@beignet/provider-auth-better-auth 0.0.45 → 0.0.46

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @beignet/provider-auth-better-auth
 
+## 0.0.46
+
+### Patch Changes
+
+- 19bac12: Generate new apps with Better Auth 1.6.25, align the Agent Auth integration with
+  the validated Better Auth core, and document schema migration requirements for
+  Better Auth upgrades and plugin changes.
+
 ## 0.0.45
 
 ## 0.0.44

package/README.md

@@ -32,12 +32,12 @@ schema, and auth routes.
 ## Install
 
 ```bash
-bun add @beignet/core @beignet/provider-auth-better-auth better-auth@1.6.20
+bun add @beignet/core @beignet/provider-auth-better-auth better-auth@1.6.25
 ```
 
 The provider supports Better Auth `>=1.3.26 <1.7.0`. The standard Beignet
-starter pins Better Auth to `1.6.20` so clean installs do not float into
-untested prerelease adapter versions.
+starter pins Better Auth to `1.6.25` so clean installs use the version Beignet
+validates in generated apps.
 
 ## Agent skills
 
@@ -327,8 +327,15 @@ the app's auth route tests and provider integration tests.
 ## Deployment notes
 
 Deploy the Better Auth database schema and secret configuration before enabling
-authenticated routes. Keep business authorization in feature policies and use
-Beignet auth hooks only for HTTP-boundary authentication.
+authenticated routes. After upgrading Better Auth or changing its plugins,
+regenerate the schema for your database adapter and apply the resulting
+migration before deployment. Apps that enable `twoFactor()` must include the
+plugin's current `failedVerificationCount` and `lockedUntil` fields. The
+standard Beignet starter does not enable two-factor authentication, so its
+default auth configuration does not require those fields.
+
+Keep business authorization in feature policies and use Beignet auth hooks only
+for HTTP-boundary authentication.
 
 ## API reference
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/provider-auth-better-auth",
-  "version": "0.0.45",
+  "version": "0.0.46",
   "type": "module",
   "description": "Better Auth provider for Beignet - adds auth port for authentication and session management",
   "main": "./dist/index.js",
@@ -65,7 +65,7 @@
     "@beignet/devtools": "*",
     "@types/bun": "^1.3.13",
     "@types/node": "^20.10.0",
-    "better-auth": "1.6.20",
+    "better-auth": "1.6.25",
     "typescript": "^5.3.0"
   },
   "beignet": {

package/skills/auth-provider/SKILL.md

@@ -142,6 +142,11 @@ action.
   should use service/system actors, not `ctx.auth`.
 - Keep session objects, cookies, bearer tokens, and provider-native auth data
   out of devtools, audit metadata, and error reports.
+- After upgrading Better Auth or changing its plugins, regenerate the schema
+  for the app's database adapter and apply the resulting migration before
+  deployment. Apps using `twoFactor()` need the current
+  `failedVerificationCount` and `lockedUntil` fields. The standard Beignet
+  starter does not enable two-factor authentication.
 
 ## Devtools