "id",
-					value: organizationId
-				}]
+			return runWithTransaction(baseAdapter, async () => {
+				const adapter = await getCurrentAdapter(baseAdapter);
+				await adapter.deleteMany({
+					model: "member",
+					where: [{
+						field: "organizationId",
+						value: organizationId
+					}]
+				});
+				await adapter.deleteMany({
+					model: "invitation",
+					where: [{
+						field: "organizationId",
+						value: organizationId
+					}]
+				});
+				await adapter.delete({
+					model: "organization",
+					where: [{
+						field: "id",
+						value: organizationId
+					}]
+				});
+				return organizationId;
 			});
-			return organizationId;
 		},
 		setActiveOrganization: async (sessionToken, organizationId, ctx) => {
 			return await context.internalAdapter.updateSession(sessionToken, { activeOrganizationId: organizationId });

package/dist/plugins/organization/client.d.mts

@@ -273,6 +273,7 @@ declare const organizationClient: <CO extends OrganizationClientOptions>(options
     ROLE_NAME_IS_ALREADY_TAKEN: _better_auth_core_utils_error_codes0.RawError<"ROLE_NAME_IS_ALREADY_TAKEN">;
     CANNOT_DELETE_A_PRE_DEFINED_ROLE: _better_auth_core_utils_error_codes0.RawError<"CANNOT_DELETE_A_PRE_DEFINED_ROLE">;
     ROLE_IS_ASSIGNED_TO_MEMBERS: _better_auth_core_utils_error_codes0.RawError<"ROLE_IS_ASSIGNED_TO_MEMBERS">;
+    INVALID_TEAM_ID: _better_auth_core_utils_error_codes0.RawError<"INVALID_TEAM_ID">;
   };
 };
 declare const inferOrgAdditionalFields: <O extends {
@@ -371,4 +372,4 @@ declare const inferOrgAdditionalFields: <O extends {
   additionalFields: unknown;
 } ? K : never]: S_1[K] } : undefined : undefined : undefined : S;
 //#endregion
-export { clientSideHasPermission, inferOrgAdditionalFields, organizationClient };
+export { OrganizationClientOptions, clientSideHasPermission, inferOrgAdditionalFields, organizationClient };

package/dist/plugins/organization/error-codes.d.mts

@@ -60,6 +60,7 @@ declare const ORGANIZATION_ERROR_CODES: {
   ROLE_NAME_IS_ALREADY_TAKEN: _better_auth_core_utils_error_codes0.RawError<"ROLE_NAME_IS_ALREADY_TAKEN">;
   CANNOT_DELETE_A_PRE_DEFINED_ROLE: _better_auth_core_utils_error_codes0.RawError<"CANNOT_DELETE_A_PRE_DEFINED_ROLE">;
   ROLE_IS_ASSIGNED_TO_MEMBERS: _better_auth_core_utils_error_codes0.RawError<"ROLE_IS_ASSIGNED_TO_MEMBERS">;
+  INVALID_TEAM_ID: _better_auth_core_utils_error_codes0.RawError<"INVALID_TEAM_ID">;
 };
 //#endregion
 export { ORGANIZATION_ERROR_CODES };

package/dist/plugins/organization/error-codes.mjs

@@ -58,7 +58,8 @@ const ORGANIZATION_ERROR_CODES = defineErrorCodes({
 	INVALID_RESOURCE: "The provided permission includes an invalid resource",
 	ROLE_NAME_IS_ALREADY_TAKEN: "That role name is already taken",
 	CANNOT_DELETE_A_PRE_DEFINED_ROLE: "Cannot delete a pre-defined role",
-	ROLE_IS_ASSIGNED_TO_MEMBERS: "Cannot delete a role that is assigned to members. Please reassign the members to a different role first"
+	ROLE_IS_ASSIGNED_TO_MEMBERS: "Cannot delete a role that is assigned to members. Please reassign the members to a different role first",
+	INVALID_TEAM_ID: "Team id contains a reserved character"
 });
 //#endregion
 export { ORGANIZATION_ERROR_CODES };

package/dist/plugins/organization/routes/crud-invites.mjs

@@ -155,6 +155,9 @@ const createInvitation = (option) => {
 			member
 		}, ctx.context) : ctx.context.orgOptions.invitationLimit ?? 100;
 		if ((await adapter.findPendingInvitations({ organizationId })).length >= invitationLimit) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.INVITATION_LIMIT_REACHED);
+		if (ctx.context.orgOptions.teams?.enabled && "teamId" in ctx.body && ctx.body.teamId) {
+			if ((typeof ctx.body.teamId === "string" ? [ctx.body.teamId] : ctx.body.teamId).some((id) => id.includes(","))) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.INVALID_TEAM_ID);
+		}
 		if (ctx.context.orgOptions.teams && ctx.context.orgOptions.teams.enabled && typeof ctx.context.orgOptions.teams.maximumMembersPerTeam !== "undefined" && "teamId" in ctx.body && ctx.body.teamId) {
 			const teamIds = typeof ctx.body.teamId === "string" ? [ctx.body.teamId] : ctx.body.teamId;
 			for (const teamId of teamIds) {

package/dist/plugins/two-factor/index.mjs

@@ -2,7 +2,7 @@ import { mergeSchema } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { sessionMiddleware } from "../../api/routes/session.mjs";
+import { sensitiveSessionMiddleware, sessionMiddleware } from "../../api/routes/session.mjs";
 import { shouldRequirePassword, validatePassword } from "../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
@@ -138,7 +138,7 @@ const twoFactor = (options) => {
 			disableTwoFactor: createAuthEndpoint("/two-factor/disable", {
 				method: "POST",
 				body: disableTwoFactorBodySchema,
-				use: [sessionMiddleware],
+				use: [sensitiveSessionMiddleware],
 				metadata: { openapi: {
 					summary: "Disable two factor authentication",
 					description: "Use this endpoint to disable two factor authentication.",
@@ -224,6 +224,7 @@ const twoFactor = (options) => {
 				*/
 				deleteSessionCookie(ctx, true);
 				await ctx.context.internalAdapter.deleteSession(data.session.token);
+				ctx.context.setNewSession(null);
 				const maxAge = options?.twoFactorCookieMaxAge ?? 600;
 				const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME, { maxAge });
 				const identifier = `2fa-${generateRandomString(20)}`;

package/dist/plugins/username/index.d.mts

@@ -90,9 +90,20 @@ declare const username: (options?: UsernameOptions | undefined) => {
               name: string;
               image?: string | null | undefined;
             } & Record<string, unknown>, context: _better_auth_core0.GenericEndpointContext | null): Promise<{
+              data: {
+                username: string;
+                displayUsername: string;
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            } | {
               data: {
                 displayUsername?: string | undefined;
-                username?: string | undefined;
                 id: string;
                 createdAt: Date;
                 updatedAt: Date;
@@ -115,7 +126,18 @@ declare const username: (options?: UsernameOptions | undefined) => {
             }> & Record<string, unknown>, context: _better_auth_core0.GenericEndpointContext | null): Promise<{
               data: {
                 displayUsername?: string | undefined;
-                username?: string | undefined;
+                username: string;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                email?: string | undefined;
+                emailVerified?: boolean | undefined;
+                name?: string | undefined;
+                image?: string | null | undefined;
+              };
+            } | {
+              data: {
+                displayUsername?: string | undefined;
                 id?: string | undefined;
                 createdAt?: Date | undefined;
                 updatedAt?: Date | undefined;

package/dist/plugins/username/index.mjs

@@ -28,6 +28,31 @@ const username = (options) => {
 	const displayUsernameNormalizer = (displayUsername) => {
 		return options?.displayUsernameNormalization ? options.displayUsernameNormalization(displayUsername) : displayUsername;
 	};
+	const minUsernameLength = options?.minUsernameLength || 3;
+	const maxUsernameLength = options?.maxUsernameLength || 30;
+	const validator = options?.usernameValidator || defaultUsernameValidator;
+	const pathsWithHttpHookValidation = ["/sign-up/email", "/update-user"];
+	async function validateUsername(username, displayUsername, adapter, currentUserId) {
+		const usernameToValidate = options?.validationOrder?.username === "post-normalization" ? normalizer(username) : username;
+		if (usernameToValidate.length < minUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_SHORT);
+		if (usernameToValidate.length > maxUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
+		if (!await validator(usernameToValidate)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_USERNAME);
+		const normalizedUsername = normalizer(username);
+		const existingUser = await adapter.findOne({
+			model: "user",
+			where: [{
+				field: "username",
+				value: normalizedUsername
+			}]
+		});
+		if (existingUser) {
+			if (!currentUserId || existingUser.id !== currentUserId) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_IS_ALREADY_TAKEN);
+		}
+		if (displayUsername && options?.displayUsernameValidator) {
+			const displayUsernameToValidate = options?.validationOrder?.displayUsername === "post-normalization" ? displayUsernameNormalizer(displayUsername) : displayUsername;
+			if (!await options.displayUsernameValidator(displayUsernameToValidate)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_DISPLAY_USERNAME);
+		}
+	}
 	return {
 		id: "username",
 		version: PACKAGE_VERSION,
@@ -36,18 +61,39 @@ const username = (options) => {
 				create: { async before(user, context) {
 					const username = "username" in user ? user.username : null;
 					const displayUsername = "displayUsername" in user ? user.displayUsername : null;
+					const currentPath = context?.path;
+					const skipValidation = currentPath && pathsWithHttpHookValidation.includes(currentPath);
+					if (username) {
+						if (!skipValidation) await validateUsername(username, displayUsername, ctx.adapter);
+						return { data: {
+							...user,
+							username: normalizer(username),
+							displayUsername: displayUsername ? displayUsernameNormalizer(displayUsername) : username
+						} };
+					}
 					return { data: {
 						...user,
-						...username ? { username: normalizer(username) } : {},
 						...displayUsername ? { displayUsername: displayUsernameNormalizer(displayUsername) } : {}
 					} };
 				} },
 				update: { async before(user, context) {
 					const username = "username" in user ? user.username : null;
 					const displayUsername = "displayUsername" in user ? user.displayUsername : null;
+					const currentPath = context?.path;
+					const skipValidation = currentPath && pathsWithHttpHookValidation.includes(currentPath);
+					if (username) {
+						if (!skipValidation) {
+							const currentUserId = context?.context?.session?.user?.id || ("id" in user ? user.id : null);
+							await validateUsername(username, displayUsername, ctx.adapter, currentUserId);
+						}
+						return { data: {
+							...user,
+							username: normalizer(username),
+							...displayUsername ? { displayUsername: displayUsernameNormalizer(displayUsername) } : {}
+						} };
+					}
 					return { data: {
 						...user,
-						...username ? { username: normalizer(username) } : {},
 						...displayUsername ? { displayUsername: displayUsernameNormalizer(displayUsername) } : {}
 					} };
 				} }
@@ -153,7 +199,7 @@ const username = (options) => {
 					if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", USERNAME_ERROR_CODES.EMAIL_NOT_VERIFIED);
 					if (ctx.context.options?.emailVerification?.sendOnSignIn) {
 						const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
-						const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${ctx.body.callbackURL || "/"}`;
+						const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 						await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 							user,
 							url,

package/dist/state.d.mts

@@ -27,8 +27,8 @@ declare function generateGenericState(c: GenericEndpointContext, stateData: Stat
   state: string;
   codeVerifier: string;
 }>;
-declare function parseGenericState(c: GenericEndpointContext, state: string, settings?: {
-  cookieName: string;
+declare function parseGenericState(c: GenericEndpointContext, state: string | undefined, settings?: {
+  cookieName?: string;
   skipStateCookieCheck?: boolean;
 }): Promise<{
   [x: string]: unknown;

package/dist/state.mjs

@@ -20,10 +20,19 @@ const stateDataSchema = z.looseObject({
 var StateError = class extends BetterAuthError {
 	code;
 	details;
+	/**
+	* The per-flow `errorCallbackURL` recovered from the parsed state, when the
+	* failure happened after the state was successfully parsed (for example a
+	* nonce or state-cookie mismatch). It was origin-validated at sign-in, so
+	* the callback can safely redirect there instead of the default error page.
+	* Absent when the state could not be parsed at all.
+	*/
+	errorURL;
 	constructor(message, options) {
 		super(message, options);
 		this.code = options.code;
 		this.details = options.details;
+		this.errorURL = options.errorURL;
 	}
 };
 async function generateGenericState(c, stateData, settings) {
@@ -62,6 +71,7 @@ async function generateGenericState(c, stateData, settings) {
 	};
 }
 async function parseGenericState(c, state, settings) {
+	if (!state) throw new StateError("State not found in OAuth callback", { code: "state_not_found" });
 	const storeStateStrategy = c.context.oauthConfig.storeStateStrategy;
 	let parsedData;
 	if (storeStateStrategy === "cookie") {
@@ -86,7 +96,8 @@ async function parseGenericState(c, state, settings) {
 		}
 		if (!parsedData.oauthState || parsedData.oauthState !== state) throw new StateError("State mismatch: OAuth state parameter does not match stored state", {
 			code: "state_security_mismatch",
-			details: { state }
+			details: { state },
+			errorURL: parsedData.errorURL
 		});
 		expireCookie(c, stateCookie);
 	} else {
@@ -98,20 +109,23 @@ async function parseGenericState(c, state, settings) {
 		parsedData = stateDataSchema.parse(JSON.parse(data.value));
 		if (parsedData.oauthState !== void 0 && parsedData.oauthState !== state) throw new StateError("State mismatch: OAuth state parameter does not match stored state", {
 			code: "state_security_mismatch",
-			details: { state }
+			details: { state },
+			errorURL: parsedData.errorURL
 		});
 		const stateCookie = c.context.createAuthCookie(settings?.cookieName ?? "state");
 		const stateCookieValue = await c.getSignedCookie(stateCookie.name, c.context.secret);
 		if (!(settings?.skipStateCookieCheck ?? c.context.oauthConfig.skipStateCookieCheck) && (!stateCookieValue || stateCookieValue !== state)) throw new StateError("State mismatch: State not persisted correctly", {
 			code: "state_security_mismatch",
-			details: { state }
+			details: { state },
+			errorURL: parsedData.errorURL
 		});
 		expireCookie(c, stateCookie);
 		await c.context.internalAdapter.deleteVerificationByIdentifier(state);
 	}
 	if (parsedData.expiresAt < Date.now()) throw new StateError("Invalid state: request expired", {
 		code: "state_mismatch",
-		details: { expiresAt: parsedData.expiresAt }
+		details: { expiresAt: parsedData.expiresAt },
+		errorURL: parsedData.errorURL
 	});
 	return parsedData;
 }

package/dist/test-utils/headers.mjs

@@ -1,3 +1,4 @@
+import { applySetCookies } from "../cookies/cookie-utils.mjs";
 //#region src/test-utils/headers.ts
 /**
 * converts set cookie containing headers to
@@ -9,13 +10,7 @@ function convertSetCookieToCookie(headers) {
 		if (name.toLowerCase() === "set-cookie") setCookieHeaders.push(value);
 	});
 	if (setCookieHeaders.length === 0) return headers;
-	const existingCookies = headers.get("cookie") || "";
-	const cookies = existingCookies ? existingCookies.split("; ") : [];
-	setCookieHeaders.forEach((setCookie) => {
-		const cookiePair = setCookie.split(";")[0];
-		cookies.push(cookiePair.trim());
-	});
-	headers.set("cookie", cookies.join("; "));
+	applySetCookies(headers, setCookieHeaders);
 	return headers;
 }
 //#endregion

package/dist/test-utils/test-instance.d.mts

@@ -240,7 +240,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         allowedMediaTypes: string[];
         scope: "server";
       };
-    }, void>;
+    }, never>;
     readonly getSession: better_call0.StrictEndpoint<"/get-session", {
       method: ("GET" | "POST")[];
       operationId: string;
@@ -339,6 +339,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         callbackURL: zod.ZodOptional<zod.ZodString>;
         rememberMe: zod.ZodOptional<zod.ZodBoolean>;
       }, zod_v4_core0.$strip>, zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+      cloneRequest: true;
       metadata: {
         allowedMediaTypes: string[];
         $Infer: {
@@ -505,6 +506,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
       method: "POST";
       operationId: string;
       use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+      cloneRequest: true;
       body: zod.ZodObject<{
         email: zod.ZodString;
         password: zod.ZodString;
@@ -736,6 +738,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
     readonly sendVerificationEmail: better_call0.StrictEndpoint<"/send-verification-email", {
       method: "POST";
       operationId: string;
+      cloneRequest: true;
       body: zod.ZodObject<{
         email: zod.ZodEmail;
         callbackURL: zod.ZodOptional<zod.ZodString>;
@@ -2242,7 +2245,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         allowedMediaTypes: string[];
         scope: "server";
       };
-    }, void>;
+    }, never>;
     readonly getSession: better_call0.StrictEndpoint<"/get-session", {
       method: ("GET" | "POST")[];
       operationId: string;
@@ -2341,6 +2344,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         callbackURL: zod.ZodOptional<zod.ZodString>;
         rememberMe: zod.ZodOptional<zod.ZodBoolean>;
       }, zod_v4_core0.$strip>, zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+      cloneRequest: true;
       metadata: {
         allowedMediaTypes: string[];
         $Infer: {
@@ -2507,6 +2511,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
       method: "POST";
       operationId: string;
       use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+      cloneRequest: true;
       body: zod.ZodObject<{
         email: zod.ZodString;
         password: zod.ZodString;
@@ -2738,6 +2743,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
     readonly sendVerificationEmail: better_call0.StrictEndpoint<"/send-verification-email", {
       method: "POST";
       operationId: string;
+      cloneRequest: true;
       body: zod.ZodObject<{
         email: zod.ZodEmail;
         callbackURL: zod.ZodOptional<zod.ZodString>;
@@ -4247,7 +4253,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             allowedMediaTypes: string[];
             scope: "server";
           };
-        }, void>;
+        }, never>;
         readonly getSession: better_call0.StrictEndpoint<"/get-session", {
           method: ("GET" | "POST")[];
           operationId: string;
@@ -4346,6 +4352,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             callbackURL: zod.ZodOptional<zod.ZodString>;
             rememberMe: zod.ZodOptional<zod.ZodBoolean>;
           }, zod_v4_core0.$strip>, zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+          cloneRequest: true;
           metadata: {
             allowedMediaTypes: string[];
             $Infer: {
@@ -4512,6 +4519,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           method: "POST";
           operationId: string;
           use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodString;
             password: zod.ZodString;
@@ -4743,6 +4751,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         readonly sendVerificationEmail: better_call0.StrictEndpoint<"/send-verification-email", {
           method: "POST";
           operationId: string;
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodEmail;
             callbackURL: zod.ZodOptional<zod.ZodString>;
@@ -6249,7 +6258,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             allowedMediaTypes: string[];
             scope: "server";
           };
-        }, void>;
+        }, never>;
         readonly getSession: better_call0.StrictEndpoint<"/get-session", {
           method: ("GET" | "POST")[];
           operationId: string;
@@ -6348,6 +6357,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             callbackURL: zod.ZodOptional<zod.ZodString>;
             rememberMe: zod.ZodOptional<zod.ZodBoolean>;
           }, zod_v4_core0.$strip>, zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+          cloneRequest: true;
           metadata: {
             allowedMediaTypes: string[];
             $Infer: {
@@ -6514,6 +6524,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           method: "POST";
           operationId: string;
           use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodString;
             password: zod.ZodString;
@@ -6745,6 +6756,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         readonly sendVerificationEmail: better_call0.StrictEndpoint<"/send-verification-email", {
           method: "POST";
           operationId: string;
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodEmail;
             callbackURL: zod.ZodOptional<zod.ZodString>;
@@ -8325,7 +8337,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             allowedMediaTypes: string[];
             scope: "server";
           };
-        }, void>;
+        }, never>;
         readonly getSession: better_call0.StrictEndpoint<"/get-session", {
           method: ("GET" | "POST")[];
           operationId: string;
@@ -8424,6 +8436,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             callbackURL: zod.ZodOptional<zod.ZodString>;
             rememberMe: zod.ZodOptional<zod.ZodBoolean>;
           }, zod_v4_core0.$strip>, zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+          cloneRequest: true;
           metadata: {
             allowedMediaTypes: string[];
             $Infer: {
@@ -8590,6 +8603,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           method: "POST";
           operationId: string;
           use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodString;
             password: zod.ZodString;
@@ -8821,6 +8835,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         readonly sendVerificationEmail: better_call0.StrictEndpoint<"/send-verification-email", {
           method: "POST";
           operationId: string;
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodEmail;
             callbackURL: zod.ZodOptional<zod.ZodString>;
@@ -10327,7 +10342,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             allowedMediaTypes: string[];
             scope: "server";
           };
-        }, void>;
+        }, never>;
         readonly getSession: better_call0.StrictEndpoint<"/get-session", {
           method: ("GET" | "POST")[];
           operationId: string;
@@ -10426,6 +10441,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
             callbackURL: zod.ZodOptional<zod.ZodString>;
             rememberMe: zod.ZodOptional<zod.ZodBoolean>;
           }, zod_v4_core0.$strip>, zod.ZodRecord<zod.ZodString, zod.ZodAny>>;
+          cloneRequest: true;
           metadata: {
             allowedMediaTypes: string[];
             $Infer: {
@@ -10592,6 +10608,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           method: "POST";
           operationId: string;
           use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodString;
             password: zod.ZodString;
@@ -10823,6 +10840,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         readonly sendVerificationEmail: better_call0.StrictEndpoint<"/send-verification-email", {
           method: "POST";
           operationId: string;
+          cloneRequest: true;
           body: zod.ZodObject<{
             email: zod.ZodEmail;
             callbackURL: zod.ZodOptional<zod.ZodString>;

package/dist/utils/index.d.mts

@@ -1,4 +1,4 @@
 import { generateState, parseState } from "../oauth2/state.mjs";
 import { StateData, generateGenericState, parseGenericState } from "../state.mjs";
 import { HIDE_METADATA } from "./hide-metadata.mjs";
-import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL } from "./url.mjs";
+import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./url.mjs";

package/dist/utils/url.d.mts

@@ -1,6 +1,7 @@
 import { BaseURLConfig, DynamicBaseURLConfig } from "@better-auth/core";
 
 //#region src/utils/url.d.ts
+declare function trimTrailingSlashes(value: string): string;
 declare function getBaseURL(url?: string, path?: string, request?: Request, loadEnv?: boolean, trustedProxyHeaders?: boolean | undefined): string | undefined;
 declare function getOrigin(url: string): string | null;
 declare function getProtocol(url: string): string | null;
@@ -74,4 +75,4 @@ declare function resolveDynamicBaseURL(config: DynamicBaseURLConfig, source: Req
  */
 declare function resolveBaseURL(config: BaseURLConfig | undefined, basePath: string, source?: Request | Headers, loadEnv?: boolean, trustedProxyHeaders?: boolean): string | undefined;
 //#endregion
-export { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL };
+export { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };