From 3d0797fcf085c0fceed00eec61dce7e47e101c4e Mon Sep 17 00:00:00 2001
From: ToBinio <tobias.frischmann1@gmail.com>
Date: Wed, 12 Nov 2025 10:10:58 +0100
Subject: [PATCH] move to better-auth first draft

---
 README.md                                 |   3 +
 app/components/settings/GoogleLogin.vue   |  55 +--
 app/composables/login/useLoginEmail.ts    |  13 -
 app/composables/login/useLoginID.ts       |   9 +
 app/composables/login/useLoginImageUrl.ts |  10 +-
 app/composables/login/useLoginSession.ts  |  21 +
 app/composables/login/useLoginToken.ts    |   8 -
 app/composables/useInitData.ts            |  30 +-
 app/pages/index.vue                       |  10 +-
 app/utils/auth.ts                         |   3 +
 nuxt.config.ts                            |   1 -
 package.json                              |   5 +-
 pnpm-lock.yaml                            | 508 +++++++++++++++-------
 server/api/auth/.post.ts                  |  31 --
 server/api/auth/[...all].ts               |   5 +
 server/api/auth/renew.get.ts              |   9 -
 server/api/auth/valid.get.ts              |  14 -
 server/api/categories/.get.ts             |   4 +-
 server/api/categories/.post.ts            |   6 +-
 server/api/categories/[uuid].delete.ts    |   6 +-
 server/api/categories/sse.ts              |   4 +-
 server/api/tags/.get.ts                   |   4 +-
 server/api/tags/.post.ts                  |   6 +-
 server/api/tags/[uuid].delete.ts          |   6 +-
 server/api/tags/sse.ts                    |   4 +-
 server/api/todos/.get.ts                  |   4 +-
 server/api/todos/.post.ts                 |   6 +-
 server/api/todos/[uuid].delete.ts         |   6 +-
 server/api/todos/move.post.ts             |   6 +-
 server/api/todos/sse.ts                   |   4 +-
 server/auth.ts                            |  12 +
 server/utils/authHandle.ts                |  66 +--
 shared/auth.ts                            |  16 -
 33 files changed, 490 insertions(+), 405 deletions(-)
 delete mode 100644 app/composables/login/useLoginEmail.ts
 create mode 100644 app/composables/login/useLoginID.ts
 create mode 100644 app/composables/login/useLoginSession.ts
 delete mode 100644 app/composables/login/useLoginToken.ts
 create mode 100644 app/utils/auth.ts
 delete mode 100644 server/api/auth/.post.ts
 create mode 100644 server/api/auth/[...all].ts
 delete mode 100644 server/api/auth/renew.get.ts
 delete mode 100644 server/api/auth/valid.get.ts
 create mode 100644 server/auth.ts
 delete mode 100644 shared/auth.ts

diff --git a/README.md b/README.md
index 0529768..738839d 100644
--- a/README.md
+++ b/README.md
@@ -17,4 +17,7 @@ JWT_TTL_SECONDS=2592000 // 1Month
 
 UPSTASH_URL=<url>
 UPSTASH_TOKEN=<auth_token>
+
+BETTER_AUTH_SECRET=<secret>
+BETTER_AUTH_URL=http://localhost:3000
 ```
diff --git a/app/components/settings/GoogleLogin.vue b/app/components/settings/GoogleLogin.vue
index 3775f54..b35404b 100644
--- a/app/components/settings/GoogleLogin.vue
+++ b/app/components/settings/GoogleLogin.vue
@@ -6,59 +6,34 @@
 		PopoverRoot,
 		PopoverTrigger,
 	} from "reka-ui";
-	import type { ImplicitFlowSuccessResponse } from "vue3-google-signin";
+	import { useLoginID } from "~/composables/login/useLoginID";
 	import { useLoginImageUrl } from "~/composables/login/useLoginImageUrl";
-	import { useLoginToken } from "~/composables/login/useLoginToken";
+	import { authClient } from "~/utils/auth";
 
 	const { t } = useI18n();
 
-	const token = useLoginToken();
+	const id = useLoginID();
 	const userImage = useLoginImageUrl();
 
 	const isLoggedIn = computed(() => {
-		return !!token.value;
+		return !!id.value;
 	});
 
-	const { isReady, login } = useCodeClient({
-		onSuccess: handleLoginSuccess,
-		onError: handleLoginError,
-	});
-
-	async function handleLoginSuccess(response: ImplicitFlowSuccessResponse) {
-		const code = response.code;
-
-		const res = await $fetch("/api/auth/", {
-			method: "POST",
-			body: { code },
-			...useFetchOptions(),
-		}).catch(async (err) => {
-			//todo - show in toast
-			console.warn(err);
-			return undefined;
+	async function login() {
+		const data = await authClient.signIn.social({
+			provider: "google",
 		});
-
-		if (res) {
-			token.value = res.token;
-		}
-	}
-
-	async function handleLoginError() {
-		console.error("Login failed");
 	}
 
-	function logout() {
-		token.value = undefined;
+	async function logout() {
+		await authClient.signOut();
 	}
 </script>
 
 <template>
 	<div v-if="!isLoggedIn" class="flex gap-1">
-		<div class="border-secondary flex h-8 items-center rounded border-1 px-1">
-			<button
-				class="flex cursor-pointer gap-1"
-				:disabled="!isReady"
-				@click="() => login()"
-			>
+		<div class="border-secondary flex h-8 items-center rounded border px-1">
+			<button class="flex cursor-pointer gap-1" @click="() => login()">
 				{{ t("login") }}
 				<img src="/img/google_logo.svg" alt="Google Logo">
 			</button>
@@ -66,7 +41,7 @@
 	</div>
 	<div v-if="isLoggedIn" class="flex gap-1">
 		<div
-			class="border-secondary flex h-8 items-center gap-1 rounded border-1 px-1"
+			class="border-secondary flex h-8 items-center gap-1 rounded border px-1"
 		>
 			<PopoverRoot>
 				<PopoverTrigger class="h-6 cursor-pointer">
@@ -83,11 +58,7 @@
 						side="top"
 						:side-offset="5"
 					>
-						<button
-							class="h-6 cursor-pointer"
-							:disabled="!isReady"
-							@click="logout()"
-						>
+						<button class="h-6 cursor-pointer" @click="logout()">
 							{{ t("logout") }}
 						</button>
 
diff --git a/app/composables/login/useLoginEmail.ts b/app/composables/login/useLoginEmail.ts
deleted file mode 100644
index ca2ca3c..0000000
--- a/app/composables/login/useLoginEmail.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { decodeJwt } from "@/utils/jwt";
-import { useLoginToken } from "./useLoginToken";
-
-export function useLoginEmail() {
-	const token = useLoginToken();
-
-	return computed(() => {
-		if (!token.value) return undefined;
-
-		const payload = decodeJwt(token.value);
-		return payload?.email;
-	});
-}
diff --git a/app/composables/login/useLoginID.ts b/app/composables/login/useLoginID.ts
new file mode 100644
index 0000000..32b69c9
--- /dev/null
+++ b/app/composables/login/useLoginID.ts
@@ -0,0 +1,9 @@
+import { useLoginSession } from "./useLoginSession";
+
+export function useLoginID() {
+	const session = useLoginSession();
+
+	return computed(() => {
+		return session.value?.user?.id;
+	});
+}
diff --git a/app/composables/login/useLoginImageUrl.ts b/app/composables/login/useLoginImageUrl.ts
index 9c825f5..9881bdc 100644
--- a/app/composables/login/useLoginImageUrl.ts
+++ b/app/composables/login/useLoginImageUrl.ts
@@ -1,13 +1,9 @@
-import { decodeJwt } from "@/utils/jwt";
-import { useLoginToken } from "./useLoginToken";
+import { useLoginSession } from "./useLoginSession";
 
 export function useLoginImageUrl() {
-	const token = useLoginToken();
+	const session = useLoginSession();
 
 	return computed(() => {
-		if (!token.value) return undefined;
-
-		const payload = decodeJwt(token.value);
-		return payload?.picture;
+		return session.value?.user?.image;
 	});
 }
diff --git a/app/composables/login/useLoginSession.ts b/app/composables/login/useLoginSession.ts
new file mode 100644
index 0000000..27d9fec
--- /dev/null
+++ b/app/composables/login/useLoginSession.ts
@@ -0,0 +1,21 @@
+import type { Session, User } from "better-auth";
+
+export function useLoginSession() {
+	const session = ref<{ session: Session; user: User } | null>(null);
+
+	async function load() {
+		const { data } = await authClient.useSession(useFetch);
+
+		watch(
+			data,
+			() => {
+				session.value = data.value;
+			},
+			{ immediate: true },
+		);
+	}
+
+	load();
+
+	return session;
+}
diff --git a/app/composables/login/useLoginToken.ts b/app/composables/login/useLoginToken.ts
deleted file mode 100644
index b83d495..0000000
--- a/app/composables/login/useLoginToken.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-export function useLoginToken() {
-	const runtimeConfig = useRuntimeConfig();
-
-	return useCookie<string | undefined>("token", {
-		maxAge: parseInt(runtimeConfig.public.jwtTTL, 10),
-		sameSite: true,
-	});
-}
diff --git a/app/composables/useInitData.ts b/app/composables/useInitData.ts
index ac3bf7c..b284ad2 100644
--- a/app/composables/useInitData.ts
+++ b/app/composables/useInitData.ts
@@ -1,6 +1,6 @@
 import { useCategoryStore } from "~/stores/useCategoryStore";
 import { useTagStore } from "~/stores/useTagStore";
-import { useLoginToken } from "./login/useLoginToken";
+import { useLoginID } from "./login/useLoginID";
 
 export async function useInitdata() {
 	const todoStore = useTodoStore();
@@ -32,40 +32,22 @@ export async function useInitdata() {
 		categoryStore.reset();
 	}
 
-	const token = useLoginToken();
+	const id = useLoginID();
 
 	onMounted(async () => {
-		if (token.value) {
-			Init.client();
-
-			const fetch = useRequestFetch();
-			const data = await fetch("/api/auth/renew", {
-				...useFetchOptions(),
-			}).catch(async (err) => {
-				//todo - show in toast
-				console.warn(err);
-				return undefined;
-			});
-
-			if (data) {
-				token.value = data.token;
-			}
-		}
-
-		watch(token, async () => {
-			if (token.value) Init.all();
+		watch(id, async () => {
+			if (id.value) Init.all();
 			else reset();
 		});
 	});
 
 	await callOnce(async () => {
-		if (token.value) await Init.data();
+		if (id.value) await Init.data();
 	});
 
 	const focus = useWindowFocus();
-
 	watch([focus], async ([focus]) => {
-		if (focus && token.value) {
+		if (focus && id.value) {
 			await Init.data();
 		}
 	});
diff --git a/app/pages/index.vue b/app/pages/index.vue
index cd4210d..8e5e1b9 100644
--- a/app/pages/index.vue
+++ b/app/pages/index.vue
@@ -5,17 +5,19 @@
 	import HorizontalNav from "~/components/nav/HorizontalNav.vue";
 	import VerticalNav from "~/components/nav/VerticalNav.vue";
 	import Todos from "~/components/todo/Todos.vue";
-	import { useLoginToken } from "~/composables/login/useLoginToken";
 	import { useInitdata } from "~/composables/useInitData";
 
 	const isSettingsSheetOpen = ref(false);
 	const isFilterSheetOpen = ref(false);
 	const isNewSheetOpen = ref(false);
 
-	const token = useLoginToken();
-	if (!token.value) {
-		isSettingsSheetOpen.value = true;
+	async function checkLogIn() {
+		const session = await authClient.getSession();
+		if (!session.data) {
+			isSettingsSheetOpen.value = true;
+		}
 	}
+	checkLogIn();
 
 	await useInitdata();
 
diff --git a/app/utils/auth.ts b/app/utils/auth.ts
new file mode 100644
index 0000000..0018739
--- /dev/null
+++ b/app/utils/auth.ts
@@ -0,0 +1,3 @@
+import { createAuthClient } from "better-auth/vue";
+
+export const authClient = createAuthClient();
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 96920bc..6fa6b76 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -28,7 +28,6 @@ export default defineNuxtConfig({
 		"@nuxtjs/i18n",
 		"@pinia/nuxt",
 		"@vueuse/nuxt",
-		"nuxt-vue3-google-signin",
 	],
 	css: ["~/assets/css/main.css"],
 	vite: {
diff --git a/package.json b/package.json
index 492a4d1..386212d 100644
--- a/package.json
+++ b/package.json
@@ -22,12 +22,11 @@
 		"@pinia/nuxt": "^0.11.3",
 		"@tailwindcss/vite": "^4.1.17",
 		"@upstash/redis": "^1.35.6",
-		"google-auth-library": "^10.5.0",
+		"better-auth": "^1.3.34",
 		"h3": "^1.15.4",
 		"jsonwebtoken": "^9.0.2",
 		"marked": "^17.0.0",
 		"nuxt": "^4.2.1",
-		"nuxt-vue3-google-signin": "^0.0.13",
 		"pinia": "^3.0.4",
 		"reka-ui": "^2.6.0",
 		"std-env": "^3.10.0",
@@ -37,7 +36,6 @@
 		"vaul-vue": "^0.4.1",
 		"vue": "^3.5.24",
 		"vue-router": "^4.6.3",
-		"vue3-google-signin": "^2.1.1",
 		"zod": "^4.1.12"
 	},
 	"devDependencies": {
@@ -47,7 +45,6 @@
 		"@nuxtjs/device": "^3.2.4",
 		"@playwright/test": "^1.56.1",
 		"@tauri-apps/cli": "^2.9.3",
-		"@types/jsonwebtoken": "^9.0.10",
 		"@vueuse/nuxt": "^13.9.0",
 		"cross-env": "^10.1.0",
 		"typescript": "^5.9.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 60dfb8c..83cbddb 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -26,9 +26,9 @@ importers:
       '@upstash/redis':
         specifier: ^1.35.6
         version: 1.35.6
-      google-auth-library:
-        specifier: ^10.5.0
-        version: 10.5.0
+      better-auth:
+        specifier: ^1.3.34
+        version: 1.3.34(vue@3.5.24(typescript@5.9.3))
       h3:
         specifier: ^1.15.4
         version: 1.15.4
@@ -41,9 +41,6 @@ importers:
       nuxt:
         specifier: ^4.2.1
         version: 4.2.1(@biomejs/biome@2.3.4)(@netlify/blobs@9.1.2)(@parcel/watcher@2.5.1)(@types/node@24.10.0)(@upstash/redis@1.35.6)(@vue/compiler-sfc@3.5.24)(db0@0.3.4)(eslint@9.38.0(jiti@2.6.1))(ioredis@5.8.2)(lightningcss@1.30.2)(magicast@0.5.1)(optionator@0.9.4)(rollup@4.53.1)(terser@5.44.1)(typescript@5.9.3)(vite@7.2.2(@types/node@24.10.0)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.44.1)(yaml@2.8.1))(vue-tsc@3.1.3(typescript@5.9.3))(yaml@2.8.1)
-      nuxt-vue3-google-signin:
-        specifier: ^0.0.13
-        version: 0.0.13(magicast@0.5.1)(vue@3.5.24(typescript@5.9.3))
       pinia:
         specifier: ^3.0.4
         version: 3.0.4(typescript@5.9.3)(vue@3.5.24(typescript@5.9.3))
@@ -71,9 +68,6 @@ importers:
       vue-router:
         specifier: ^4.6.3
         version: 4.6.3(vue@3.5.24(typescript@5.9.3))
-      vue3-google-signin:
-        specifier: ^2.1.1
-        version: 2.1.1(vue@3.5.24(typescript@5.9.3))
       zod:
         specifier: ^4.1.12
         version: 4.1.12
@@ -96,9 +90,6 @@ importers:
       '@tauri-apps/cli':
         specifier: ^2.9.3
         version: 2.9.3
-      '@types/jsonwebtoken':
-        specifier: ^9.0.10
-        version: 9.0.10
       '@vueuse/nuxt':
         specifier: ^13.9.0
         version: 13.9.0(magicast@0.5.1)(nuxt@4.2.1(@biomejs/biome@2.3.4)(@netlify/blobs@9.1.2)(@parcel/watcher@2.5.1)(@types/node@24.10.0)(@upstash/redis@1.35.6)(@vue/compiler-sfc@3.5.24)(db0@0.3.4)(eslint@9.38.0(jiti@2.6.1))(ioredis@5.8.2)(lightningcss@1.30.2)(magicast@0.5.1)(optionator@0.9.4)(rollup@4.53.1)(terser@5.44.1)(typescript@5.9.3)(vite@7.2.2(@types/node@24.10.0)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.44.1)(yaml@2.8.1))(vue-tsc@3.1.3(typescript@5.9.3))(yaml@2.8.1))(vue@3.5.24(typescript@5.9.3))
@@ -237,6 +228,25 @@ packages:
     resolution: {integrity: sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==}
     engines: {node: '>=6.9.0'}
 
+  '@better-auth/core@1.3.34':
+    resolution: {integrity: sha512-rt/Bgl0Xa8OQ2DUMKCZEJ8vL9kUw4NCJsBP9Sj9uRhbsK8NEMPiznUOFMkUY2FvrslvfKN7H/fivwyHz9c7HzQ==}
+    peerDependencies:
+      '@better-auth/utils': 0.3.0
+      '@better-fetch/fetch': 1.1.18
+      better-call: 1.0.19
+      jose: ^6.1.0
+      kysely: ^0.28.5
+      nanostores: ^1.0.1
+
+  '@better-auth/telemetry@1.3.34':
+    resolution: {integrity: sha512-aQZ3wN90YMqV49diWxAMe1k7s2qb55KCsedCZne5PlgCjU4s3YtnqyjC5FEpzw2KY8l8rvR7DMAsDl13NjObKA==}
+
+  '@better-auth/utils@0.3.0':
+    resolution: {integrity: sha512-W+Adw6ZA6mgvnSnhOki270rwJ42t4XzSK6YWGF//BbVXL6SwCLWfyzBc1lN2m/4RM28KubdBKQ4X5VMoLRNPQw==}
+
+  '@better-fetch/fetch@1.1.18':
+    resolution: {integrity: sha512-rEFOE1MYIsBmoMJtQbl32PGHHXuG2hDxvEd7rUHE0vCBoFQVSDqaVs9hkZEtHCxRoY+CljXKFCOuJ8uxqw1LcA==}
+
   '@biomejs/biome@2.3.4':
     resolution: {integrity: sha512-TU08LXjBHdy0mEY9APtEtZdNQQijXUDSXR7IK1i45wgoPD5R0muK7s61QcFir6FpOj/RP1+YkPx5QJlycXUU3w==}
     engines: {node: '>=14.21.3'}
@@ -525,6 +535,9 @@ packages:
   '@floating-ui/vue@1.1.9':
     resolution: {integrity: sha512-BfNqNW6KA83Nexspgb9DZuz578R7HT8MZw1CfK9I6Ah4QReNWEJsXWHN+SdmOVLNGmTPDi+fDT535Df5PzMLbQ==}
 
+  '@hexagon/base64@1.1.28':
+    resolution: {integrity: sha512-lhqDEAvWixy3bZ+UOYbPwUbBkwBq5C1LAJ/xPC8Oi+lL54oyakv/npbA0aU2hgCsx/1NUd4IBvV03+aUBWxerw==}
+
   '@humanfs/core@0.19.1':
     resolution: {integrity: sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==}
     engines: {node: '>=18.18.0'}
@@ -667,6 +680,9 @@ packages:
   '@kwsites/promise-deferred@1.1.1':
     resolution: {integrity: sha512-GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw==}
 
+  '@levischuck/tiny-cbor@0.2.11':
+    resolution: {integrity: sha512-llBRm4dT4Z89aRsm6u2oEZ8tfwL/2l6BwpZ7JcyieouniDECM5AqNgr/y08zalEIvW3RSK4upYyybDcmjXqAow==}
+
   '@mapbox/node-pre-gyp@2.0.0':
     resolution: {integrity: sha512-llMXd39jtP0HpQLVI37Bf1m2ADlEb35GYSh1SDSLsBhR+5iCxiNGlT31yqbNtVHygHAtMy6dWFERpU2JgufhPg==}
     engines: {node: '>=18'}
@@ -696,6 +712,14 @@ packages:
     resolution: {integrity: sha512-7/vIJlMYrPJPlEW84V2yeRuG3QBu66dmlv9neTmZ5nXzwylhBEOhy11ai+34A8mHCSZI4mKns25w3HM9kaDdJg==}
     engines: {node: '>=16.0.0'}
 
+  '@noble/ciphers@2.0.1':
+    resolution: {integrity: sha512-xHK3XHPUW8DTAobU+G0XT+/w+JLM7/8k1UFdB5xg/zTFPnFCobhftzw8wl4Lw2aq/Rvir5pxfZV5fEazmeCJ2g==}
+    engines: {node: '>= 20.19.0'}
+
+  '@noble/hashes@2.0.1':
+    resolution: {integrity: sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==}
+    engines: {node: '>= 20.19.0'}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -1359,6 +1383,42 @@ packages:
     resolution: {integrity: sha512-dfUnCxiN9H4ap84DvD2ubjw+3vUNpstxa0TneY/Paat8a3R4uQZDLSvWjmznAY/DoahqTHl9V46HF/Zs3F29pg==}
     engines: {node: '>= 10.0.0'}
 
+  '@peculiar/asn1-android@2.5.0':
+    resolution: {integrity: sha512-t8A83hgghWQkcneRsgGs2ebAlRe54ns88p7ouv8PW2tzF1nAW4yHcL4uZKrFpIU+uszIRzTkcCuie37gpkId0A==}
+
+  '@peculiar/asn1-cms@2.5.0':
+    resolution: {integrity: sha512-p0SjJ3TuuleIvjPM4aYfvYw8Fk1Hn/zAVyPJZTtZ2eE9/MIer6/18ROxX6N/e6edVSfvuZBqhxAj3YgsmSjQ/A==}
+
+  '@peculiar/asn1-csr@2.5.0':
+    resolution: {integrity: sha512-ioigvA6WSYN9h/YssMmmoIwgl3RvZlAYx4A/9jD2qaqXZwGcNlAxaw54eSx2QG1Yu7YyBC5Rku3nNoHrQ16YsQ==}
+
+  '@peculiar/asn1-ecc@2.5.0':
+    resolution: {integrity: sha512-t4eYGNhXtLRxaP50h3sfO6aJebUCDGQACoeexcelL4roMFRRVgB20yBIu2LxsPh/tdW9I282gNgMOyg3ywg/mg==}
+
+  '@peculiar/asn1-pfx@2.5.0':
+    resolution: {integrity: sha512-Vj0d0wxJZA+Ztqfb7W+/iu8Uasw6hhKtCdLKXLG/P3kEPIQpqGI4P4YXlROfl7gOCqFIbgsj1HzFIFwQ5s20ug==}
+
+  '@peculiar/asn1-pkcs8@2.5.0':
+    resolution: {integrity: sha512-L7599HTI2SLlitlpEP8oAPaJgYssByI4eCwQq2C9eC90otFpm8MRn66PpbKviweAlhinWQ3ZjDD2KIVtx7PaVw==}
+
+  '@peculiar/asn1-pkcs9@2.5.0':
+    resolution: {integrity: sha512-UgqSMBLNLR5TzEZ5ZzxR45Nk6VJrammxd60WMSkofyNzd3DQLSNycGWSK5Xg3UTYbXcDFyG8pA/7/y/ztVCa6A==}
+
+  '@peculiar/asn1-rsa@2.5.0':
+    resolution: {integrity: sha512-qMZ/vweiTHy9syrkkqWFvbT3eLoedvamcUdnnvwyyUNv5FgFXA3KP8td+ATibnlZ0EANW5PYRm8E6MJzEB/72Q==}
+
+  '@peculiar/asn1-schema@2.5.0':
+    resolution: {integrity: sha512-YM/nFfskFJSlHqv59ed6dZlLZqtZQwjRVJ4bBAiWV08Oc+1rSd5lDZcBEx0lGDHfSoH3UziI2pXt2UM33KerPQ==}
+
+  '@peculiar/asn1-x509-attr@2.5.0':
+    resolution: {integrity: sha512-9f0hPOxiJDoG/bfNLAFven+Bd4gwz/VzrCIIWc1025LEI4BXO0U5fOCTNDPbbp2ll+UzqKsZ3g61mpBp74gk9A==}
+
+  '@peculiar/asn1-x509@2.5.0':
+    resolution: {integrity: sha512-CpwtMCTJvfvYTFMuiME5IH+8qmDe3yEWzKHe7OOADbGfq7ohxeLaXwQo0q4du3qs0AII3UbLCvb9NF/6q0oTKQ==}
+
+  '@peculiar/x509@1.14.0':
+    resolution: {integrity: sha512-Yc4PDxN3OrxUPiXgU63c+ZRXKGE8YKF2McTciYhUHFtHVB0KMnjeFSU0qpztGhsp4P0uKix4+J2xEpIEDu8oXg==}
+
   '@pinia/nuxt@0.11.3':
     resolution: {integrity: sha512-7WVNHpWx4qAEzOlnyrRC88kYrwnlR/PrThWT0XI1dSNyUAXu/KBv9oR37uCgYkZroqP5jn8DfzbkNF3BtKvE9w==}
     peerDependencies:
@@ -1582,6 +1642,13 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@simplewebauthn/browser@13.2.2':
+    resolution: {integrity: sha512-FNW1oLQpTJyqG5kkDg5ZsotvWgmBaC6jCHR7Ej0qUNep36Wl9tj2eZu7J5rP+uhXgHaLk+QQ3lqcw2vS5MX1IA==}
+
+  '@simplewebauthn/server@13.2.2':
+    resolution: {integrity: sha512-HcWLW28yTMGXpwE9VLx9J+N2KEUaELadLrkPEEI9tpI5la70xNEVEsu/C+m3u7uoq4FulLqZQhgBCzR9IZhFpA==}
+    engines: {node: '>=20.0.0'}
+
   '@sindresorhus/is@7.1.1':
     resolution: {integrity: sha512-rO92VvpgMc3kfiTjGT52LEtJ8Yc5kCWhZjLQ3LwlA4pSgPpQO7bVpYXParOD8Jwf+cVQECJo3yP/4I8aZtUQTQ==}
     engines: {node: '>=18'}
@@ -1774,12 +1841,6 @@ packages:
   '@types/json-schema@7.0.15':
     resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
 
-  '@types/jsonwebtoken@9.0.10':
-    resolution: {integrity: sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==}
-
-  '@types/ms@2.1.0':
-    resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
-
   '@types/node@24.10.0':
     resolution: {integrity: sha512-qzQZRBqkFsYyaSWXuEHc2WR9c0a0CXwiE5FWUvn7ZM+vdy1uZLfCunD38UzhuB7YN/J11ndbDBcTmOdxJo9Q7A==}
 
@@ -2076,6 +2137,10 @@ packages:
     resolution: {integrity: sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==}
     engines: {node: '>=10'}
 
+  asn1js@3.0.6:
+    resolution: {integrity: sha512-UOCGPYbl0tv8+006qks/dTgV9ajs97X2p0FAbyS2iyCRrmLSRolDaHdp+v/CLgnzHc3fVB+CwYiUmei7ndFcgA==}
+    engines: {node: '>=12.0.0'}
+
   ast-kit@2.2.0:
     resolution: {integrity: sha512-m1Q/RaVOnTp9JxPX+F+Zn7IcLYMzM8kZofDImfsKZd8MbR+ikdOzTeztStWqfrqIxZnYWryyI9ePm3NGjnZgGw==}
     engines: {node: '>=20.19.0'}
@@ -2123,8 +2188,37 @@ packages:
     resolution: {integrity: sha512-2NovHVesVF5TXefsGX1yzx1xgr7+m9JQenvz6FQY3qd+YXkKkYiv+vTCc7OriP9mcDZpTC5mAOYN4ocd29+erA==}
     hasBin: true
 
-  bignumber.js@9.3.1:
-    resolution: {integrity: sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==}
+  better-auth@1.3.34:
+    resolution: {integrity: sha512-LWA52SlvnUBJRbN8VLSTLILPomZY3zZAiLxVJCeSQ5uVmaIKkMBhERitkfJcXB9RJcfl4uP+3EqKkb6hX1/uiw==}
+    peerDependencies:
+      '@lynx-js/react': '*'
+      '@sveltejs/kit': '*'
+      next: '*'
+      react: '*'
+      react-dom: '*'
+      solid-js: '*'
+      svelte: '*'
+      vue: '*'
+    peerDependenciesMeta:
+      '@lynx-js/react':
+        optional: true
+      '@sveltejs/kit':
+        optional: true
+      next:
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+      solid-js:
+        optional: true
+      svelte:
+        optional: true
+      vue:
+        optional: true
+
+  better-call@1.0.19:
+    resolution: {integrity: sha512-sI3GcA1SCVa3H+CDHl8W8qzhlrckwXOTKhqq3OOPXjgn5aTOMIqGY34zLY/pHA6tRRMjTUC3lz5Mi7EbDA24Kw==}
 
   bindings@1.5.0:
     resolution: {integrity: sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==}
@@ -2649,9 +2743,6 @@ packages:
   exsolve@1.0.7:
     resolution: {integrity: sha512-VO5fQUzZtI6C+vx4w/4BWJpg3s/5l+6pRQEHzFRM8WFi4XffSP1Z+4qi7GbjWbvRQEbdIco5mIMq+zX4rPuLrw==}
 
-  extend@3.0.2:
-    resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==}
-
   fake-indexeddb@6.2.5:
     resolution: {integrity: sha512-CGnyrvbhPlWYMngksqrSSUT1BAVP49dZocrHuK0SvtR0D5TMs5wP0o3j7jexDJW01KSadjBp1M/71o/KR3nD1w==}
     engines: {node: '>=18'}
@@ -2749,14 +2840,6 @@ packages:
     resolution: {integrity: sha512-trLf4SzuuUxfusZADLINj+dE8clK1frKdmqiJNb1Es75fmI5oY6X2mxLVUciLLjxqw/xr72Dhy+lER6dGd02FQ==}
     engines: {node: '>=10'}
 
-  gaxios@7.1.3:
-    resolution: {integrity: sha512-YGGyuEdVIjqxkxVH1pUTMY/XtmmsApXrCVv5EU25iX6inEPbV+VakJfLealkBtJN69AQmh1eGOdCl9Sm1UP6XQ==}
-    engines: {node: '>=18'}
-
-  gcp-metadata@8.1.2:
-    resolution: {integrity: sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==}
-    engines: {node: '>=18'}
-
   gensync@1.0.0-beta.2:
     resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
     engines: {node: '>=6.9.0'}
@@ -2818,14 +2901,6 @@ packages:
     resolution: {integrity: sha512-oB4vkQGqlMl682wL1IlWd02tXCbquGWM4voPEI85QmNKCaw8zGTm1f1rubFgkg3Eli2PtKlFgrnmUqasbQWlkw==}
     engines: {node: '>=20'}
 
-  google-auth-library@10.5.0:
-    resolution: {integrity: sha512-7ABviyMOlX5hIVD60YOfHw4/CxOfBhyduaYB+wbFWCWoni4N7SLcV46hrVRktuBbZjFC9ONyqamZITN7q3n32w==}
-    engines: {node: '>=18'}
-
-  google-logging-utils@1.1.2:
-    resolution: {integrity: sha512-YsFPGVgDFf4IzSwbwIR0iaFJQFmR5Jp7V1WuYSjuRgAm9yWqsMhKE9YPlL+wvFLnc/wMiFV4SQUD9Y/JMpxIxQ==}
-    engines: {node: '>=14'}
-
   gopd@1.2.0:
     resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
     engines: {node: '>= 0.4'}
@@ -2833,10 +2908,6 @@ packages:
   graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
 
-  gtoken@8.0.0:
-    resolution: {integrity: sha512-+CqsMbHPiSTdtSO14O51eMNlrp9N79gmeqmXeouJOhfucAedHw9noVe/n5uJk3tbKE6a+6ZCQg3RPhVhHByAIw==}
-    engines: {node: '>=18'}
-
   gzip-size@7.0.0:
     resolution: {integrity: sha512-O1Ld7Dr+nqPnmGpdhzLmMTQ4vAsD+rHwMm1NLUmoUFFymBOMKxCCrtDxqdBRYXdeEPEi3SyoR4TizJLQrnKBNA==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -3014,6 +3085,9 @@ packages:
     resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
     hasBin: true
 
+  jose@6.1.1:
+    resolution: {integrity: sha512-GWSqjfOPf4cWOkBzw5THBjtGPhXKqYnfRBzh4Ni+ArTrQQ9unvmsA3oFLqaYKoKe5sjWmGu5wVKg9Ft1i+LQfg==}
+
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -3029,9 +3103,6 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
-  json-bigint@1.0.0:
-    resolution: {integrity: sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==}
-
   json-buffer@3.0.1:
     resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
 
@@ -3057,15 +3128,9 @@ packages:
   jwa@1.4.2:
     resolution: {integrity: sha512-eeH5JO+21J78qMvTIDdBXidBd6nG2kZjg5Ohz/1fpa28Z4CcsWUzJ1ZZyFq/3z3N17aZy+ZuBoHljASbL1WfOw==}
 
-  jwa@2.0.1:
-    resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==}
-
   jws@3.2.2:
     resolution: {integrity: sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==}
 
-  jws@4.0.0:
-    resolution: {integrity: sha512-KDncfTmOZoOMTFG4mBlG0qUIOlc03fmzH+ru6RgYVZhPkyiy/92Owlt/8UEN+a4TXR1FQetfIpJE8ApdvdVxTg==}
-
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
@@ -3087,6 +3152,10 @@ packages:
   kolorist@1.8.0:
     resolution: {integrity: sha512-Y+60/zizpJ3HRH8DCss+q95yr6145JXZo46OTpFvDZWLfRCE4qChOyk1b26nMaNpfHHgxagk9dXT5OP0Tfe+dQ==}
 
+  kysely@0.28.8:
+    resolution: {integrity: sha512-QUOgl5ZrS9IRuhq5FvOKFSsD/3+IA6MLE81/bOOTRA/YQpKDza2sFdN5g6JCB9BOpqMJDGefLCQ9F12hRS13TA==}
+    engines: {node: '>=20.0.0'}
+
   launch-editor@2.12.0:
     resolution: {integrity: sha512-giOHXoOtifjdHqUamwKq6c49GzBdLjvxrd2D+Q4V6uOHopJv7p9VJxikDsQ/CBXZbEITgUqSVHXLTG3VhPP1Dg==}
 
@@ -3351,6 +3420,10 @@ packages:
     engines: {node: ^18 || >=20}
     hasBin: true
 
+  nanostores@1.0.1:
+    resolution: {integrity: sha512-kNZ9xnoJYKg/AfxjrVL4SS0fKX++4awQReGqWnwTRHxeHGZ1FJFVgTqr/eMrNQdp0Tz7M7tG/TDaX8QfHDwVCw==}
+    engines: {node: ^20.0.0 || >=22.0.0}
+
   nanotar@0.2.0:
     resolution: {integrity: sha512-9ca1h0Xjvo9bEkE4UOxgAzLV0jHKe6LMaxo37ND2DAhhAtd0j8pR1Wxz+/goMrZO8AEZTWCmyaOsFI/W5AdpCQ==}
 
@@ -3436,10 +3509,6 @@ packages:
   nuxt-define@1.0.0:
     resolution: {integrity: sha512-CYZ2WjU+KCyCDVzjYUM4eEpMF0rkPmkpiFrybTqqQCRpUbPt2h3snswWIpFPXTi+osRCY6Og0W/XLAQgDL4FfQ==}
 
-  nuxt-vue3-google-signin@0.0.13:
-    resolution: {integrity: sha512-D1X3XLzyRjEexgndHiOsM21K7jdK3Ypuz6aIGLAQwxxh9TWM197C19keAd0ZknlhRYMLsTfq7erwkM7GtRoUBA==}
-    engines: {node: '>=20.0.0'}
-
   nuxt@4.2.1:
     resolution: {integrity: sha512-OE5ONizgwkKhjTGlUYB3ksE+2q2/I30QIYFl3N1yYz1r2rwhunGA3puUvqkzXwgLQ3AdsNcigPDmyQsqjbSdoQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -3843,6 +3912,13 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
+  pvtsutils@1.3.6:
+    resolution: {integrity: sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==}
+
+  pvutils@1.1.5:
+    resolution: {integrity: sha512-KTqnxsgGiQ6ZAzZCVlJH5eOjSnvlyEgx1m8bkRJfOhmGRqfo5KLvmAlACQkrjEtOQ4B7wF9TdSLIs9O90MX9xA==}
+    engines: {node: '>=16.0.0'}
+
   qs@6.14.0:
     resolution: {integrity: sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==}
     engines: {node: '>=0.6'}
@@ -3888,6 +3964,9 @@ packages:
     resolution: {integrity: sha512-DJnGAeenTdpMEH6uAJRK/uiyEIH9WVsUmoLwzudwGJUwZPp80PDBWPHXSAGNPwNvIXAbe7MSUB1zQFugFml66A==}
     engines: {node: '>=4'}
 
+  reflect-metadata@0.2.2:
+    resolution: {integrity: sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==}
+
   regexp-tree@0.1.27:
     resolution: {integrity: sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==}
     hasBin: true
@@ -3921,10 +4000,6 @@ packages:
   rfdc@1.4.1:
     resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
 
-  rimraf@5.0.10:
-    resolution: {integrity: sha512-l0OE8wL34P4nJH/H2ffoaniAokM2qSmrtXHmlpvYr5AVVX8msAyW0l8NVJFDxlSK4u3Uh/f41cQheDVdnYijwQ==}
-    hasBin: true
-
   rollup-plugin-visualizer@6.0.5:
     resolution: {integrity: sha512-9+HlNgKCVbJDs8tVtjQ43US12eqaiHyyiLMdBwQ7vSZPiHMysGNo2E88TAp1si5wx8NAoYriI2A5kuKfIakmJg==}
     engines: {node: '>=18'}
@@ -3943,6 +4018,9 @@ packages:
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
+  rou3@0.5.1:
+    resolution: {integrity: sha512-OXMmJ3zRk2xeXFGfA3K+EOPHC5u7RDFG7lIOx0X1pdnhUkI8MdVrbV+sNsD80ElpUZ+MRHdyxPnFthq9VHs8uQ==}
+
   run-applescript@7.1.0:
     resolution: {integrity: sha512-DPe5pVFaAsinSaV6QjQ6gdiedWDcRCbUuiQfQa2wmWV7+xC9bGulGI8+TdRmoFkAPaBXk8CrAbnlY2ISniJ47Q==}
     engines: {node: '>=18'}
@@ -3992,6 +4070,9 @@ packages:
     resolution: {integrity: sha512-61g9pCh0Vnh7IutZjtLGGpTA355+OPn2TyDv/6ivP2h/AdAVX9azsoxmg2/M6nZeQZNYBEwIcsne1mJd9oQItQ==}
     engines: {node: '>= 18'}
 
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
   setprototypeof@1.2.0:
     resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==}
 
@@ -4214,9 +4295,16 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4'
 
+  tslib@1.14.1:
+    resolution: {integrity: sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==}
+
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
+  tsyringe@4.10.0:
+    resolution: {integrity: sha512-axr3IdNuVIxnaK5XGEUFTu3YmAQ6lllgrvqfEoR16g/HGnYY/6We4oWENtAnzK6/LpJ2ur9PAb80RBt7/U4ugw==}
+    engines: {node: '>= 6.0.0'}
+
   type-check@0.4.0:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
@@ -4606,11 +4694,6 @@ packages:
     peerDependencies:
       typescript: '>=5.0.0'
 
-  vue3-google-signin@2.1.1:
-    resolution: {integrity: sha512-RwlwyeCv8+PZjK35C/UyJN4/9MH+Fsz4bJDO7IjtmRuOaTMrvmMmI6SP5qkJgD7w9MIKOCj5rYVFMAL7+NCM0A==}
-    peerDependencies:
-      vue: ^3
-
   vue@3.5.24:
     resolution: {integrity: sha512-uTHDOpVQTMjcGgrqFPSb8iO2m1DUvo+WbGqoXQz8Y1CeBYQ0FXf2z1gLRaBtHjlRz7zZUBHxjVB5VTLzYkvftg==}
     peerDependencies:
@@ -4899,6 +4982,31 @@ snapshots:
       '@babel/helper-string-parser': 7.27.1
       '@babel/helper-validator-identifier': 7.28.5
 
+  '@better-auth/core@1.3.34(@better-auth/utils@0.3.0)(@better-fetch/fetch@1.1.18)(better-call@1.0.19)(jose@6.1.1)(kysely@0.28.8)(nanostores@1.0.1)':
+    dependencies:
+      '@better-auth/utils': 0.3.0
+      '@better-fetch/fetch': 1.1.18
+      better-call: 1.0.19
+      jose: 6.1.1
+      kysely: 0.28.8
+      nanostores: 1.0.1
+      zod: 4.1.12
+
+  '@better-auth/telemetry@1.3.34(better-call@1.0.19)(jose@6.1.1)(kysely@0.28.8)(nanostores@1.0.1)':
+    dependencies:
+      '@better-auth/core': 1.3.34(@better-auth/utils@0.3.0)(@better-fetch/fetch@1.1.18)(better-call@1.0.19)(jose@6.1.1)(kysely@0.28.8)(nanostores@1.0.1)
+      '@better-auth/utils': 0.3.0
+      '@better-fetch/fetch': 1.1.18
+    transitivePeerDependencies:
+      - better-call
+      - jose
+      - kysely
+      - nanostores
+
+  '@better-auth/utils@0.3.0': {}
+
+  '@better-fetch/fetch@1.1.18': {}
+
   '@biomejs/biome@2.3.4':
     optionalDependencies:
       '@biomejs/cli-darwin-arm64': 2.3.4
@@ -5119,6 +5227,8 @@ snapshots:
       - '@vue/composition-api'
       - vue
 
+  '@hexagon/base64@1.1.28': {}
+
   '@humanfs/core@0.19.1': {}
 
   '@humanfs/node@0.16.7':
@@ -5284,6 +5394,8 @@ snapshots:
 
   '@kwsites/promise-deferred@1.1.1': {}
 
+  '@levischuck/tiny-cbor@0.2.11': {}
+
   '@mapbox/node-pre-gyp@2.0.0':
     dependencies:
       consola: 3.4.2
@@ -5337,6 +5449,10 @@ snapshots:
   '@netlify/runtime-utils@1.3.1':
     optional: true
 
+  '@noble/ciphers@2.0.1': {}
+
+  '@noble/hashes@2.0.1': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -6068,6 +6184,102 @@ snapshots:
       '@parcel/watcher-win32-ia32': 2.5.1
       '@parcel/watcher-win32-x64': 2.5.1
 
+  '@peculiar/asn1-android@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-cms@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      '@peculiar/asn1-x509-attr': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-csr@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-ecc@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pfx@2.5.0':
+    dependencies:
+      '@peculiar/asn1-cms': 2.5.0
+      '@peculiar/asn1-pkcs8': 2.5.0
+      '@peculiar/asn1-rsa': 2.5.0
+      '@peculiar/asn1-schema': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pkcs8@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-pkcs9@2.5.0':
+    dependencies:
+      '@peculiar/asn1-cms': 2.5.0
+      '@peculiar/asn1-pfx': 2.5.0
+      '@peculiar/asn1-pkcs8': 2.5.0
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      '@peculiar/asn1-x509-attr': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-rsa@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-schema@2.5.0':
+    dependencies:
+      asn1js: 3.0.6
+      pvtsutils: 1.3.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-x509-attr@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      asn1js: 3.0.6
+      tslib: 2.8.1
+
+  '@peculiar/asn1-x509@2.5.0':
+    dependencies:
+      '@peculiar/asn1-schema': 2.5.0
+      asn1js: 3.0.6
+      pvtsutils: 1.3.6
+      tslib: 2.8.1
+
+  '@peculiar/x509@1.14.0':
+    dependencies:
+      '@peculiar/asn1-cms': 2.5.0
+      '@peculiar/asn1-csr': 2.5.0
+      '@peculiar/asn1-ecc': 2.5.0
+      '@peculiar/asn1-pkcs9': 2.5.0
+      '@peculiar/asn1-rsa': 2.5.0
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      pvtsutils: 1.3.6
+      reflect-metadata: 0.2.2
+      tslib: 2.8.1
+      tsyringe: 4.10.0
+
   '@pinia/nuxt@0.11.3(magicast@0.5.1)(pinia@3.0.4(typescript@5.9.3)(vue@3.5.24(typescript@5.9.3)))':
     dependencies:
       '@nuxt/kit': 4.2.1(magicast@0.5.1)
@@ -6237,6 +6449,19 @@ snapshots:
   '@rollup/rollup-win32-x64-msvc@4.53.1':
     optional: true
 
+  '@simplewebauthn/browser@13.2.2': {}
+
+  '@simplewebauthn/server@13.2.2':
+    dependencies:
+      '@hexagon/base64': 1.1.28
+      '@levischuck/tiny-cbor': 0.2.11
+      '@peculiar/asn1-android': 2.5.0
+      '@peculiar/asn1-ecc': 2.5.0
+      '@peculiar/asn1-rsa': 2.5.0
+      '@peculiar/asn1-schema': 2.5.0
+      '@peculiar/asn1-x509': 2.5.0
+      '@peculiar/x509': 1.14.0
+
   '@sindresorhus/is@7.1.1': {}
 
   '@sindresorhus/merge-streams@4.0.0': {}
@@ -6378,16 +6603,10 @@ snapshots:
 
   '@types/json-schema@7.0.15': {}
 
-  '@types/jsonwebtoken@9.0.10':
-    dependencies:
-      '@types/ms': 2.1.0
-      '@types/node': 24.10.0
-
-  '@types/ms@2.1.0': {}
-
   '@types/node@24.10.0':
     dependencies:
       undici-types: 7.16.0
+    optional: true
 
   '@types/parse-path@7.1.0':
     dependencies:
@@ -6816,6 +7035,12 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  asn1js@3.0.6:
+    dependencies:
+      pvtsutils: 1.3.6
+      pvutils: 1.1.5
+      tslib: 2.8.1
+
   ast-kit@2.2.0:
     dependencies:
       '@babel/parser': 7.28.5
@@ -6850,7 +7075,32 @@ snapshots:
 
   baseline-browser-mapping@2.8.25: {}
 
-  bignumber.js@9.3.1: {}
+  better-auth@1.3.34(vue@3.5.24(typescript@5.9.3)):
+    dependencies:
+      '@better-auth/core': 1.3.34(@better-auth/utils@0.3.0)(@better-fetch/fetch@1.1.18)(better-call@1.0.19)(jose@6.1.1)(kysely@0.28.8)(nanostores@1.0.1)
+      '@better-auth/telemetry': 1.3.34(better-call@1.0.19)(jose@6.1.1)(kysely@0.28.8)(nanostores@1.0.1)
+      '@better-auth/utils': 0.3.0
+      '@better-fetch/fetch': 1.1.18
+      '@noble/ciphers': 2.0.1
+      '@noble/hashes': 2.0.1
+      '@simplewebauthn/browser': 13.2.2
+      '@simplewebauthn/server': 13.2.2
+      better-call: 1.0.19
+      defu: 6.1.4
+      jose: 6.1.1
+      kysely: 0.28.8
+      nanostores: 1.0.1
+      zod: 4.1.12
+    optionalDependencies:
+      vue: 3.5.24(typescript@5.9.3)
+
+  better-call@1.0.19:
+    dependencies:
+      '@better-auth/utils': 0.3.0
+      '@better-fetch/fetch': 1.1.18
+      rou3: 0.5.1
+      set-cookie-parser: 2.7.2
+      uncrypto: 0.1.3
 
   bindings@1.5.0:
     dependencies:
@@ -7118,7 +7368,8 @@ snapshots:
 
   csstype@3.1.3: {}
 
-  data-uri-to-buffer@4.0.1: {}
+  data-uri-to-buffer@4.0.1:
+    optional: true
 
   db0@0.3.4: {}
 
@@ -7398,8 +7649,6 @@ snapshots:
 
   exsolve@1.0.7: {}
 
-  extend@3.0.2: {}
-
   fake-indexeddb@6.2.5: {}
 
   fast-deep-equal@3.1.3: {}
@@ -7432,6 +7681,7 @@ snapshots:
     dependencies:
       node-domexception: 1.0.0
       web-streams-polyfill: 3.3.3
+    optional: true
 
   file-entry-cache@8.0.0:
     dependencies:
@@ -7470,6 +7720,7 @@ snapshots:
   formdata-polyfill@4.0.10:
     dependencies:
       fetch-blob: 3.2.0
+    optional: true
 
   fraction.js@4.3.7: {}
 
@@ -7485,23 +7736,6 @@ snapshots:
 
   fuse.js@7.1.0: {}
 
-  gaxios@7.1.3:
-    dependencies:
-      extend: 3.0.2
-      https-proxy-agent: 7.0.6
-      node-fetch: 3.3.2
-      rimraf: 5.0.10
-    transitivePeerDependencies:
-      - supports-color
-
-  gcp-metadata@8.1.2:
-    dependencies:
-      gaxios: 7.1.3
-      google-logging-utils: 1.1.2
-      json-bigint: 1.0.0
-    transitivePeerDependencies:
-      - supports-color
-
   gensync@1.0.0-beta.2: {}
 
   get-caller-file@2.0.5: {}
@@ -7582,32 +7816,11 @@ snapshots:
       slash: 5.1.0
       unicorn-magic: 0.3.0
 
-  google-auth-library@10.5.0:
-    dependencies:
-      base64-js: 1.5.1
-      ecdsa-sig-formatter: 1.0.11
-      gaxios: 7.1.3
-      gcp-metadata: 8.1.2
-      google-logging-utils: 1.1.2
-      gtoken: 8.0.0
-      jws: 4.0.0
-    transitivePeerDependencies:
-      - supports-color
-
-  google-logging-utils@1.1.2: {}
-
   gopd@1.2.0:
     optional: true
 
   graceful-fs@4.2.11: {}
 
-  gtoken@8.0.0:
-    dependencies:
-      gaxios: 7.1.3
-      jws: 4.0.0
-    transitivePeerDependencies:
-      - supports-color
-
   gzip-size@7.0.0:
     dependencies:
       duplexer: 0.1.2
@@ -7774,6 +7987,8 @@ snapshots:
 
   jiti@2.6.1: {}
 
+  jose@6.1.1: {}
+
   js-tokens@4.0.0: {}
 
   js-tokens@9.0.1: {}
@@ -7784,10 +7999,6 @@ snapshots:
 
   jsesc@3.1.0: {}
 
-  json-bigint@1.0.0:
-    dependencies:
-      bignumber.js: 9.3.1
-
   json-buffer@3.0.1: {}
 
   json-schema-traverse@0.4.1: {}
@@ -7822,22 +8033,11 @@ snapshots:
       ecdsa-sig-formatter: 1.0.11
       safe-buffer: 5.2.1
 
-  jwa@2.0.1:
-    dependencies:
-      buffer-equal-constant-time: 1.0.1
-      ecdsa-sig-formatter: 1.0.11
-      safe-buffer: 5.2.1
-
   jws@3.2.2:
     dependencies:
       jwa: 1.4.2
       safe-buffer: 5.2.1
 
-  jws@4.0.0:
-    dependencies:
-      jwa: 2.0.1
-      safe-buffer: 5.2.1
-
   keyv@4.5.4:
     dependencies:
       json-buffer: 3.0.1
@@ -7852,6 +8052,8 @@ snapshots:
 
   kolorist@1.8.0: {}
 
+  kysely@0.28.8: {}
+
   launch-editor@2.12.0:
     dependencies:
       picocolors: 1.1.1
@@ -8087,6 +8289,8 @@ snapshots:
 
   nanoid@5.1.6: {}
 
+  nanostores@1.0.1: {}
+
   nanotar@0.2.0: {}
 
   natural-compare@1.4.0: {}
@@ -8205,7 +8409,8 @@ snapshots:
 
   node-addon-api@7.1.1: {}
 
-  node-domexception@1.0.0: {}
+  node-domexception@1.0.0:
+    optional: true
 
   node-fetch-native@1.6.7: {}
 
@@ -8218,6 +8423,7 @@ snapshots:
       data-uri-to-buffer: 4.0.1
       fetch-blob: 3.2.0
       formdata-polyfill: 4.0.10
+    optional: true
 
   node-forge@1.3.1: {}
 
@@ -8250,16 +8456,6 @@ snapshots:
 
   nuxt-define@1.0.0: {}
 
-  nuxt-vue3-google-signin@0.0.13(magicast@0.5.1)(vue@3.5.24(typescript@5.9.3)):
-    dependencies:
-      '@nuxt/kit': 4.2.1(magicast@0.5.1)
-      defu: 6.1.4
-      unimport: 5.5.0
-      vue3-google-signin: 2.1.1(vue@3.5.24(typescript@5.9.3))
-    transitivePeerDependencies:
-      - magicast
-      - vue
-
   nuxt@4.2.1(@biomejs/biome@2.3.4)(@netlify/blobs@9.1.2)(@parcel/watcher@2.5.1)(@types/node@24.10.0)(@upstash/redis@1.35.6)(@vue/compiler-sfc@3.5.24)(db0@0.3.4)(eslint@9.38.0(jiti@2.6.1))(ioredis@5.8.2)(lightningcss@1.30.2)(magicast@0.5.1)(optionator@0.9.4)(rollup@4.53.1)(terser@5.44.1)(typescript@5.9.3)(vite@7.2.2(@types/node@24.10.0)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.44.1)(yaml@2.8.1))(vue-tsc@3.1.3(typescript@5.9.3))(yaml@2.8.1):
     dependencies:
       '@dxup/nuxt': 0.2.1(magicast@0.5.1)
@@ -8824,6 +9020,12 @@ snapshots:
 
   punycode@2.3.1: {}
 
+  pvtsutils@1.3.6:
+    dependencies:
+      tslib: 2.8.1
+
+  pvutils@1.1.5: {}
+
   qs@6.14.0:
     dependencies:
       side-channel: 1.1.0
@@ -8876,6 +9078,8 @@ snapshots:
     dependencies:
       redis-errors: 1.2.0
 
+  reflect-metadata@0.2.2: {}
+
   regexp-tree@0.1.27: {}
 
   reka-ui@2.6.0(typescript@5.9.3)(vue@3.5.24(typescript@5.9.3)):
@@ -8911,10 +9115,6 @@ snapshots:
 
   rfdc@1.4.1: {}
 
-  rimraf@5.0.10:
-    dependencies:
-      glob: 10.4.5
-
   rollup-plugin-visualizer@6.0.5(rollup@4.53.1):
     dependencies:
       open: 8.4.2
@@ -8952,6 +9152,8 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.53.1
       fsevents: 2.3.3
 
+  rou3@0.5.1: {}
+
   run-applescript@7.1.0: {}
 
   run-parallel@1.2.0:
@@ -9007,6 +9209,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  set-cookie-parser@2.7.2: {}
+
   setprototypeof@1.2.0: {}
 
   shebang-command@2.0.0:
@@ -9232,8 +9436,14 @@ snapshots:
     dependencies:
       typescript: 5.9.3
 
+  tslib@1.14.1: {}
+
   tslib@2.8.1: {}
 
+  tsyringe@4.10.0:
+    dependencies:
+      tslib: 1.14.1
+
   type-check@0.4.0:
     dependencies:
       prelude-ls: 1.2.1
@@ -9262,7 +9472,8 @@ snapshots:
       magic-string: 0.30.21
       unplugin: 2.3.10
 
-  undici-types@7.16.0: {}
+  undici-types@7.16.0:
+    optional: true
 
   unenv@2.0.0-rc.24:
     dependencies:
@@ -9561,10 +9772,6 @@ snapshots:
       '@vue/language-core': 3.1.3(typescript@5.9.3)
       typescript: 5.9.3
 
-  vue3-google-signin@2.1.1(vue@3.5.24(typescript@5.9.3)):
-    dependencies:
-      vue: 3.5.24(typescript@5.9.3)
-
   vue@3.5.24(typescript@5.9.3):
     dependencies:
       '@vue/compiler-dom': 3.5.24
@@ -9575,7 +9782,8 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.3
 
-  web-streams-polyfill@3.3.3: {}
+  web-streams-polyfill@3.3.3:
+    optional: true
 
   webidl-conversions@3.0.1: {}
 
diff --git a/server/api/auth/.post.ts b/server/api/auth/.post.ts
deleted file mode 100644
index 878b952..0000000
--- a/server/api/auth/.post.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import { OAuth2Client } from "google-auth-library";
-import jwt from "jsonwebtoken";
-import type { JwtPayload, JwtToken } from "#shared/types";
-
-const runtimeConfig = useRuntimeConfig();
-const oAuthClient = new OAuth2Client(
-	runtimeConfig.public.googleClientId,
-	runtimeConfig.googleClientSecret,
-	runtimeConfig.public.googleRedirectUrl,
-);
-
-export default defineEventHandler(async (event): Promise<JwtToken> => {
-	const body = await readBody(event);
-	const code = body.code;
-
-	try {
-		const result = await oAuthClient.getToken(code);
-		const decode = jwt.decode(result.res?.data.id_token) as JwtPayload;
-
-		const token = AuthApi.create(decode?.sub, decode?.email, decode?.picture);
-
-		return { token: token };
-	} catch (err) {
-		console.warn(err);
-
-		throw createError({
-			statusCode: 400,
-			statusMessage: "Invalid Google Code",
-		});
-	}
-});
diff --git a/server/api/auth/[...all].ts b/server/api/auth/[...all].ts
new file mode 100644
index 0000000..5fb0732
--- /dev/null
+++ b/server/api/auth/[...all].ts
@@ -0,0 +1,5 @@
+import { auth } from "../../auth";
+
+export default defineEventHandler((event) => {
+	return auth.handler(toWebRequest(event));
+});
diff --git a/server/api/auth/renew.get.ts b/server/api/auth/renew.get.ts
deleted file mode 100644
index 8686123..0000000
--- a/server/api/auth/renew.get.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import type { JwtToken } from "#shared/types";
-
-export default defineAuthenticatedEventHandler(
-	async (_event, token): Promise<JwtToken> => {
-		const newToken = AuthApi.create(token.sub, token.email, token.picture);
-
-		return { token: newToken };
-	},
-);
diff --git a/server/api/auth/valid.get.ts b/server/api/auth/valid.get.ts
deleted file mode 100644
index b53af31..0000000
--- a/server/api/auth/valid.get.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { H3Error } from "h3";
-import type { JwtValidation } from "#shared/types";
-
-export default defineEventHandler(async (event): Promise<JwtValidation> => {
-	const jwt = AuthApi.get(event);
-
-	if (jwt instanceof H3Error) {
-		throw jwt;
-	}
-
-	return {
-		success: !!jwt,
-	};
-});
diff --git a/server/api/categories/.get.ts b/server/api/categories/.get.ts
index 3ced334..cd5bd95 100644
--- a/server/api/categories/.get.ts
+++ b/server/api/categories/.get.ts
@@ -1,7 +1,7 @@
 import type { Category } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (_event, token): Promise<Category[]> => {
-		return await Categories.getAll(token.sub);
+	async (_event, session): Promise<Category[]> => {
+		return await Categories.getAll(session.userId);
 	},
 );
diff --git a/server/api/categories/.post.ts b/server/api/categories/.post.ts
index e142144..7ccdb35 100644
--- a/server/api/categories/.post.ts
+++ b/server/api/categories/.post.ts
@@ -2,15 +2,15 @@ import { H3Error } from "h3";
 import { Category } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (event, token): Promise<Category> => {
+	async (event, session): Promise<Category> => {
 		const newCategory = await readValidatedBody<Category>(event, (data) => {
 			return Category.parse(data);
 		});
 
-		const category = await Categories.updateOrAdd(token.sub, newCategory);
+		const category = await Categories.updateOrAdd(session.userId, newCategory);
 		if (category instanceof H3Error) throw category;
 
-		CategorieEventStream.sendUpdate(token.sub);
+		CategorieEventStream.sendUpdate(session.userId);
 		return category;
 	},
 );
diff --git a/server/api/categories/[uuid].delete.ts b/server/api/categories/[uuid].delete.ts
index 5a755dd..a0af5a6 100644
--- a/server/api/categories/[uuid].delete.ts
+++ b/server/api/categories/[uuid].delete.ts
@@ -2,7 +2,7 @@ import { H3Error } from "h3";
 import type { Category, UUID } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (event, token): Promise<Category> => {
+	async (event, session): Promise<Category> => {
 		const uuid: UUID | undefined = getRouterParam(event, "uuid");
 
 		if (!uuid)
@@ -12,10 +12,10 @@ export default defineAuthenticatedEventHandler(
 				message: `no uuid set - uuid:'${uuid}'`,
 			});
 
-		const category = await Categories.delete(token.sub, uuid);
+		const category = await Categories.delete(session.userId, uuid);
 		if (category instanceof H3Error) throw category;
 
-		CategorieEventStream.sendUpdate(token.sub);
+		CategorieEventStream.sendUpdate(session.userId);
 		return category;
 	},
 );
diff --git a/server/api/categories/sse.ts b/server/api/categories/sse.ts
index 9da1639..52ffcd1 100644
--- a/server/api/categories/sse.ts
+++ b/server/api/categories/sse.ts
@@ -1,6 +1,6 @@
-export default defineAuthenticatedEventHandler(async (event, token) => {
+export default defineAuthenticatedEventHandler(async (event, session) => {
 	const eventStream = createEventStream(event);
-	CategorieEventStream.addStream(token.sub, eventStream);
+	CategorieEventStream.addStream(session.userId, eventStream);
 
 	return eventStream.send();
 });
diff --git a/server/api/tags/.get.ts b/server/api/tags/.get.ts
index 435bdd1..21ce1ff 100644
--- a/server/api/tags/.get.ts
+++ b/server/api/tags/.get.ts
@@ -1,7 +1,7 @@
 import type { Label } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (_event, token): Promise<Label[]> => {
-		return await Tags.getAll(token.sub);
+	async (_event, session): Promise<Label[]> => {
+		return await Tags.getAll(session.userId);
 	},
 );
diff --git a/server/api/tags/.post.ts b/server/api/tags/.post.ts
index e342c5c..c9ad59f 100644
--- a/server/api/tags/.post.ts
+++ b/server/api/tags/.post.ts
@@ -2,15 +2,15 @@ import { H3Error } from "h3";
 import { Label } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (event, token): Promise<Label> => {
+	async (event, session): Promise<Label> => {
 		const newTag = await readValidatedBody<Label>(event, (data) => {
 			return Label.parse(data);
 		});
 
-		const tag = await Tags.updateOrAdd(token.sub, newTag);
+		const tag = await Tags.updateOrAdd(session.userId, newTag);
 		if (tag instanceof H3Error) throw tag;
 
-		TagEventStream.sendUpdate(token.sub);
+		TagEventStream.sendUpdate(session.userId);
 		return tag;
 	},
 );
diff --git a/server/api/tags/[uuid].delete.ts b/server/api/tags/[uuid].delete.ts
index f919482..e346ebb 100644
--- a/server/api/tags/[uuid].delete.ts
+++ b/server/api/tags/[uuid].delete.ts
@@ -2,7 +2,7 @@ import { H3Error } from "h3";
 import type { Label, UUID } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (event, token): Promise<Label> => {
+	async (event, session): Promise<Label> => {
 		const uuid: UUID | undefined = getRouterParam(event, "uuid");
 
 		if (!uuid)
@@ -12,10 +12,10 @@ export default defineAuthenticatedEventHandler(
 				message: `no uuid set - uuid:'${uuid}'`,
 			});
 
-		const tag = await Tags.delete(token.sub, uuid);
+		const tag = await Tags.delete(session.userId, uuid);
 		if (tag instanceof H3Error) throw tag;
 
-		TagEventStream.sendUpdate(token.sub);
+		TagEventStream.sendUpdate(session.userId);
 		return tag;
 	},
 );
diff --git a/server/api/tags/sse.ts b/server/api/tags/sse.ts
index c6bceca..5212967 100644
--- a/server/api/tags/sse.ts
+++ b/server/api/tags/sse.ts
@@ -1,6 +1,6 @@
-export default defineAuthenticatedEventHandler(async (event, token) => {
+export default defineAuthenticatedEventHandler(async (event, session) => {
 	const eventStream = createEventStream(event);
-	TagEventStream.addStream(token.sub, eventStream);
+	TagEventStream.addStream(session.userId, eventStream);
 
 	return eventStream.send();
 });
diff --git a/server/api/todos/.get.ts b/server/api/todos/.get.ts
index e332494..7c8a3c7 100644
--- a/server/api/todos/.get.ts
+++ b/server/api/todos/.get.ts
@@ -1,7 +1,7 @@
 import type { Todo } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (_event, token): Promise<Todo[]> => {
-		return await Todos.getAll(token.sub);
+	async (_event, session): Promise<Todo[]> => {
+		return await Todos.getAll(session.userId);
 	},
 );
diff --git a/server/api/todos/.post.ts b/server/api/todos/.post.ts
index 074db50..2769149 100644
--- a/server/api/todos/.post.ts
+++ b/server/api/todos/.post.ts
@@ -9,20 +9,20 @@ export const Body = z.object({
 });
 
 export default defineAuthenticatedEventHandler(
-	async (event, token): Promise<Todo> => {
+	async (event, session): Promise<Todo> => {
 		const body = await readValidatedBody(event, (data) => {
 			return Body.parse(data);
 		});
 
 		const todo = await Todos.updateOrAdd(
-			token.sub,
+			session.userId,
 			body.data,
 			body.position,
 			body.previousId,
 		);
 		if (todo instanceof H3Error) throw todo;
 
-		TodoEventStream.sendUpdate(token.sub);
+		TodoEventStream.sendUpdate(session.userId);
 		return todo;
 	},
 );
diff --git a/server/api/todos/[uuid].delete.ts b/server/api/todos/[uuid].delete.ts
index 5fc1797..e78efae 100644
--- a/server/api/todos/[uuid].delete.ts
+++ b/server/api/todos/[uuid].delete.ts
@@ -2,7 +2,7 @@ import { H3Error } from "h3";
 import type { Todo, UUID } from "~~/shared/types";
 
 export default defineAuthenticatedEventHandler(
-	async (event, token): Promise<Todo> => {
+	async (event, session): Promise<Todo> => {
 		const uuid: UUID | undefined = getRouterParam(event, "uuid");
 
 		if (!uuid)
@@ -12,10 +12,10 @@ export default defineAuthenticatedEventHandler(
 				message: `no uuid set - uuid:'${uuid}'`,
 			});
 
-		const todo = await Todos.delete(token.sub, uuid);
+		const todo = await Todos.delete(session.userId, uuid);
 		if (todo instanceof H3Error) throw todo;
 
-		TodoEventStream.sendUpdate(token.sub);
+		TodoEventStream.sendUpdate(session.userId);
 		return todo;
 	},
 );
diff --git a/server/api/todos/move.post.ts b/server/api/todos/move.post.ts
index e0aacbd..6013f24 100644
--- a/server/api/todos/move.post.ts
+++ b/server/api/todos/move.post.ts
@@ -6,7 +6,7 @@ export type moveTodoBody = {
 	to: UUID;
 };
 
-export default defineAuthenticatedEventHandler(async (event, token) => {
+export default defineAuthenticatedEventHandler(async (event, session) => {
 	const body = await readValidatedBody<moveTodoBody>(event, (data) => {
 		const body = data as moveTodoBody;
 		if (!body.toMove || !body.to)
@@ -17,8 +17,8 @@ export default defineAuthenticatedEventHandler(async (event, token) => {
 			});
 	});
 
-	const todo = await Todos.move(token.sub, body.toMove, body.to);
+	const todo = await Todos.move(session.userId, body.toMove, body.to);
 	if (todo instanceof H3Error) throw todo;
 
-	TodoEventStream.sendUpdate(token.sub);
+	TodoEventStream.sendUpdate(session.userId);
 });
diff --git a/server/api/todos/sse.ts b/server/api/todos/sse.ts
index beadd37..ee8f07f 100644
--- a/server/api/todos/sse.ts
+++ b/server/api/todos/sse.ts
@@ -1,6 +1,6 @@
-export default defineAuthenticatedEventHandler(async (event, token) => {
+export default defineAuthenticatedEventHandler(async (event, session) => {
 	const eventStream = createEventStream(event);
-	TodoEventStream.addStream(token.sub, eventStream);
+	TodoEventStream.addStream(session.userId, eventStream);
 
 	return eventStream.send();
 });
diff --git a/server/auth.ts b/server/auth.ts
new file mode 100644
index 0000000..6f07faa
--- /dev/null
+++ b/server/auth.ts
@@ -0,0 +1,12 @@
+import { DatabaseSync } from "node:sqlite";
+import { betterAuth } from "better-auth";
+
+export const auth = betterAuth({
+	database: new DatabaseSync("./.data/sqlite.db"),
+	socialProviders: {
+		google: {
+			clientId: process.env.GOOGLE_CLIENT_ID!,
+			clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
+		},
+	},
+});
diff --git a/server/utils/authHandle.ts b/server/utils/authHandle.ts
index 39bfe44..59f911b 100644
--- a/server/utils/authHandle.ts
+++ b/server/utils/authHandle.ts
@@ -1,70 +1,38 @@
+import type { Session } from "better-auth";
 import type { EventHandlerRequest, H3Event } from "h3";
-import { getCookie, H3Error } from "h3";
-import jwt from "jsonwebtoken";
-import { Auth } from "~~/shared/auth";
-import type { JwtPayload } from "~~/shared/types";
+import { H3Error } from "h3";
+import { auth } from "../auth";
 
 export function defineAuthenticatedEventHandler<T>(
 	handler: (
 		event: H3Event<EventHandlerRequest>,
-		user: JwtPayload,
+		session: Session,
 	) => T | Promise<T>,
 ) {
-	return defineEventHandler((event): T | Promise<T> => {
-		const token = AuthApi.getOrThrow(event);
-		return handler(event, token);
+	return defineEventHandler(async (event): Promise<T> => {
+		const session = await AuthApi.getOrThrow(event);
+		return handler(event, session);
 	});
 }
 
 export const AuthApi = {
-	create(id: string, email: string, picture: string): string {
-		const runtimeConfig = useRuntimeConfig();
+	async get(event: H3Event): Promise<Session | H3Error> {
+		const result = await auth.api.getSession(event);
 
-		return Auth.createRaw(
-			id,
-			email,
-			picture,
-			`${runtimeConfig.public.jwtTTL}s` as `${number}s`,
-			runtimeConfig.jwtSecret,
-		);
-	},
-
-	get(event: H3Event): undefined | JwtPayload | H3Error {
-		const token = getCookie(event, "token");
-
-		if (!token) {
-			return createError({ statusCode: 400, statusMessage: "No JwtToken set" });
-		}
-
-		try {
-			const runtimeConfig = useRuntimeConfig();
-
-			return jwt.verify(token, runtimeConfig.jwtSecret) as JwtPayload;
-		} catch {
-			return undefined;
-		}
-	},
-
-	getOrError(event: H3Event): JwtPayload | H3Error {
-		const token = AuthApi.get(event);
-
-		if (!token) {
-			return createError({
-				statusCode: 401,
-				statusMessage: "Invalid JwtToken",
-			});
+		if (!result) {
+			return createError({ statusCode: 400, statusMessage: "No Session set" });
 		}
 
-		return token;
+		return result.session;
 	},
 
-	getOrThrow(event: H3Event): JwtPayload {
-		const token = AuthApi.getOrError(event);
+	async getOrThrow(event: H3Event): Promise<Session> {
+		const session = await AuthApi.get(event);
 
-		if (token instanceof H3Error) {
-			throw token;
+		if (session instanceof H3Error) {
+			throw session;
 		}
 
-		return token;
+		return session;
 	},
 };
diff --git a/shared/auth.ts b/shared/auth.ts
deleted file mode 100644
index 405b7d8..0000000
--- a/shared/auth.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import jwt from "jsonwebtoken";
-import type { JwtPayload } from "~~/shared/types";
-
-export const Auth = {
-	createRaw(
-		id: string,
-		email: string,
-		picture: string,
-		ttl: `${number}s`,
-		secret: string,
-	): string {
-		return jwt.sign({ sub: id, email, picture } as JwtPayload, secret, {
-			expiresIn: ttl,
-		});
-	},
-};
-- 
knotmirror 0.0.1