Summary

Adds publicEndpoints plugin capability for RFC 8414 / OIDC Discovery compliance.

This allows plugins to register endpoints at the origin root (e.g., /.well-known/openid-configuration) instead of under the basePath (e.g., /api/auth/.well-known/...).

Important clarification: This does NOT mount Better Auth at root. Only /.well-known/* paths are intercepted by the main handler and routed to the public router. All other endpoints remain at the configured basePath.

Closes #7453

Changes

• Add publicEndpoints field to BetterAuthPlugin type
• Add publicRouter that mounts at / instead of basePath
• Auto-route /.well-known/* in main handler to publicRouter
• Export optional publicHandler and publicApi on auth object
• Add conflict detection for public endpoints

How It Works

1. Plugins can define publicEndpoints alongside regular endpoints
2. The main handler automatically routes /.well-known/* requests to the public router
3. publicHandler and publicApi are only defined when plugins actually use publicEndpoints
4. Existing behavior is completely unchanged - no breaking changes

Example Usage

const myPlugin = {
  id: "my-plugin",
  // Regular endpoints at basePath (e.g., /api/auth/my-endpoint)
  endpoints: {
    myEndpoint: createAuthEndpoint("/my-endpoint", ...)
  },
  // Public endpoints at root (e.g., /.well-known/my-config)  
  publicEndpoints: {
    wellKnownConfig: createAuthEndpoint("/.well-known/my-config", ...)
  }
};

Test Plan

• New tests for publicEndpoints functionality (11 tests)
• Existing to-auth-endpoints tests pass (34 tests)
• Existing check-endpoint-conflicts tests pass (13 tests)
• TypeScript types check
• Lint passes

Summary by cubic

Adds publicEndpoints so plugins can serve well-known routes at the origin root (/.well-known/*) while keeping all other endpoints under basePath. When used, the auth instance exposes a dedicated public router and API.

• New Features

  • publicEndpoints on BetterAuthPlugin; new publicRouter mounts at /, and the main handler auto-routes /.well-known/*.
  • publicHandler and publicApi are exposed only when at least one plugin defines publicEndpoints.
  • Detects and logs conflicts for public paths and HTTP methods; types updated to include publicEndpoints, publicHandler, and publicApi.

• Bug Fixes

  • After hooks can return void/null/undefined without modifying the response.
  • Safer per-request context for dynamic baseURL (recomputes trusted origins/providers and cookies; resolves base URL on first request for static configs).

^{Written for commit 8f0116d. Summary will update on new commits.}