@agent-native/core 0.148.0 → 0.149.0

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/agent-chat/context-tools.js

@@ -138,7 +138,7 @@ Prefer \`web-request\` for simple API calls and static pages. Use browser automa
 
 The \`call-agent\` tool sends a message to a DIFFERENT, separately-deployed app's agent (A2A protocol). It is **not** for calling actions within the current app.
 
-Use a natural-language \`message\` by default. The receiving app owns interpretation and runs with its own instructions, skills, connected sources, data dictionary, and tools. Do not choose its provider, schema, query, joins, or SQL for it. A direct \`action\` + \`input\` call is only for an exact bounded read whose complete contract is already known; it is never a workaround for unreliable delegation.
+Use a natural-language \`message\` by default. The receiving app owns interpretation and runs with its own instructions, skills, connected sources, data dictionary, and tools. Do not choose its provider, schema, query, joins, or SQL for it. A direct \`action\` + \`input\` call is only for an exact bounded read whose complete contract is already known; it is never for a create, update, delete, send, save, publish, or other side effect, and it is never a workaround for unreliable delegation.
 
 **NEVER use \`call-agent\` to:**
 - Call your own app by name

package/dist/server/agent-chat/prompt-resources.js

@@ -787,7 +787,7 @@ export async function loadResourcesForPrompt(owner, compact = false, selfAppId,
             // Nothing else in the prompt or the initial tool surface tells the agent
             // which peer apps exist, so this block is not droppable: without it the
             // agent reports cross-app work as impossible instead of delegating.
-            addSection(`<available-apps>\nWorkspace apps available over A2A/call-agent:\n${lines.join("\n")}\n\nWhen another app owns the work or data, use \`call-agent\` with the app id and a natural-language message. The receiving specialist owns source selection, schema interpretation, queries, joins, and use of its local tools. Direct action invocation is optional for an exact bounded read with a fully known schema; never use it to compensate for unreliable delegation.\n\nThese one-liners are the only cross-app detail in this prompt. Before building a capability another app may already own, before telling the user what is or is not possible across apps, and whenever the user asks which app to use, call \`describe-workspace-apps\` - it reads each peer's live agent card for current purpose and optional capability details. Never hand-maintain a list of workspace apps in code or docs; it goes stale silently.\n</available-apps>`, "required");
+            addSection(`<available-apps>\nWorkspace apps available over A2A/call-agent:\n${lines.join("\n")}\n\nWhen another app owns the work or data, use \`call-agent\` with the app id and a natural-language message. The receiving specialist owns source selection, schema interpretation, queries, joins, and use of its local tools. Direct action invocation is only for an explicitly read-only bounded action with a fully known schema. Never put creates, updates, deletes, sends, saves, publishes, or other side effects in direct action mode; put those objectives in the natural-language message.\n\nThese one-liners are the only cross-app detail in this prompt. Before building a capability another app may already own, before telling the user what is or is not possible across apps, and whenever the user asks which app to use, call \`describe-workspace-apps\` - it reads each peer's live agent card for current purpose and optional capability details. Never hand-maintain a list of workspace apps in code or docs; it goes stale silently.\n</available-apps>`, "required");
         }
     }
     catch {

package/dist/server/agent-chat-plugin.js

@@ -1081,7 +1081,7 @@ export function createAgentChatPlugin(options) {
                     if (!entry) {
                         return {
                             status: "failed",
-                            output: "Unknown or unavailable read-only action",
+                            output: "Unknown or unavailable read-only action. Direct cross-app action mode only accepts explicitly exposed read-only operations; retry creates, updates, deletes, sends, saves, publishes, and other side effects with a natural-language message.",
                         };
                     }
                     const result = await executeAgentToolCall({

package/dist/server/auth.js

@@ -48,7 +48,7 @@ import { readBody } from "../server/h3-helpers.js";
 import { putSetting } from "../settings/store.js";
 import { resolveSsrCacheHeaders } from "../shared/cache-control.js";
 import { extractOAuthStateAppId } from "../shared/oauth-state.js";
-import { PASSWORD_MIN_LENGTH, PASSWORD_MIN_LENGTH_MESSAGE, } from "../shared/password-policy.js";
+import { PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, PASSWORD_MAX_LENGTH_MESSAGE, PASSWORD_MIN_LENGTH_MESSAGE, } from "../shared/password-policy.js";
 import { SIGN_IN_CONTINUATION_PARAM, SIGN_IN_ENTRY_PATH, SIGN_IN_LEGACY_ENTRY_PATH, SIGN_IN_LEGACY_RETURN_PARAM, decodeContinuation, normalizeAppPath, signInJourney, } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { normalizeWorkspaceAppAudience, workspaceAppAudienceFromEnv, workspaceAppRouteAccessFromEnv, } from "../shared/workspace-app-audience.js";
@@ -576,6 +576,18 @@ function verifyEmailRedirectHasError(location, requestUrl) {
         return /[?&]error=/.test(location);
     }
 }
+function sanitizeVerificationErrorRedirect(location, requestUrl) {
+    try {
+        const parsed = new URL(location, requestUrl);
+        parsed.searchParams.set("error", "verification_link_invalid");
+        return /^[a-z][a-z\d+.-]*:/i.test(location)
+            ? parsed.toString()
+            : `${parsed.pathname}${parsed.search}${parsed.hash}`;
+    }
+    catch {
+        return location;
+    }
+}
 function appendVerifiedParamToLocation(location) {
     const hashIndex = location.indexOf("#");
     const beforeHash = hashIndex >= 0 ? location.slice(0, hashIndex) : location;
@@ -633,6 +645,41 @@ const EXPECTED_AUTH_FAILURE_PATTERNS = [
 ];
 const VALID_AUTH_EMAIL_MESSAGE = "Enter a valid email address, like you@example.com.";
 const AUTH_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const AUTH_CREDENTIALS_REQUIRED_MESSAGE = "Enter your email and password.";
+const AUTH_EMAIL_NOT_VERIFIED_MESSAGE = "Your email isn't verified yet. Check your inbox for a verification link.";
+const AUTH_ACCOUNT_EXISTS_MESSAGE = "An account with this email already exists. Sign in instead or reset your password.";
+const AUTH_PASSWORD_REQUIRED_MESSAGE = "Enter a password.";
+const AUTH_LOGIN_FALLBACK = "We couldn't sign you in right now. Please try again.";
+const AUTH_MAGIC_LINK_FALLBACK = "We couldn't send a sign-in link right now. Please try again.";
+const AUTH_SIGNUP_FALLBACK = "We couldn't create your account right now. Please try again.";
+const AUTH_VERIFICATION_LINK_FALLBACK = "This verification link is invalid or expired. Request a new one.";
+const AUTH_RESET_PASSWORD_FALLBACK = "We couldn't update your password. The link may have expired; request a new one.";
+const AUTH_RESET_EMAIL_FALLBACK = "We couldn't send a password reset email. Check your email and try again.";
+const AUTH_GENERIC_FALLBACK = "We couldn't complete that request right now. Please try again.";
+const AUTH_GOOGLE_FALLBACK = "We couldn't sign you in with Google right now. Please try again.";
+const AUTH_GOOGLE_CANCELLED = "Google sign-in was cancelled. Try again when you're ready.";
+const AUTH_GOOGLE_START_FALLBACK = "We couldn't start Google sign-in. Please try again.";
+function isTechnicalAuthErrorMessage(message) {
+    return /failed query|\bselect\b.*\bfrom\b|\binsert\b.*\binto\b|\bupdate\b.*\bset\b|\bdelete\b.*\bfrom\b|\bsql\b|database|relation .* does not exist|column .* does not exist|syntax error|constraint|connection refused|econn|timeout/i.test(message);
+}
+function isAuthPasswordTooShortMessage(message) {
+    return /password.*(?:at least|minimum|min(?:imum)?|too short)/i.test(message);
+}
+function isAuthPasswordTooLongMessage(message) {
+    return /password.*(?:at most|maximum|max(?:imum)?|too long)/i.test(message);
+}
+function isAuthPasswordRequiredMessage(message) {
+    return /password.*(?:required|missing)/i.test(message);
+}
+function isAuthEmailNotVerifiedMessage(message) {
+    return /(?:email|account).*(?:not verified|unverified)|not verified/i.test(message);
+}
+function isAuthAccountExistsMessage(message) {
+    return /(?:already exists|already registered|already in use|user exists|user already|duplicate key|unique constraint|unique.*(?:email|constraint))/i.test(message);
+}
+function isAuthInvalidCredentialsMessage(message) {
+    return /(?:invalid|incorrect|wrong).*?(?:email|password|credentials)|(?:email|password|credentials).*?(?:invalid|incorrect|wrong)/i.test(message);
+}
 function normalizeAuthEmail(value) {
     if (typeof value !== "string")
         return null;
@@ -640,16 +687,102 @@ function normalizeAuthEmail(value) {
     return AUTH_EMAIL_PATTERN.test(email) ? email : null;
 }
 function publicAuthError(error, fallback) {
-    const message = error?.message;
-    if (typeof message === "string") {
-        if (isAuthEmailValidationMessage(message)) {
-            return { message: VALID_AUTH_EMAIL_MESSAGE, statusCode: 400 };
-        }
-        if (message.trim())
-            return { message };
+    const authError = error;
+    const message = typeof authError?.message === "string" ? authError.message : "";
+    const code = typeof authError?.code === "string" ? authError.code : "";
+    const details = `${code} ${message}`.trim();
+    if (isAuthEmailValidationMessage(details) ||
+        /invalid[_ -]?email/i.test(code)) {
+        return { message: VALID_AUTH_EMAIL_MESSAGE, statusCode: 400 };
+    }
+    if (isAuthPasswordTooShortMessage(details) ||
+        /password[_ -]?(too[_ -]?short|minimum)/i.test(code)) {
+        return { message: PASSWORD_MIN_LENGTH_MESSAGE, statusCode: 400 };
+    }
+    if (isAuthPasswordTooLongMessage(details) ||
+        /password[_ -]?(too[_ -]?long|maximum)/i.test(code)) {
+        return { message: PASSWORD_MAX_LENGTH_MESSAGE, statusCode: 400 };
+    }
+    if (isAuthPasswordRequiredMessage(details)) {
+        return { message: AUTH_PASSWORD_REQUIRED_MESSAGE, statusCode: 400 };
+    }
+    if (isAuthEmailNotVerifiedMessage(details)) {
+        return { message: AUTH_EMAIL_NOT_VERIFIED_MESSAGE, statusCode: 403 };
+    }
+    if (isAuthAccountExistsMessage(details) ||
+        /user[_ -]?already[_ -]?exists/i.test(code)) {
+        return { message: AUTH_ACCOUNT_EXISTS_MESSAGE, statusCode: 409 };
+    }
+    if (isAuthInvalidCredentialsMessage(details)) {
+        return { message: "The email or password is incorrect.", statusCode: 401 };
+    }
+    // Better Auth adapters can include the underlying SQL statement in an
+    // Error.message. That detail is useful in server logs, but it is neither a
+    // recovery path nor a safe public response. Map it to the route-specific
+    // fallback and keep the diagnostic in captureAuthError() above. Account
+    // conflicts are classified above so a unique constraint error stays useful.
+    if (isTechnicalAuthErrorMessage(details)) {
+        return { message: fallback, statusCode: 500 };
     }
     return { message: fallback };
 }
+function publicAuthErrorFromPayload(payload, fallback) {
+    const payloadError = typeof payload.error === "string" ? payload.error : undefined;
+    const code = typeof payload.code === "string"
+        ? payload.code
+        : typeof payload.errorCode === "string"
+            ? payload.errorCode
+            : payloadError && /^[A-Z0-9_ -]+$/.test(payloadError)
+                ? payloadError
+                : undefined;
+    const message = typeof payload.message === "string"
+        ? payload.message
+        : payloadError && code !== payloadError
+            ? payloadError
+            : undefined;
+    return publicAuthError({ code, message }, fallback);
+}
+function betterAuthErrorFallback(path) {
+    if (path.includes("reset-password"))
+        return AUTH_RESET_PASSWORD_FALLBACK;
+    if (path.includes("request-password-reset"))
+        return AUTH_RESET_EMAIL_FALLBACK;
+    if (path.includes("verify-email"))
+        return AUTH_VERIFICATION_LINK_FALLBACK;
+    if (path.includes("send-verification-email")) {
+        return "We couldn't resend the verification email. Please try again.";
+    }
+    if (path.includes("sign-in/magic-link"))
+        return AUTH_MAGIC_LINK_FALLBACK;
+    if (path.includes("sign-in/email")) {
+        return "The email or password is incorrect.";
+    }
+    if (path.includes("sign-up/email"))
+        return AUTH_SIGNUP_FALLBACK;
+    return AUTH_GENERIC_FALLBACK;
+}
+async function sanitizeBetterAuthErrorResponse(response, fallback) {
+    if (response.status < 400)
+        return response;
+    const payload = await response
+        .clone()
+        .json()
+        .catch(() => undefined);
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+        return response;
+    }
+    const authError = publicAuthErrorFromPayload(payload, fallback);
+    const headers = new Headers(response.headers);
+    headers.delete("content-length");
+    headers.set("content-type", "application/json");
+    return new Response(JSON.stringify({ error: authError.message, message: authError.message }), {
+        status: authError.message === fallback
+            ? response.status
+            : (authError.statusCode ?? response.status),
+        statusText: response.statusText,
+        headers,
+    });
+}
 function isAuthEmailValidationMessage(message) {
     // Credential failures (e.g. Better Auth's "Invalid email or password") mention
     // "email" + "invalid" but are NOT email-format errors — don't rewrite them to
@@ -2301,7 +2434,7 @@ async function mountBetterAuthRoutes(app, options) {
             const redirectUri = resolveOAuthRedirectUri(event);
             if (redirectUri === null) {
                 setResponseStatus(event, 400);
-                return { error: "Invalid redirect_uri" };
+                return { error: AUTH_GOOGLE_START_FALLBACK };
             }
             const q = getQuery(event);
             const desktop = isElectronRequest(event) || q.desktop === "1" || q.desktop === "true";
@@ -2398,22 +2531,22 @@ async function mountBetterAuthRoutes(app, options) {
                         query.error_description
                         ? query.error_description
                         : undefined;
-                    const msg = providerDescription ||
-                        providerError ||
-                        "Missing authorization code";
+                    const msg = providerError === "access_denied"
+                        ? AUTH_GOOGLE_CANCELLED
+                        : AUTH_GOOGLE_FALLBACK;
                     if (flowId) {
                         setDesktopExchangeError(flowId, {
-                            message: `Google sign-in failed: ${msg}`,
+                            message: msg,
                             code: providerError || "missing_authorization_code",
                         });
                     }
                     logGoogleOAuthDebug(event, "callback-error", {
                         flowId,
                         desktop,
-                        message: msg,
+                        message: providerDescription || providerError || msg,
                         code: providerError,
                     });
-                    return oauthErrorPage(`Connection failed: ${msg}`);
+                    return oauthErrorPage(msg);
                 }
                 // Defence in depth: the state is HMAC-signed, but if the signing
                 // key ever leaked an attacker could mint state with their own
@@ -2421,7 +2554,7 @@ async function mountBetterAuthRoutes(app, options) {
                 // auth-url time so the token exchange is always sent to a URI we
                 // own.
                 if (!isAllowedOAuthRedirectUri(redirectUri, event)) {
-                    const msg = "Invalid Google OAuth redirect URI in state. Restart sign-in from this app.";
+                    const msg = AUTH_GOOGLE_START_FALLBACK;
                     if (flowId) {
                         setDesktopExchangeError(flowId, {
                             message: msg,
@@ -2433,7 +2566,7 @@ async function mountBetterAuthRoutes(app, options) {
                         desktop,
                         message: msg,
                     });
-                    return oauthErrorPage(`Connection failed: ${msg}`);
+                    return oauthErrorPage(msg);
                 }
                 const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
                     method: "POST",
@@ -2532,7 +2665,7 @@ async function mountBetterAuthRoutes(app, options) {
                 const msg = error.message || "Unknown error";
                 if (callbackFlowId) {
                     setDesktopExchangeError(callbackFlowId, {
-                        message: `Google sign-in failed: ${msg}`,
+                        message: AUTH_GOOGLE_FALLBACK,
                         code: "callback_error",
                     });
                 }
@@ -2541,7 +2674,7 @@ async function mountBetterAuthRoutes(app, options) {
                     desktop: callbackDesktop,
                     message: msg,
                 });
-                return oauthErrorPage(`Connection failed: ${msg}`);
+                return oauthErrorPage(AUTH_GOOGLE_FALLBACK);
             }
         }));
     }
@@ -2732,10 +2865,16 @@ async function mountBetterAuthRoutes(app, options) {
                 // validation error.
             }
         }
-        const response = await auth.handler(requestForAuth);
+        let response = await auth.handler(requestForAuth);
         const isResponse = response != null &&
             typeof response.status === "number" &&
             typeof response.headers?.get === "function";
+        if (isResponse && response.status >= 400) {
+            // The direct Better Auth surface is also reachable from the browser,
+            // so wrapper-route sanitization alone is not enough to keep adapter
+            // SQL and provider internals out of the auth UI.
+            response = await sanitizeBetterAuthErrorResponse(response, betterAuthErrorFallback(reqPath));
+        }
         // After email verification, add ?verified=1 to the redirect so the
         // login page can show "Email verified!". MUTATE the response in
         // place — `new Response(null, { headers: new Headers(response.headers) })`
@@ -2749,9 +2888,10 @@ async function mountBetterAuthRoutes(app, options) {
             response.status >= 300 &&
             response.status < 400) {
             const loc = response.headers.get("location");
-            if (loc &&
-                !/[?&]verified=/.test(loc) &&
-                !verifyEmailRedirectHasError(loc, authRequest.url)) {
+            if (loc && verifyEmailRedirectHasError(loc, authRequest.url)) {
+                response.headers.set("location", sanitizeVerificationErrorRedirect(loc, authRequest.url));
+            }
+            else if (loc && !/[?&]verified=/.test(loc)) {
                 await ensureEmailVerifiedForRedirect(authRequest, response);
                 response.headers.set("location", appendVerifiedParamToLocation(loc));
             }
@@ -2860,7 +3000,7 @@ async function mountBetterAuthRoutes(app, options) {
         const password = body?.password;
         if (!rawEmail.trim() || !password) {
             setResponseStatus(event, 400);
-            return { error: "Email and password are required" };
+            return { error: AUTH_CREDENTIALS_REQUIRED_MESSAGE };
         }
         if (!email) {
             setResponseStatus(event, 400);
@@ -2890,15 +3030,13 @@ async function mountBetterAuthRoutes(app, options) {
             // email isn't verified yet. Don't return { ok: true } without a
             // session or the frontend will reload into a dead end.
             setResponseStatus(event, 403);
-            return {
-                error: "Email not verified. Check your inbox for a verification link.",
-            };
+            return { error: AUTH_EMAIL_NOT_VERIFIED_MESSAGE };
         }
         catch (e) {
             if (!isExpectedAuthFailure(e)) {
                 captureAuthError(e, { route: "login", email });
             }
-            const authError = publicAuthError(e, "Invalid email or password");
+            const authError = publicAuthError(e, AUTH_LOGIN_FALLBACK);
             setResponseStatus(event, authError.statusCode ?? 401);
             return { error: authError.message };
         }
@@ -2938,7 +3076,7 @@ async function mountBetterAuthRoutes(app, options) {
             if (!isExpectedAuthFailure(e)) {
                 captureAuthError(e, { route: "magic-link", email });
             }
-            const authError = publicAuthError(e, "Unable to send sign-in link");
+            const authError = publicAuthError(e, AUTH_MAGIC_LINK_FALLBACK);
             setResponseStatus(event, authError.statusCode ?? 400);
             return { error: authError.message };
         }
@@ -2960,12 +3098,18 @@ async function mountBetterAuthRoutes(app, options) {
             setResponseStatus(event, 400);
             return { error: VALID_AUTH_EMAIL_MESSAGE };
         }
-        if (!password ||
-            typeof password !== "string" ||
-            password.length < PASSWORD_MIN_LENGTH) {
+        if (!password || typeof password !== "string") {
+            setResponseStatus(event, 400);
+            return { error: AUTH_PASSWORD_REQUIRED_MESSAGE };
+        }
+        if (password.length < PASSWORD_MIN_LENGTH) {
             setResponseStatus(event, 400);
             return { error: PASSWORD_MIN_LENGTH_MESSAGE };
         }
+        if (password.length > PASSWORD_MAX_LENGTH) {
+            setResponseStatus(event, 400);
+            return { error: PASSWORD_MAX_LENGTH_MESSAGE };
+        }
         if (await isGoogleSignInRequiredForEmail(email)) {
             setResponseStatus(event, 403);
             return { error: GOOGLE_AUTH_REQUIRED_MESSAGE };
@@ -2982,7 +3126,7 @@ async function mountBetterAuthRoutes(app, options) {
             if (!isExpectedAuthFailure(e)) {
                 captureAuthError(e, { route: "signup", email });
             }
-            const authError = publicAuthError(e, "Registration failed");
+            const authError = publicAuthError(e, AUTH_SIGNUP_FALLBACK);
             setResponseStatus(event, authError.statusCode ?? 409);
             return { error: authError.message };
         }
@@ -3157,7 +3301,7 @@ function mountAuthFallbackRoutes(app) {
         const password = body?.password;
         if (!rawEmail.trim() || !password) {
             setResponseStatus(event, 400);
-            return { error: "Email and password are required" };
+            return { error: AUTH_CREDENTIALS_REQUIRED_MESSAGE };
         }
         if (!email) {
             setResponseStatus(event, 400);
@@ -3185,15 +3329,13 @@ function mountAuthFallbackRoutes(app) {
                 return authLoginResponse(event, result.token, email);
             }
             setResponseStatus(event, 403);
-            return {
-                error: "Email not verified. Check your inbox for a verification link.",
-            };
+            return { error: AUTH_EMAIL_NOT_VERIFIED_MESSAGE };
         }
         catch (e) {
             if (!isExpectedAuthFailure(e)) {
                 captureAuthError(e, { route: "login", email });
             }
-            const authError = publicAuthError(e, "Invalid email or password");
+            const authError = publicAuthError(e, AUTH_LOGIN_FALLBACK);
             setResponseStatus(event, authError.statusCode ?? 401);
             return { error: authError.message };
         }
@@ -3211,12 +3353,18 @@ function mountAuthFallbackRoutes(app) {
             setResponseStatus(event, 400);
             return { error: VALID_AUTH_EMAIL_MESSAGE };
         }
-        if (!password ||
-            typeof password !== "string" ||
-            password.length < PASSWORD_MIN_LENGTH) {
+        if (!password || typeof password !== "string") {
+            setResponseStatus(event, 400);
+            return { error: AUTH_PASSWORD_REQUIRED_MESSAGE };
+        }
+        if (password.length < PASSWORD_MIN_LENGTH) {
             setResponseStatus(event, 400);
             return { error: PASSWORD_MIN_LENGTH_MESSAGE };
         }
+        if (password.length > PASSWORD_MAX_LENGTH) {
+            setResponseStatus(event, 400);
+            return { error: PASSWORD_MAX_LENGTH_MESSAGE };
+        }
         if (await isGoogleSignInRequiredForEmail(email)) {
             setResponseStatus(event, 403);
             return { error: GOOGLE_AUTH_REQUIRED_MESSAGE };
@@ -3234,7 +3382,7 @@ function mountAuthFallbackRoutes(app) {
             if (!isExpectedAuthFailure(e)) {
                 captureAuthError(e, { route: "signup", email });
             }
-            const authError = publicAuthError(e, "Registration failed");
+            const authError = publicAuthError(e, AUTH_SIGNUP_FALLBACK);
             setResponseStatus(event, authError.statusCode ?? 409);
             return { error: authError.message };
         }

package/dist/server/better-auth-migrations.js

@@ -1,4 +1,32 @@
 import { runMigrations } from "../db/migrations.js";
+async function assertBetterAuthUserIdentityColumns() {
+    const { getCloudflareD1Binding, getDbExec, getDialect, isPostgres } = await import("../db/client.js");
+    const dialect = getDialect();
+    let columnNames;
+    if (dialect === "d1") {
+        const d1 = getCloudflareD1Binding();
+        if (!d1) {
+            throw new Error('Cannot inspect the Better Auth "user" table because the D1 binding is unavailable.');
+        }
+        const result = await d1.prepare("PRAGMA table_info(user)").all();
+        columnNames = result.results.map((column) => {
+            const record = column;
+            return typeof record.name === "string" ? record.name : "";
+        });
+    }
+    else if (isPostgres()) {
+        const { rows } = await getDbExec().execute(`SELECT column_name FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = 'user' AND column_name IN ('id', 'email')`);
+        columnNames = rows.map((row) => String(row.column_name ?? row[0] ?? ""));
+    }
+    else {
+        const { rows } = await getDbExec().execute("PRAGMA table_info(user)");
+        columnNames = rows.map((row) => String(row.name ?? row[1] ?? ""));
+    }
+    const missing = ["id", "email"].filter((column) => !columnNames.includes(column));
+    if (missing.length > 0) {
+        throw new Error(`Cannot repair the Better Auth "user" table because required identity column(s) are missing: ${missing.join(", ")}. Restore the existing user schema before deploying this migration.`);
+    }
+}
 /**
  * Better Auth's framework-owned schema. This is deliberately a release
  * migration, not a fallback inside `getBetterAuth()`: request functions must
@@ -171,6 +199,31 @@ export const BETTER_AUTH_MIGRATIONS = [
       `,
         },
     },
+    {
+        version: 2,
+        name: "better-auth-repair-user-columns",
+        sql: {
+            // `CREATE TABLE IF NOT EXISTS` does not reconcile an older table that
+            // already has the Better Auth name but is missing newer columns. Keep
+            // this repair additive so existing user rows and legacy auth data stay
+            // intact while the adapter gets the columns it selects on signup.
+            postgres: `
+        ALTER TABLE "user" ADD COLUMN IF NOT EXISTS "name" TEXT NOT NULL DEFAULT '';
+        ALTER TABLE "user" ADD COLUMN IF NOT EXISTS "email_verified" BOOLEAN NOT NULL DEFAULT FALSE;
+        ALTER TABLE "user" ADD COLUMN IF NOT EXISTS "image" TEXT;
+        ALTER TABLE "user" ADD COLUMN IF NOT EXISTS "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP;
+        ALTER TABLE "user" ADD COLUMN IF NOT EXISTS "updated_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP
+      `,
+            sqlite: `
+        ALTER TABLE user ADD COLUMN IF NOT EXISTS name TEXT NOT NULL DEFAULT '';
+        ALTER TABLE user ADD COLUMN IF NOT EXISTS email_verified INTEGER NOT NULL DEFAULT 0;
+        ALTER TABLE user ADD COLUMN IF NOT EXISTS image TEXT;
+        ALTER TABLE user ADD COLUMN IF NOT EXISTS created_at INTEGER NOT NULL DEFAULT 0;
+        ALTER TABLE user ADD COLUMN IF NOT EXISTS updated_at INTEGER NOT NULL DEFAULT 0
+      `,
+        },
+        run: assertBetterAuthUserIdentityColumns,
+    },
 ];
 export async function runBetterAuthMigrations(nitroApp) {
     await runMigrations(BETTER_AUTH_MIGRATIONS, {

package/dist/server/http-response-telemetry.js

@@ -7,6 +7,8 @@ import { track } from "../tracking/index.js";
 import { getAppName } from "./app-name.js";
 const TELEMETRY_EVENT_NAME = "http.response";
 const REQUEST_ID_HEADER = "x-agent-native-request-id";
+// Provider delivery posts back to these collectors. Recording the collector
+// response would feed another `http.response` event into the same collector.
 const TRACKING_INGEST_PATHS = new Set([
     "/track",
     "/api/analytics/track",
@@ -49,6 +51,10 @@ function sampleRate() {
 function shouldDisableTelemetry() {
     return boolEnv("AGENT_NATIVE_HTTP_TELEMETRY_DISABLED");
 }
+function isTrackingIngestPath(pathname) {
+    const normalized = pathname.replace(/\/+$/, "") || "/";
+    return TRACKING_INGEST_PATHS.has(normalized);
+}
 function requestPath(event) {
     const raw = event.url?.pathname ??
         String(event.node?.req?.url ?? event.path ?? "/").split("?")[0] ??
@@ -114,7 +120,7 @@ function organizationForHost(host) {
 function shouldTrack(pathname, statusCode, state) {
     if (shouldDisableTelemetry())
         return false;
-    if (TRACKING_INGEST_PATHS.has(pathname))
+    if (isTrackingIngestPath(pathname))
         return false;
     if (pathname.startsWith("/api/analytics/replay"))
         return false;