Authentication and authorization for TypeScript applications.
A reproducible error is not automatically a bug: first establish which contract it violates.
The file, explained
Better Auth combines portable TypeScript conventions with a triage method for reported failures. Agents must distinguish invalid usage from valid empty results, check the reported version, and preserve intentional behavior. Its test guidance narrows execution to a focused Vitest command and requires the shared test harness, while runtime rules keep library code usable across Node.js, Bun, Deno, and Workers.
Quoted passages are verbatim. Open one to see it in the source.
01 / Behavioral framing
Reproduction is the start of triage. The file requires evidence from documented behavior, types, or established runtime semantics before treating the result as a bug.
Source excerpt starting at line 56.- A reproducible error is not automatically a bug. First prove the behavior violates Better Auth's documented contract, TypeScript contract, or established runtime semantics.
02 / Good and bad pairs
The session example distinguishes missing request headers from a real request without a session cookie. This makes a subtle API boundary concrete before an agent changes validation.
Source excerpt starting at line 59.- Distinguish invalid usage from valid empty state. Example: a server session check without request headers is invalid usage; a server session check with headers but no session cookie is a valid request that returns `null`.
03 / Hard prohibitions
A specific byte type gives the cross-runtime requirement a practical consequence in everyday code. Tests have an explicit exception.
Source excerpt starting at line 29.- Use `Uint8Array` instead of `Buffer` (except in tests)
04 / Verification by change type
The file prohibits the root command because it runs every package, and supplies a file-and-pattern command for focused feedback.
Source excerpt starting at line 19.- NEVER run `pnpm test` (runs all packages). Use `vitest path/to/test -t <pattern>`
Put it to work
Better Auth's file tells an agent how the codebase works. It cannot tell it which bug three customers hit this week. Modem keeps that context current and attaches it to the work.
Try Modem