better-auth 1.7.21 → 1.7.22

package/dist/_virtual/_rolldown/runtime.mjs

@@ -1,4 +1,4 @@
-//#region \0rolldown/runtime.js
+// \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -23,5 +23,4 @@ var __copyProps = (to, from, except, desc) => {
 	return to;
 };
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
-//#endregion
 export { __exportAll, __reExport };

package/dist/adapters/index.d.mts

@@ -1,6 +1,5 @@
 import { AdapterFactory, AdapterFactoryConfig, AdapterFactoryCustomizeAdapterCreator, AdapterFactoryOptions, AdapterTestDebugLogs, CustomAdapter, createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName } from "@better-auth/core/db/adapter";
 export * from "@better-auth/core/db/adapter";
-//#region src/adapters/index.d.ts
 /**
  * @deprecated Use `createAdapterFactory` instead.
  */
@@ -17,5 +16,4 @@ export type AdapterConfig = AdapterFactoryConfig;
  * @deprecated Use `AdapterFactoryCustomizeAdapterCreator` instead.
  */
 export type CreateCustomAdapter = AdapterFactoryCustomizeAdapterCreator;
-//#endregion
 export { type AdapterFactory, type AdapterFactoryConfig, type AdapterFactoryCustomizeAdapterCreator, type AdapterFactoryOptions, type AdapterTestDebugLogs, type CustomAdapter, createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName };

package/dist/adapters/index.mjs

@@ -1,9 +1,8 @@
 import { createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName } from "@better-auth/core/db/adapter";
 export * from "@better-auth/core/db/adapter";
-//#region src/adapters/index.ts
+// src/adapters/index.ts
 /**
 * @deprecated Use `createAdapterFactory` instead.
 */
 const createAdapter = createAdapterFactory;
-//#endregion
 export { createAdapter, createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName };

package/dist/api/dispatch.d.mts

@@ -1,6 +1,5 @@
 import { AuthContext } from "@better-auth/core";
 import { Endpoint, EndpointContext, InputContext } from "better-call";
-//#region src/api/dispatch.d.ts
 /**
  * Input accepted by {@link dispatchAuthEndpoint}. `context` must already be a
  * resolved `AuthContext`; the caller owns `baseURL` resolution. A fresh
@@ -28,5 +27,4 @@ export type DispatchContext = Partial<InputContext<string, any> & EndpointContex
  * @param endpoint The endpoint to dispatch.
  * @param input Input context whose `context` is an already-resolved `AuthContext`.
  */
-export declare function dispatchAuthEndpoint(endpoint: Endpoint, input: DispatchContext): Promise<unknown>;
-//#endregion
+export declare function dispatchAuthEndpoint(endpoint: Endpoint, input: DispatchContext): Promise<unknown>;

package/dist/api/dispatch.mjs

@@ -6,7 +6,7 @@ import { APIError } from "@better-auth/core/error";
 import { createDefu } from "defu";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, createWithSpan } from "@better-auth/core/instrumentation";
 import { kAPIErrorHeaderSymbol, toResponse } from "better-call";
-//#region src/api/dispatch.ts
+// src/api/dispatch.ts
 const defuReplaceArrays = createDefu((obj, key, value) => {
 	if (Array.isArray(obj[key]) && Array.isArray(value)) {
 		obj[key] = value;
@@ -273,5 +273,4 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		} : result.response;
 	}));
 }
-//#endregion
 export { dispatchAuthEndpoint, getOperationId };

package/dist/api/index.d.mts

@@ -1,8 +1,8 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
+import "../index.mjs";
 import "../types/index.mjs";
 import { generateGenericState, parseGenericState } from "../state.mjs";
-import "../index.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
@@ -30,7 +30,6 @@ import { APIError } from "@better-auth/core/error";
 import { getIP } from "@better-auth/core/utils/ip";
 import { Middleware } from "better-call";
 import { AuthEndpoint, AuthMiddleware, NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
-//#region src/api/index.d.ts
 export declare function checkEndpointConflicts(options: BetterAuthOptions, logger: InternalLogger): void;
 export declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<AuthContext>, options: Option): {
   api: OverrideMerge<{
@@ -243,6 +242,7 @@ export declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awai
         disableRefresh: import("zod").ZodOptional<import("zod").ZodCoercedBoolean<unknown>>;
       }, import("zod/v4/core").$strip>>;
       requireHeaders: true;
+      disableBody: true;
       metadata: {
         openapi: {
           operationId: string;
@@ -2257,6 +2257,7 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
         disableRefresh: import("zod").ZodOptional<import("zod").ZodCoercedBoolean<unknown>>;
       }, import("zod/v4/core").$strip>>;
       requireHeaders: true;
+      disableBody: true;
       metadata: {
         openapi: {
           operationId: string;
@@ -4049,5 +4050,4 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
     }>;
   } extends (infer T_2) ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K]; } : never) & T_1> : never : never : never;
 };
-//#endregion
 export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -2,24 +2,24 @@ import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
-import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
-import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
-import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
-import { generateGenericState, parseGenericState } from "../state.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
-import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
+import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
 import { error } from "./routes/error.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
+import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
 import { signInEmail, signInSocial } from "./routes/sign-in.mjs";
 import { signOut } from "./routes/sign-out.mjs";
 import { signUpEmail } from "./routes/sign-up.mjs";
 import { updateSession } from "./routes/update-session.mjs";
-import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
-import { dispatchAuthEndpoint } from "./dispatch.mjs";
 import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
+import { dispatchAuthEndpoint } from "./dispatch.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { markSessionOutsideStore } from "./state/session-source.mjs";
+import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import { getIP } from "@better-auth/core/utils/ip";
@@ -27,7 +27,7 @@ import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createRouter } from "better-call";
 import { NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
-//#region src/api/index.ts
+// src/api/index.ts
 function checkEndpointConflicts(options, logger) {
 	const endpointRegistry = /* @__PURE__ */ new Map();
 	options.plugins?.forEach((plugin) => {
@@ -223,5 +223,4 @@ const router = (ctx, options) => {
 		}
 	});
 };
-//#endregion
 export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/middlewares/authorization.d.mts

@@ -1,4 +1,3 @@
-//#region src/api/middlewares/authorization.d.ts
 /**
  * Middleware that verifies the authenticated user owns a resource.
  * Must be used after sessionMiddleware in the `use` array.
@@ -68,5 +67,4 @@ export declare function requireOrgRole(config: {
   allowedRoles?: string[];
 }): import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
   verifiedMember: {};
-}>>;
-//#endregion
+}>>;

package/dist/api/middlewares/authorization.mjs

@@ -1,6 +1,6 @@
 import { APIError } from "@better-auth/core/error";
 import { createAuthMiddleware } from "@better-auth/core/api";
-//#region src/api/middlewares/authorization.ts
+// src/api/middlewares/authorization.ts
 /**
 * Middleware that verifies the authenticated user owns a resource.
 * Must be used after sessionMiddleware in the `use` array.
@@ -75,5 +75,4 @@ function requireOrgRole(config) {
 		return { verifiedMember: member };
 	});
 }
-//#endregion
 export { requireOrgRole, requireResourceOwnership };

package/dist/api/middlewares/origin-check.d.mts

@@ -1,5 +1,4 @@
 import { GenericEndpointContext } from "@better-auth/core";
-//#region src/api/middlewares/origin-check.d.ts
 /**
  * A middleware to validate callbackURL and origin against trustedOrigins.
  * Also handles CSRF protection using Fetch Metadata for first-login scenarios.
@@ -10,5 +9,4 @@ export declare const originCheck: (getValue: (ctx: GenericEndpointContext) => st
  * Middleware for CSRF protection using Fetch Metadata headers.
  * This prevents cross-site navigation login attacks while supporting progressive enhancement.
  */
-export declare const formCsrfMiddleware: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
-//#endregion
+export declare const formCsrfMiddleware: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;

package/dist/api/middlewares/origin-check.mjs

@@ -1,10 +1,10 @@
-import { getBaseURL, getOrigin } from "../../utils/url.mjs";
 import { matchesOriginPattern } from "../../auth/trusted-origins.mjs";
+import { getBaseURL, getOrigin } from "../../utils/url.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { deprecate } from "@better-auth/core/utils/deprecate";
-//#region src/api/middlewares/origin-check.ts
+// src/api/middlewares/origin-check.ts
 /**
 * Checks if CSRF should be skipped for backward compatibility.
 * Previously, disableOriginCheck also disabled CSRF checks.
@@ -151,5 +151,4 @@ async function validateFormCsrf(ctx) {
 	}
 	if (headers.get("origin") || headers.get("referer")) return await validateOrigin(ctx, true);
 }
-//#endregion
 export { formCsrfMiddleware, originCheck, originCheckMiddleware };

package/dist/api/rate-limiter/index.mjs

@@ -2,7 +2,7 @@ import { wildcardMatch } from "../../utils/wildcard.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { createRateLimitKey, getIP } from "@better-auth/core/utils/ip";
 import { normalizePathname } from "@better-auth/core/utils/url";
-//#region src/api/rate-limiter/index.ts
+// src/api/rate-limiter/index.ts
 const memory = /* @__PURE__ */ new Map();
 const MEMORY_STORE_MAX_ENTRIES = 1e5;
 function pruneMemoryStore() {
@@ -317,5 +317,4 @@ function getDefaultSpecialRules() {
 		max: 3
 	}];
 }
-//#endregion
 export { onRequestRateLimit };

package/dist/api/routes/account.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-//#region src/api/routes/account.d.ts
 export declare const listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
   method: "GET";
   use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -405,5 +404,4 @@ export declare const accountInfo: import("better-call").StrictEndpoint<"/account
   };
   user: import("@better-auth/core/oauth2").OAuth2UserInfo;
   data: object;
-}>;
-//#endregion
+}>;

package/dist/api/routes/account.mjs

@@ -1,22 +1,21 @@
+import { getAwaitableValue } from "../../context/helpers.mjs";
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
-import { parseAccountOutput } from "../../db/schema.mjs";
-import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
-import { getAwaitableValue } from "../../context/helpers.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { derivePurposeKey } from "../../crypto/purpose.mjs";
+import { parseAccountOutput } from "../../db/schema.mjs";
 import { resolveOAuthAccountKeyForAPI } from "../../oauth2/account-key.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
-import { toBoolean } from "../../utils/boolean.mjs";
-import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
+import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
-import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { additionalAuthorizationParamsSchema, parseStringBoolean, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-//#region src/api/routes/account.ts
+// src/api/routes/account.ts
 function parseStoredScopes(scope) {
 	if (!scope) return [];
 	return scope.split(",").map((s) => s.trim()).filter(Boolean);
@@ -208,7 +207,9 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			});
 		}
 		if (linkedAccount) throw APIError.from("CONFLICT", BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED);
-		if (!c.context.trustedProviders.includes(provider.id) && !toBoolean(linkingUserInfo.user.emailVerified) || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
+		const isTrustedProvider = c.context.trustedProviders.includes(provider.id);
+		const emailVerified = parseStringBoolean(linkingUserInfo.user.emailVerified) ?? false;
+		if (!isTrustedProvider && !emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
 			message: "Account not linked - linking not allowed",
 			code: "LINKING_NOT_ALLOWED"
 		});
@@ -626,5 +627,4 @@ const accountInfo = createAuthEndpoint("/account-info", {
 		}
 	});
 });
-//#endregion
 export { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount };

package/dist/api/routes/callback.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-//#region src/api/routes/callback.d.ts
 export declare const callbackOAuth: import("better-call").StrictEndpoint<"/callback/:id", {
   method: ("GET" | "POST")[];
   operationId: string;
@@ -25,5 +24,4 @@ export declare const callbackOAuth: import("better-call").StrictEndpoint<"/callb
     allowedMediaTypes: string[];
     scope: "server";
   };
-}, void>;
-//#endregion
+}, void>;

package/dist/api/routes/callback.mjs

@@ -1,16 +1,16 @@
-import { isAPIError } from "../../utils/is-api-error.mjs";
-import { setSessionCookie } from "../../cookies/index.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/state.mjs";
-import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
+import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import { isAPIError } from "../../utils/is-api-error.mjs";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-//#region src/api/routes/callback.ts
+// src/api/routes/callback.ts
 const schema = z.object({
 	code: z.string().optional(),
 	error: z.string().optional(),
@@ -170,5 +170,4 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 	}
 	throw c.redirect(toRedirectTo);
 });
-//#endregion
 export { callbackOAuth };

package/dist/api/routes/email-verification.d.mts

@@ -2,7 +2,6 @@ import { User } from "../../types/models.mjs";
 import "../../types/index.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
 import * as z from "zod";
-//#region src/api/routes/email-verification.d.ts
 export declare function createEmailVerificationToken(secret: string, email: string,
 /**
  * The email to update from
@@ -151,5 +150,4 @@ export declare const verifyEmail: import("better-call").StrictEndpoint<"/verify-
   };
 }, void | {
   status: boolean;
-}>;
-//#endregion
+}>;

package/dist/api/routes/email-verification.mjs

@@ -1,16 +1,16 @@
-import { originCheck } from "../middlewares/origin-check.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
 import { signJWT } from "../../crypto/jwt.mjs";
 import { parseUserOutput } from "../../db/schema.mjs";
-import { setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "./session.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
+import { originCheck } from "../middlewares/origin-check.mjs";
+import { getSessionFromCtx } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 import { jwtVerify } from "jose";
 import { JWTExpired } from "jose/errors";
-//#region src/api/routes/email-verification.ts
+// src/api/routes/email-verification.ts
 async function createEmailVerificationToken(secret, email, updateTo, expiresIn = 3600, extraPayload) {
 	return await signJWT({
 		email: email.toLowerCase(),
@@ -312,5 +312,4 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 		user: null
 	});
 });
-//#endregion
 export { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail };

package/dist/api/routes/error.d.mts

@@ -1,4 +1,3 @@
-//#region src/api/routes/error.d.ts
 export declare const error: import("better-call").StrictEndpoint<"/error", {
   method: "GET";
   metadata: {
@@ -20,5 +19,4 @@ export declare const error: import("better-call").StrictEndpoint<"/error", {
     };
     scope: "server";
   };
-}, Response>;
-//#endregion
+}, Response>;

package/dist/api/routes/error.mjs

@@ -2,7 +2,7 @@ import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { isProduction } from "@better-auth/core/env";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
-//#region src/api/routes/error.ts
+// src/api/routes/error.ts
 function sanitize(input) {
 	return input.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/&(?!amp;|lt;|gt;|quot;|#39;|#x[0-9a-fA-F]+;|#[0-9]+;)/g, "&amp;");
 }
@@ -383,5 +383,4 @@ const error = createAuthEndpoint("/error", {
 	});
 	return new Response(html(c.context.options, safeCode, safeDescription), { headers: { "Content-Type": "text/html" } });
 });
-//#endregion
 export { error };

package/dist/api/routes/ok.d.mts

@@ -1,4 +1,3 @@
-//#region src/api/routes/ok.d.ts
 export declare const ok: import("better-call").StrictEndpoint<"/ok", {
   method: "GET";
   metadata: {
@@ -28,5 +27,4 @@ export declare const ok: import("better-call").StrictEndpoint<"/ok", {
   };
 }, {
   ok: boolean;
-}>;
-//#endregion
+}>;

package/dist/api/routes/ok.mjs

@@ -1,6 +1,6 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { createAuthEndpoint } from "@better-auth/core/api";
-//#region src/api/routes/ok.ts
+// src/api/routes/ok.ts
 const ok = createAuthEndpoint("/ok", {
 	method: "GET",
 	metadata: {
@@ -23,5 +23,4 @@ const ok = createAuthEndpoint("/ok", {
 }, async (ctx) => {
 	return ctx.json({ ok: true });
 });
-//#endregion
 export { ok };

package/dist/api/routes/password.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-//#region src/api/routes/password.d.ts
 export declare const requestPasswordReset: import("better-call").StrictEndpoint<"/request-password-reset", {
   method: "POST";
   body: z.ZodObject<{
@@ -175,5 +174,4 @@ export declare const verifyPassword: import("better-call").StrictEndpoint<"/veri
   }>>[];
 }, {
   status: boolean;
-}>;
-//#endregion
+}>;

package/dist/api/routes/password.mjs

@@ -1,12 +1,12 @@
-import { originCheck } from "../middlewares/origin-check.mjs";
 import { getDate } from "../../utils/date.mjs";
-import { sensitiveSessionMiddleware } from "./session.mjs";
 import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword, validatePassword } from "../../utils/password.mjs";
+import { originCheck } from "../middlewares/origin-check.mjs";
+import { sensitiveSessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-//#region src/api/routes/password.ts
+// src/api/routes/password.ts
 function redirectError(ctx, callbackURL, query) {
 	const url = callbackURL ? new URL(callbackURL, ctx.baseURL) : new URL(`${ctx.baseURL}/error`);
 	if (query) Object.entries(query).forEach(([k, v]) => url.searchParams.set(k, v));
@@ -195,5 +195,4 @@ password: z.string().meta({ description: "The password to verify" }) }),
 	})) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
 	return ctx.json({ status: true });
 });
-//#endregion
 export { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword };

package/dist/api/routes/session.d.mts

@@ -3,7 +3,6 @@ import { Session, User } from "../../types/models.mjs";
 import "../../types/index.mjs";
 import { BetterAuthOptions, GenericEndpointContext } from "@better-auth/core";
 import * as z from "zod";
-//#region src/api/routes/session.d.ts
 export declare const getSession: <Option extends BetterAuthOptions>() => import("better-call").StrictEndpoint<"/get-session", {
   method: ("GET" | "POST")[];
   operationId: string;
@@ -12,6 +11,7 @@ export declare const getSession: <Option extends BetterAuthOptions>() => import(
     disableRefresh: z.ZodOptional<z.ZodCoercedBoolean<unknown>>;
   }, z.core.$strip>>;
   requireHeaders: true;
+  disableBody: true;
   metadata: {
     openapi: {
       operationId: string;
@@ -443,5 +443,4 @@ export declare const revokeOtherSessions: import("better-call").StrictEndpoint<"
   };
 }, {
   status: boolean;
-}>;
-//#endregion
+}>;

package/dist/api/routes/session.mjs

@@ -1,19 +1,20 @@
-import { isAPIError } from "../../utils/is-api-error.mjs";
 import { hasServerSessionStore } from "../../context/store-capabilities.mjs";
+import { decodeCookieCache, deleteSessionCookie, expireCookie, setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
+import { createSessionStore, getChunkedCookie, getSessionQuerySchema } from "../../cookies/session-store.mjs";
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
-import { createSessionStore, getChunkedCookie, getSessionQuerySchema } from "../../cookies/session-store.mjs";
-import { decodeCookieCache, deleteSessionCookie, expireCookie, setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
+import { isAPIError } from "../../utils/is-api-error.mjs";
 import { getShouldSkipSessionRefresh } from "../state/should-session-refresh.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
-//#region src/api/routes/session.ts
+// src/api/routes/session.ts
 const getSession = () => createAuthEndpoint("/get-session", {
 	method: ["GET", "POST"],
 	operationId: "getSession",
 	query: getSessionQuerySchema,
 	requireHeaders: true,
+	disableBody: true,
 	metadata: { openapi: {
 		operationId: "getSession",
 		description: "Get the current session",
@@ -32,6 +33,7 @@ const getSession = () => createAuthEndpoint("/get-session", {
 }, async (ctx) => {
 	ctx.setHeader("cache-control", "no-store");
 	ctx.setHeader("pragma", "no-cache");
+	ctx.context.session = null;
 	const deferSessionRefresh = ctx.context.options.session?.deferSessionRefresh;
 	const isPostRequest = ctx.method === "POST";
 	if (isPostRequest && !deferSessionRefresh) throw APIError.from("METHOD_NOT_ALLOWED", BASE_ERROR_CODES.METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED);
@@ -151,7 +153,6 @@ const getSession = () => createAuthEndpoint("/get-session", {
 			}
 		}
 		const session = await ctx.context.internalAdapter.findSession(sessionCookieToken);
-		ctx.context.session = session;
 		if (!session || session.session.expiresAt < /* @__PURE__ */ new Date()) {
 			deleteSessionCookie(ctx);
 			if (session) {
@@ -163,6 +164,7 @@ const getSession = () => createAuthEndpoint("/get-session", {
 			}
 			return ctx.json(null);
 		}
+		ctx.context.session = session;
 		/**
 		* We don't need to update the session if the user doesn't want to be remembered
 		* or if the session refresh is disabled
@@ -227,6 +229,7 @@ const getSession = () => createAuthEndpoint("/get-session", {
 			user: parsedUser
 		});
 	} catch (error) {
+		ctx.context.session = null;
 		if (isAPIError(error)) throw error;
 		ctx.context.logger.error("INTERNAL_SERVER_ERROR", error);
 		throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_GET_SESSION, { cause: error });
@@ -412,6 +415,7 @@ const revokeSession = createAuthEndpoint("/revoke-session", {
 			code: "INTERNAL_SERVER_ERROR"
 		});
 	}
+	if (token === ctx.context.session.session.token) deleteSessionCookie(ctx);
 	return ctx.json({ status: true });
 });
 /**
@@ -445,6 +449,7 @@ const revokeSessions = createAuthEndpoint("/revoke-sessions", {
 			code: "INTERNAL_SERVER_ERROR"
 		});
 	}
+	deleteSessionCookie(ctx);
 	return ctx.json({ status: true });
 });
 const revokeOtherSessions = createAuthEndpoint("/revoke-other-sessions", {
@@ -477,5 +482,4 @@ const revokeOtherSessions = createAuthEndpoint("/revoke-other-sessions", {
 	await Promise.all(otherSessions.map((session) => ctx.context.internalAdapter.deleteSession(session.token)));
 	return ctx.json({ status: true });
 });
-//#endregion
 export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };

package/dist/api/routes/sign-in.d.mts

@@ -1,7 +1,6 @@
 import { BetterAuthOptions } from "@better-auth/core";
 import { User } from "@better-auth/core/db";
 import * as z from "zod";
-//#region src/api/routes/sign-in.d.ts
 declare const socialSignInBodySchema: z.ZodObject<{
   callbackURL: z.ZodOptional<z.ZodString>;
   newUserCallbackURL: z.ZodOptional<z.ZodString>;
@@ -180,5 +179,4 @@ export declare const signInEmail: <O extends BetterAuthOptions>() => import("bet
   url?: string | undefined;
   user: User<O["user"], O["plugins"]>;
 }>;
-//#endregion
 export {};

package/dist/api/routes/sign-in.mjs

@@ -1,21 +1,21 @@
-import { formCsrfMiddleware } from "../middlewares/origin-check.mjs";
-import { parseUserOutput } from "../../db/schema.mjs";
-import { setSessionCookie } from "../../cookies/index.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { parseUserOutput } from "../../db/schema.mjs";
 import { resolveOAuthAccountKeyForAPI, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { assertPasswordNotTooLong } from "../../utils/password.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
+import { formCsrfMiddleware } from "../middlewares/origin-check.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
-import { assertPasswordNotTooLong } from "../../utils/password.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-//#region src/api/routes/sign-in.ts
+// src/api/routes/sign-in.ts
 const socialSignInBodySchema = z.object({
 	/**
 	* Callback URL to redirect to after the user
@@ -366,5 +366,4 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 		user: parseUserOutput(ctx.context.options, user)
 	});
 });
-//#endregion
 export { signInEmail, signInSocial };