Authentication and authorization for TypeScript applications.
Better Auth asks contributors to prove that a reported failure violates a contract before treating it as a bug. The guide checks versions and valid empty results, uses a shared Vitest harness, and keeps library code portable across Node.js, Bun, Deno, and Workers.
├── └── · symlink → AGENTS.md
01 / Behavioral framing
Reproduction is the start of triage. The file requires evidence from documented behavior, types, or established runtime semantics before treating the result as a bug.
Source excerpt starting at line 56.- A reproducible error is not automatically a bug. First prove the behavior violates Better Auth's documented contract, TypeScript contract, or established runtime semantics.
02 / Good and bad pairs
The session example distinguishes missing request headers from a real request without a session cookie, showing the API boundary that validation must preserve.
Source excerpt starting at line 59.- Distinguish invalid usage from valid empty state. Example: a server session check without request headers is invalid usage; a server session check with headers but no session cookie is a valid request that returns `null`.
03 / Hard prohibitions
A specific byte type gives the cross-runtime requirement a practical consequence in everyday code. Tests have an explicit exception.
Source excerpt starting at line 29.- Use `Uint8Array` instead of `Buffer` (except in tests)
04 / Verification by change type
The file prohibits the root command because it runs every package, and supplies a file-and-pattern command for focused feedback.
Source excerpt starting at line 19.- NEVER run `pnpm test` (runs all packages). Use `vitest path/to/test -t <pattern>`
These instructions explain how to work in Better Auth. Modem shows your agents what customers said, who is affected, and what changed.
