@better-auth/core 1.7.0-rc.1 → 1.7.0-rc.2

package/dist/types/helper.d.mts

@@ -4,7 +4,7 @@ type Awaitable<T> = T | Promise<T>;
 type AwaitableFunction<T> = T | (() => Awaitable<T>);
 type LiteralString = "" | (string & Record<never, never>);
 type LiteralUnion<LiteralType, BaseType extends Primitive> = LiteralType | (BaseType & Record<never, never>);
-type Prettify<T> = { [K in keyof T]: T[K] } & {};
+type Prettify<T> = { [K in keyof T]: T[K]; } & {};
 type UnionToIntersection<U> = (U extends any ? (k: U) => void : never) extends ((k: infer I) => void) ? I : never;
 //#endregion
 export { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection };

package/dist/types/index.d.mts

@@ -6,4 +6,4 @@ import { SecretConfig } from "./secret.mjs";
 import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./plugin-client.mjs";
 import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
-export { type StandardSchemaV1$1 as StandardSchemaV1 };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1$1 as StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };

package/dist/types/init-options.d.mts

@@ -9,6 +9,7 @@ import { SocialProviderList, SocialProviders } from "../social-providers/index.m
 import { Awaitable, LiteralString, LiteralUnion } from "./helper.mjs";
 import { BetterAuthPlugin } from "./plugin.mjs";
 import { Account, BaseAccount } from "../db/schema/account.mjs";
+import "../db/index.mjs";
 import { AuthContext, GenericEndpointContext } from "./context.mjs";
 import { AuthMiddleware } from "../api/index.mjs";
 import { CookieOptions } from "better-call";
@@ -16,10 +17,9 @@ import { Database } from "bun:sqlite";
 import { DatabaseSync } from "node:sqlite";
 import { D1Database } from "@cloudflare/workers-types";
 import { Dialect, Kysely, MysqlPool, PostgresPool, SqliteDatabase } from "kysely";
-
 //#region src/types/init-options.d.ts
 type KyselyDatabaseType = "postgres" | "mysql" | "sqlite" | "mssql";
-type Optional<T> = { [P in keyof T]?: T[P] | undefined };
+type Optional<T> = { [P in keyof T]?: T[P] | undefined; };
 type StoreIdentifierOption = "plain" | "hashed" | {
   hash: (identifier: string) => Promise<string>;
 };
@@ -53,18 +53,24 @@ type ValidateUserInfoAction = "create-user" | "link-account" | "sign-in";
 type ValidateUserInfoMethod = "oauth" | "sso-oidc" | "sso-saml" | "email-password" | "magic-link" | "email-otp" | "anonymous" | "siwe" | "phone-number" | "admin" | (string & {});
 /** OAuth-specific provisioning context; present only when `method` is `"oauth"`. */
 type ValidateUserInfoOAuthInfo = {
-  /** The social or generic OAuth provider id (e.g. `"google"`). */providerId: string; /** The raw provider profile (userinfo or id-token claims), unmapped. */
+  /** The social or generic OAuth provider id (e.g. `"google"`). */
+  providerId: string;
+  /** The raw provider profile (userinfo or id-token claims), unmapped. */
   profile?: Record<string, unknown> | undefined;
 };
 /** SSO-specific provisioning context; present for OIDC and SAML SSO methods. */
 type ValidateUserInfoSSOInfo = {
-  /** The configured SSO provider id. */providerId: string; /** The raw OIDC claims or SAML assertion attributes, unmapped. */
+  /** The configured SSO provider id. */
+  providerId: string;
+  /** The raw OIDC claims or SAML assertion attributes, unmapped. */
   profile?: Record<string, unknown> | undefined;
 };
 /** Provisioning origin passed to `createUser`; the creation seam adds `action: "create-user"` to build {@link ValidateUserInfoSource}. */
 type UserProvisioningSource = {
-  method: ValidateUserInfoMethod; /** Provider id and raw profile; present iff `method` is `"oauth"`. */
-  oauth?: ValidateUserInfoOAuthInfo | undefined; /** Provider id and raw profile; present iff `method` is `"sso-oidc"` or `"sso-saml"`. */
+  method: ValidateUserInfoMethod;
+  /** Provider id and raw profile; present iff `method` is `"oauth"`. */
+  oauth?: ValidateUserInfoOAuthInfo | undefined;
+  /** Provider id and raw profile; present iff `method` is `"sso-oidc"` or `"sso-saml"`. */
   sso?: ValidateUserInfoSSOInfo | undefined;
 };
 /**
@@ -87,7 +93,8 @@ type ValidateUserInfoSource = UserProvisioningSource & {
   action: ValidateUserInfoAction;
 };
 type ValidateUserInfoResult = {
-  /** A short, machine-readable rejection code, surfaced to the client. */error: string;
+  /** A short, machine-readable rejection code, surfaced to the client. */
+  error: string;
   /**
    * A human-readable reason, surfaced to the client. Do not put sensitive
    * details here.
@@ -190,7 +197,7 @@ type BetterAuthDBOptions<ModelName extends string, Keys extends string = string>
   /**
    * Additional fields for the model
    */
-  additionalFields?: { [Key in Exclude<string, Keys | "id">]: DBFieldAttribute };
+  additionalFields?: { [Key in Exclude<string, Keys | "id">]: DBFieldAttribute; };
 };
 type BetterAuthRateLimitOptions = Optional<BetterAuthRateLimitRule> & Omit<BetterAuthDBOptions<"rateLimit", keyof BaseRateLimit>, "additionalFields"> & {
   /**
@@ -370,11 +377,26 @@ type BetterAuthAdvancedOptions = {
      * function.
      */
     generateId?: GenerateIdFn | false | "serial" | "uuid";
+    /**
+     * Enable database joins for adapters that support them.
+     *
+     * When disabled (default), related data is fetched via
+     * separate queries. When enabled, adapters that support
+     * native joins use them; otherwise Better Auth falls back
+     * to separate queries.
+     *
+     * Please read the adapter documentation for more
+     * information regarding joins before enabling this.
+     * Not all adapters support joins.
+     *
+     * @default false
+     */
+    joins?: boolean;
   } | undefined;
   /**
    * Trusted proxy headers
    *
-    * - `x-forwarded-host`
+   * - `x-forwarded-host`
    * - `x-forwarded-proto`
    *
    * If set to `true` and no `baseURL` option is provided, we will use the headers to infer the
@@ -764,15 +786,18 @@ type BetterAuthOptions = {
      * ```
      */
     customSyntheticUser?: (params: {
-      /** Core user fields: name, email, emailVerified, image, createdAt, updatedAt */coreFields: {
+      /** Core user fields: name, email, emailVerified, image, createdAt, updatedAt */
+      coreFields: {
         name: string;
         email: string;
         emailVerified: boolean;
         image: string | null;
         createdAt: Date;
         updatedAt: Date;
-      }; /** Processed additional fields from options.user.additionalFields (with defaults applied) */
-      additionalFields: Record<string, unknown>; /** Generated user ID */
+      };
+      /** Processed additional fields from options.user.additionalFields (with defaults applied) */
+      additionalFields: Record<string, unknown>;
+      /** Generated user ID */
       id: string;
     }) => Record<string, unknown>;
   } | undefined;
@@ -1509,20 +1534,6 @@ type BetterAuthOptions = {
      */
     debug?: boolean;
   } | undefined;
-  /**
-   * Experimental features
-   */
-  experimental?: {
-    /**
-     * Enable experimental joins for your database adapter.
-     *
-     * 	Please read the adapter documentation for more information regarding joins before enabling this.
-     * 	Not all adapters support joins.
-     *
-     * @default false
-     */
-    joins?: boolean;
-  };
 };
 //#endregion
 export { BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthDBOptions, BetterAuthOptions, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, DynamicBaseURLConfig, GenerateIdFn, StoreIdentifierOption, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };

package/dist/types/plugin-client.d.mts

@@ -2,7 +2,6 @@ import { LiteralString } from "./helper.mjs";
 import { BetterAuthOptions } from "./init-options.mjs";
 import { BetterFetch, BetterFetchOption, BetterFetchPlugin } from "@better-fetch/fetch";
 import { Atom, WritableAtom } from "nanostores";
-
 //#region src/types/plugin-client.d.ts
 type InferableServerPlugin = {
   id?: LiteralString | undefined;
@@ -89,7 +88,6 @@ interface BetterAuthClientPlugin {
   /**
    * better-auth client options
    */
-
   options: BetterAuthClientOptions | undefined) => Record<string, any>;
   /**
    * State atoms that'll be resolved by each framework
@@ -120,4 +118,4 @@ interface BetterAuthClientPlugin {
   }>;
 }
 //#endregion
-export { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore };
+export { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore, RevalidateOptions };

package/dist/types/plugin.d.mts

@@ -2,13 +2,13 @@ import { BetterAuthPluginDBSchema } from "../db/plugin.mjs";
 import { Awaitable, LiteralString } from "./helper.mjs";
 import { RawError } from "../utils/error-codes.mjs";
 import { BetterAuthOptions } from "./init-options.mjs";
+import "../db/index.mjs";
 import { AuthContext } from "./context.mjs";
 import { AuthMiddleware } from "../api/index.mjs";
 import { Endpoint, EndpointContext, InputContext, Middleware } from "better-call";
 import { Migration } from "kysely";
-
 //#region src/types/plugin.d.ts
-type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;
+type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]>; } : T;
 type HookEndpointContext = Partial<EndpointContext<string, any> & Omit<InputContext<string, any>, "method">> & {
   path?: string;
   context: AuthContext & {

package/dist/utils/async.d.mts

@@ -1,5 +1,4 @@
 import { Awaitable } from "../types/helper.mjs";
-
 //#region src/utils/async.d.ts
 interface MapConcurrentOptions {
   /**

package/dist/utils/db.d.mts

@@ -1,4 +1,5 @@
 import { DBFieldAttribute } from "../db/type.mjs";
+import "../db/index.mjs";
 //#region src/utils/db.d.ts
 /**
  * Filters output data by removing fields with the `returned: false` attribute.

package/dist/utils/deprecate.d.mts

@@ -1,5 +1,4 @@
 import { InternalLogger } from "../env/logger.mjs";
-
 //#region src/utils/deprecate.d.ts
 /**
  * Wraps a function to log a deprecation warning at once.

package/dist/utils/error-codes.d.mts

@@ -3,11 +3,11 @@ type UpperLetter = "A" | "B" | "C" | "D" | "E" | "F" | "G" | "H" | "I" | "J" | "
 type SpecialCharacter = "_";
 type IsValidUpperSnakeCase<S extends string> = S extends `${infer F}${infer R}` ? F extends UpperLetter | SpecialCharacter ? IsValidUpperSnakeCase<R> : false : true;
 type InvalidKeyError<K extends string> = `Invalid error code key: "${K}" - must only contain uppercase letters (A-Z) and underscores (_)`;
-type ValidateErrorCodes<T> = { [K in keyof T]: K extends string ? IsValidUpperSnakeCase<K> extends false ? InvalidKeyError<K> : T[K] : T[K] };
+type ValidateErrorCodes<T> = { [K in keyof T]: K extends string ? IsValidUpperSnakeCase<K> extends false ? InvalidKeyError<K> : T[K] : T[K]; };
 type RawError<K extends string = string> = {
   readonly code: K;
   message: string;
 };
-declare function defineErrorCodes<const T extends Record<string, string>, R extends { [K in keyof T & string]: RawError<K> }>(codes: ValidateErrorCodes<T>): R;
+declare function defineErrorCodes<const T extends Record<string, string>, R extends { [K in keyof T & string]: RawError<K>; }>(codes: ValidateErrorCodes<T>): R;
 //#endregion
 export { RawError, defineErrorCodes };

package/dist/utils/host.d.mts

@@ -26,7 +26,33 @@
  * The semantic kind of a host, derived from RFC 6890 special-purpose registries
  * plus a few domain-name categories (localhost, cloud metadata FQDNs).
  */
-type HostKind = /** IPv4 `127.0.0.0/8` or IPv6 `::1`. */"loopback" /** DNS name `localhost` or RFC 6761 `.localhost` TLD. */ | "localhost" /** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */ | "unspecified" /** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */ | "private" /** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */ | "linkLocal" /** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */ | "sharedAddressSpace" /** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */ | "documentation" /** RFC 2544 `198.18.0.0/15`. */ | "benchmarking" /** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */ | "multicast" /** IPv4 limited broadcast `255.255.255.255`. */ | "broadcast" /** Other RFC 6890 special-purpose ranges (0.0.0.0/8, 192.0.0.0/24, 192.88.99.0/24, 240.0.0.0/4, 2001::/32, etc.). */ | "reserved" /** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */ | "cloudMetadata" /** Any host not matching a special-purpose range above. */ | "public";
+type HostKind =
+/** IPv4 `127.0.0.0/8` or IPv6 `::1`. */
+"loopback" |
+/** DNS name `localhost` or RFC 6761 `.localhost` TLD. */
+"localhost" |
+/** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */
+"unspecified" |
+/** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */
+"private" |
+/** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */
+"linkLocal" |
+/** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */
+"sharedAddressSpace" |
+/** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */
+"documentation" |
+/** RFC 2544 `198.18.0.0/15`. */
+"benchmarking" |
+/** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */
+"multicast" |
+/** IPv4 limited broadcast `255.255.255.255`. */
+"broadcast" |
+/** Other RFC 6890 special-purpose ranges (0.0.0.0/8, 192.0.0.0/24, 192.88.99.0/24, 240.0.0.0/4, 2001::/32, etc.). */
+"reserved" |
+/** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */
+"cloudMetadata" |
+/** Any host not matching a special-purpose range above. */
+"public";
 /**
  * The syntactic form of the input host: an IPv4 literal, an IPv6 literal, or
  * a domain name. IPv4-mapped IPv6 (`::ffff:192.0.2.1`) is reported as `ipv4`

package/dist/utils/host.mjs

@@ -9,7 +9,7 @@ import { isValidIP, normalizeIP } from "./ip.mjs";
 * only exists for the FQDN form that a naive server-side fetch might resolve
 * via its own resolver.
 */
-const CLOUD_METADATA_HOSTS = new Set([
+const CLOUD_METADATA_HOSTS = /* @__PURE__ */ new Set([
 	"metadata.google.internal",
 	"metadata.goog",
 	"metadata",

package/dist/utils/ip.d.mts

@@ -1,4 +1,5 @@
 import { BetterAuthOptions } from "../types/init-options.mjs";
+import "../types/index.mjs";
 //#region src/utils/ip.d.ts
 /**
  * Normalizes an IP address for consistent rate limiting.

package/dist/utils/ip.mjs

@@ -111,7 +111,7 @@ function ipToBytes(ip) {
 	const mapped = extractIPv4FromMapped(ip);
 	if (mapped) return Uint8Array.from(mapped.split(".").map((octet) => Number(octet)));
 	const groups = expandIPv6(ip);
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	for (let i = 0; i < 8; i++) {
 		const group = Number.parseInt(groups[i] ?? "0", 16);
 		bytes[i * 2] = group >> 8 & 255;

package/dist/utils/is-api-error.d.mts

@@ -1,5 +1,4 @@
 import { APIError } from "../error/index.mjs";
-
 //#region src/utils/is-api-error.d.ts
 declare function isAPIError(error: unknown): error is APIError;
 //#endregion

package/dist/utils/redirect-uri.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-
 //#region src/utils/redirect-uri.d.ts
 /**
  * Zod schema for OAuth redirect URIs and other developer-supplied URLs that the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.7.0-rc.1",
+  "version": "1.7.0-rc.2",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -80,6 +80,11 @@
       "types": "./dist/db/index.d.mts",
       "default": "./dist/db/index.mjs"
     },
+    "./db/internal": {
+      "dev-source": "./src/db/internal.ts",
+      "types": "./dist/db/internal.d.mts",
+      "default": "./dist/db/internal.mjs"
+    },
     "./db/adapter": {
       "dev-source": "./src/db/adapter/index.ts",
       "types": "./dist/db/adapter/index.d.mts",
@@ -135,6 +140,9 @@
       "db": [
         "dist/db/index.d.mts"
       ],
+      "db/internal": [
+        "dist/db/internal.d.mts"
+      ],
       "db/adapter": [
         "dist/db/adapter/index.d.mts"
       ],
@@ -162,7 +170,7 @@
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
-    "tsdown": "0.21.1"
+    "tsdown": "0.22.7"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",

package/src/context/request-state.ts

@@ -4,15 +4,35 @@ import { __getBetterAuthGlobal } from "./global";
 
 export type RequestStateWeakMap = WeakMap<object, any>;
 
+// Memoizes the in-flight AsyncLocalStorage initialization so concurrent
+// first-callers share a single instance instead of each constructing one.
+let asyncStorageInit: Promise<AsyncLocalStorage<RequestStateWeakMap>> | null =
+	null;
+
 const ensureAsyncStorage = async () => {
 	const betterAuthGlobal = __getBetterAuthGlobal();
-	if (!betterAuthGlobal.context.requestStateAsyncStorage) {
-		const AsyncLocalStorage = await getAsyncLocalStorage();
-		betterAuthGlobal.context.requestStateAsyncStorage =
-			new AsyncLocalStorage<RequestStateWeakMap>();
+	const existing = betterAuthGlobal.context.requestStateAsyncStorage;
+	if (existing) {
+		return existing as AsyncLocalStorage<RequestStateWeakMap>;
+	}
+	// Without memoizing the init, several concurrent callers can each pass the
+	// check above, each `await getAsyncLocalStorage()`, and each assign a fresh
+	// instance — last write wins. `runWithRequestState().run()` then executes on
+	// one instance while a nested `getCurrentRequestState()` reads the
+	// overwritten one, throwing "No request state found". This shows up
+	// intermittently on serverless cold start (e.g. Cloudflare Workers), where
+	// the first requests hit before the lazy `node:async_hooks` import settles.
+	// The idempotent `??=` keeps the global singleton stable even if multiple
+	// BetterAuth copies (Dual Module Hazard) race here.
+	if (!asyncStorageInit) {
+		asyncStorageInit = getAsyncLocalStorage().then((AsyncLocalStorage) => {
+			betterAuthGlobal.context.requestStateAsyncStorage ??=
+				new AsyncLocalStorage<RequestStateWeakMap>();
+			return betterAuthGlobal.context
+				.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
+		});
 	}
-	return betterAuthGlobal.context
-		.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
+	return asyncStorageInit;
 };
 
 export async function getRequestStateAsyncLocalStorage() {

package/src/context/transaction.ts

@@ -100,6 +100,9 @@ export const runWithTransaction = async <
 >(
 	adapter: DBAdapter<Options>,
 	fn: () => R,
+	options?: {
+		onAfterCommitHookError?: (error: unknown) => void | Promise<void>;
+	},
 ): Promise<R> => {
 	let called = false;
 	return ensureAsyncStorage()
@@ -128,12 +131,21 @@ export const runWithTransaction = async <
 				hasError = true;
 				error = e;
 			}
-			for (const hook of pendingHooks) {
-				await hook();
-			}
 			if (hasError) {
 				throw error;
 			}
+			for (const hook of pendingHooks) {
+				try {
+					await hook();
+				} catch (error) {
+					if (!options?.onAfterCommitHookError) throw error;
+					try {
+						await options.onAfterCommitHookError(error);
+					} catch {
+						// Reporting cannot roll back committed work or suppress later hooks.
+					}
+				}
+			}
 			return result!;
 		})
 		.catch((err) => {
@@ -150,20 +162,27 @@ export const runWithTransaction = async <
  */
 export const queueAfterTransactionHook = async (
 	hook: () => Promise<void>,
+	options?: {
+		/** Handles a queued hook failure after the surrounding work has committed. */
+		onError?: (error: unknown) => void | Promise<void>;
+	},
 ): Promise<void> => {
-	return ensureAsyncStorage()
-		.then((als) => {
-			const store = als.getStore();
-			if (store) {
-				// We're in a transaction context, queue the hook
-				store.pendingHooks.push(hook);
-			} else {
-				// Not in a transaction, execute immediately
-				return hook();
-			}
-		})
-		.catch(() => {
-			// No async storage available, execute immediately
-			return hook();
-		});
+	const executeHook = async () => {
+		try {
+			await hook();
+		} catch (error) {
+			if (!options?.onError) throw error;
+			await options.onError(error);
+		}
+	};
+	let storage: Awaited<ReturnType<typeof ensureAsyncStorage>>;
+	try {
+		storage = await ensureAsyncStorage();
+	} catch {
+		return executeHook();
+	}
+
+	const store = storage.getStore();
+	if (!store?.isTransactionActive) return executeHook();
+	store.pendingHooks.push(executeHook);
 };

package/src/db/adapter/factory.ts

@@ -425,19 +425,19 @@ export const createAdapterFactory =
 				joinConfig,
 			} of requiredModels) {
 				let joinedData = await (async () => {
-					if (options.experimental?.joins) {
-						const result = data[modelName];
-						return result;
-					} else {
-						// doesn't support joins, so fallback to handleFallbackJoin
-						const result = await handleFallbackJoin({
-							baseModel: unsafe_model,
-							baseData: transformedData,
-							joinModel: modelName,
-							specificJoinConfig: joinConfig,
-						});
-						return result;
+					if (options.advanced?.database?.joins) {
+						// Use native joined data when the adapter included the key;
+						// otherwise fall back to separate queries.
+						if (modelName in data) {
+							return data[modelName];
+						}
 					}
+					return await handleFallbackJoin({
+						baseModel: unsafe_model,
+						baseData: transformedData,
+						joinModel: modelName,
+						specificJoinConfig: joinConfig,
+					});
 				})();
 
 				// If joinedData is undefined, initialize it based on relationship type
@@ -1118,9 +1118,12 @@ export const createAdapterFactory =
 						join = result.join;
 						select = result.select;
 					}
-					// If adapter doesn't support joins and we have joins, don't pass them to the adapter
-					const experimentalJoins = options.experimental?.joins;
-					if (!experimentalJoins && join && Object.keys(join).length > 0) {
+					// If joins are disabled and we have joins, don't pass them to the adapter
+					if (
+						!options.advanced?.database?.joins &&
+						join &&
+						Object.keys(join).length > 0
+					) {
 						passJoinToAdapter = false;
 					}
 				} else {
@@ -1206,9 +1209,12 @@ export const createAdapterFactory =
 						join = result.join;
 						select = result.select;
 					}
-					// If adapter doesn't support joins and we have joins, don't pass them to the adapter
-					const experimentalJoins = options.experimental?.joins;
-					if (!experimentalJoins && join && Object.keys(join).length > 0) {
+					// If joins are disabled and we have joins, don't pass them to the adapter
+					if (
+						!options.advanced?.database?.joins &&
+						join &&
+						Object.keys(join).length > 0
+					) {
 						passJoinToAdapter = false;
 					}
 				} else {

package/src/db/adapter/get-default-model-name.ts

@@ -20,26 +20,35 @@ export const initGetDefaultModelName = ({
 	 * 3. Using this function helps us get the actual model name based on the user's defined custom modelName.
 	 */
 	const getDefaultModelName = (model: string) => {
+		// Resolve a model string (either a schema key or a user-defined
+		// `modelName`) back to its canonical schema key.
+		//
+		// An exact schema-key match must win over a `modelName` match.
+		// Better-auth internals (and `references.model`, see get-tables.ts)
+		// always pass canonical schema keys, so when a user remaps a
+		// built-in table onto another table's schema key (e.g.
+		// `user.modelName = "account"`), preferring the modelName alias
+		// would silently reroute every internal "account" query to the
+		// user table. The modelName lookup is only a fallback for
+		// externally supplied physical table names.
+		// @see https://github.com/better-auth/better-auth/issues/8111
+		// @see https://github.com/better-auth/better-auth/issues/10136
+		const resolve = (candidate: string): string | undefined => {
+			if (schema[candidate]) return candidate;
+			return Object.entries(schema).find(
+				([_, f]) => f.modelName === candidate,
+			)?.[0];
+		};
+
 		// It's possible this `model` could had applied `usePlural`.
 		// Thus we'll try the search but without the trailing `s`.
 		if (usePlural && model.charAt(model.length - 1) === "s") {
 			const pluralessModel = model.slice(0, -1);
-			let m = schema[pluralessModel] ? pluralessModel : undefined;
-			if (!m) {
-				m = Object.entries(schema).find(
-					([_, f]) => f.modelName === pluralessModel,
-				)?.[0];
-			}
-
-			if (m) {
-				return m;
-			}
+			const m = resolve(pluralessModel);
+			if (m) return m;
 		}
 
-		let m = schema[model] ? model : undefined;
-		if (!m) {
-			m = Object.entries(schema).find(([_, f]) => f.modelName === model)?.[0];
-		}
+		const m = resolve(model);
 
 		if (!m) {
 			throw new BetterAuthError(`Model "${model}" not found in schema`);