@better-auth/core 1.7.0-rc.3 → 1.7.0-rc.5

package/dist/api/index.d.mts

@@ -6,7 +6,7 @@ import { AuthContext } from "../types/context.mjs";
 import "../types/index.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
 import "../oauth2/index.mjs";
-import { EndpointContext, EndpointOptions, StrictEndpoint } from "better-call";
+import { EndpointHandler, EndpointOptions, MiddlewareHandler, StrictEndpoint } from "better-call";
 //#region src/api/index.d.ts
 /**
  * Response headers that forbid any intermediary (proxy, CDN, browser) from
@@ -26,12 +26,9 @@ declare const NO_STORE_HEADERS: {
   readonly "Cache-Control": "no-store";
   readonly Pragma: "no-cache";
 };
-declare const optionsMiddleware: <InputCtx extends import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>;
+declare const optionsMiddleware: import("better-call").Middleware<import("better-call").MiddlewareOptions, <InputCtx extends import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>>;
 declare const createAuthMiddleware: {
-  <Options extends import("better-call").MiddlewareOptions, R>(options: Options, handler: (ctx: import("better-call").MiddlewareContext<Options, {
-    returned?: unknown | undefined;
-    responseHeaders?: Headers | undefined;
-  } & import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
+  <Options extends import("better-call").MiddlewareOptions, R>(options: Options, handler: (ctx: import("better-call").MiddlewareContext<Options, import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
     options: import("@better-auth/core").BetterAuthOptions;
     trustedOrigins: string[];
     trustedProviders: string[];
@@ -123,6 +120,7 @@ declare const createAuthMiddleware: {
       updateAge: number;
       expiresIn: number;
       freshAge: number;
+      cookieCacheSigner?: import("@better-auth/core").CookieCacheSigner | undefined;
       cookieRefreshCache: false | {
         enabled: true;
         updateAge: number;
@@ -156,11 +154,11 @@ declare const createAuthMiddleware: {
     skipCSRFCheck: boolean;
     runInBackground: (promise: Promise<unknown>) => void;
     runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("@better-auth/core").Awaitable<unknown>;
-  }>) => Promise<R>): (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R>;
-  <Options extends import("better-call").MiddlewareOptions, R_1>(handler: (ctx: import("better-call").MiddlewareContext<Options, {
+  } & {
     returned?: unknown | undefined;
     responseHeaders?: Headers | undefined;
-  } & import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
+  }>) => Promise<R>): import("better-call").Middleware<Options, (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R>>;
+  <Options extends import("better-call").MiddlewareOptions, R_1>(handler: (ctx: import("better-call").MiddlewareContext<Options, import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
     options: import("@better-auth/core").BetterAuthOptions;
     trustedOrigins: string[];
     trustedProviders: string[];
@@ -252,6 +250,7 @@ declare const createAuthMiddleware: {
       updateAge: number;
       expiresIn: number;
       freshAge: number;
+      cookieCacheSigner?: import("@better-auth/core").CookieCacheSigner | undefined;
       cookieRefreshCache: false | {
         enabled: true;
         updateAge: number;
@@ -285,37 +284,19 @@ declare const createAuthMiddleware: {
     skipCSRFCheck: boolean;
     runInBackground: (promise: Promise<unknown>) => void;
     runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("@better-auth/core").Awaitable<unknown>;
-  }>) => Promise<R_1>): (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R_1>;
+  } & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  }>) => Promise<R_1>): import("better-call").Middleware<Options, (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R_1>>;
 };
-type EndpointHandler<Path extends string, Options extends EndpointOptions, R> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;
-declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(path: Path, options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
-declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+type AuthEndpointHandler<Path extends string, Options extends EndpointOptions, R> = EndpointHandler<Path, Options, R, AuthContext>;
+type PathlessAuthEndpointHandler<Options extends EndpointOptions, R> = AuthEndpointHandler<string, Options, R>;
+declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(path: Path, options: Options, handler: AuthEndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+declare function createAuthEndpoint<InferredPath extends string, Options extends EndpointOptions, R>(options: Options, handler: PathlessAuthEndpointHandler<Options, R>): StrictEndpoint<InferredPath, Options, R>;
 declare namespace createAuthEndpoint {
-  /**
-   * Declare a **server-only** endpoint.
-   *
-   * The endpoint is callable through `auth.api.*` from trusted server code but is
-   * never registered on the HTTP router and never emitted into the OpenAPI
-   * schema. It takes no path because it has no URL to be reached at.
-   *
-   * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
-   * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
-   * keeps the endpoint off the HTTP surface even if a path is later added by
-   * mistake: better-call's router skips an endpoint when its path is missing *or*
-   * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
-   * on path omission alone is invisible and one keystroke away from exposure.
-   *
-   * @example
-   * ```ts
-   * viewBackupCodes: createAuthEndpoint.serverOnly(
-   * 	{ method: "POST", body: schema },
-   * 	async (ctx) => { ... },
-   * )
-   * ```
-   */
-  function serverOnly<Path extends string, Options extends EndpointOptions, R>(options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+  var serverOnly: <InferredPath extends string, Options extends EndpointOptions, R>(options: Options, handler: PathlessAuthEndpointHandler<Options, R>) => StrictEndpoint<InferredPath, Options, R>;
 }
 type AuthEndpoint<Path extends string, Opts extends EndpointOptions, R> = ReturnType<typeof createAuthEndpoint<Path, Opts, R>>;
-type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
+type AuthMiddleware = MiddlewareHandler;
 //#endregion
 export { AuthEndpoint, AuthMiddleware, NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };

package/dist/api/index.mjs

@@ -47,30 +47,26 @@ const optionsMiddleware = createMiddleware(async () => {
 const createAuthMiddleware = createMiddleware.create({ use: [optionsMiddleware, createMiddleware(async () => {
 	return {};
 })] });
-const use = [optionsMiddleware];
-function createAuthEndpoint(pathOrOptions, handlerOrOptions, handlerOrNever) {
-	const path = typeof pathOrOptions === "string" ? pathOrOptions : void 0;
-	const options = typeof handlerOrOptions === "object" ? handlerOrOptions : pathOrOptions;
-	const handler = typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
+const createEndpointWithAuthContext = createEndpoint.create({ use: [optionsMiddleware] });
+function wrapEndpointHandler(handler, options) {
 	const noStore = options.metadata?.noStore === true;
-	const wrapped = async (ctx) => {
-		if (noStore) for (const [name, value] of Object.entries(NO_STORE_HEADERS)) ctx.setHeader(name, value);
-		const runtimeCtx = ctx;
+	return async (context) => {
+		if (noStore) for (const [name, value] of Object.entries(NO_STORE_HEADERS)) context.setHeader(name, value);
 		try {
-			return await runWithEndpointContext(ctx, () => handler(ctx));
-		} catch (e) {
-			attachResponseHeadersToAPIError(runtimeCtx.responseHeaders, e);
-			throw e;
+			return await runWithEndpointContext(context, () => handler(context));
+		} catch (error) {
+			attachResponseHeadersToAPIError(context.responseHeaders, error);
+			throw error;
 		}
 	};
-	if (path) return createEndpoint(path, {
-		...options,
-		use: [...options?.use || [], ...use]
-	}, wrapped);
-	return createEndpoint({
-		...options,
-		use: [...options?.use || [], ...use]
-	}, wrapped);
+}
+function createAuthEndpoint(...args) {
+	if (args.length === 3) {
+		const [path, options, handler] = args;
+		return createEndpointWithAuthContext(path, options, wrapEndpointHandler(handler, options));
+	}
+	const [options, handler] = args;
+	return createEndpointWithAuthContext(options, wrapEndpointHandler(handler, options));
 }
 /**
 * Set `metadata.SERVER_ONLY` while preserving any existing metadata
@@ -85,11 +81,28 @@ function withServerOnly(options) {
 		}
 	};
 }
-(function(_createAuthEndpoint) {
-	function serverOnly(options, handler) {
-		return createAuthEndpoint(withServerOnly(options), handler);
-	}
-	_createAuthEndpoint.serverOnly = serverOnly;
-})(createAuthEndpoint || (createAuthEndpoint = {}));
+/**
+* Declare a **server-only** endpoint.
+*
+* The endpoint is callable through `auth.api.*` from trusted server code but is
+* never registered on the HTTP router and never emitted into the OpenAPI
+* schema. It takes no path because it has no URL to be reached at.
+*
+* Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
+* Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
+* keeps the endpoint off the HTTP surface even if a path is later added by
+* mistake: better-call's router skips an endpoint when its path is missing *or*
+* when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
+* on path omission alone is invisible and one keystroke away from exposure.
+*
+* @example
+* ```ts
+* viewBackupCodes: createAuthEndpoint.serverOnly(
+* 	{ method: "POST", body: schema },
+* 	async (ctx) => { ... },
+* )
+* ```
+*/
+createAuthEndpoint.serverOnly = (options, handler) => createAuthEndpoint(withServerOnly(options), handler);
 //#endregion
 export { NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };

package/dist/context/global.mjs

@@ -2,7 +2,7 @@
 const symbol = Symbol.for("better-auth:global");
 let bind = null;
 const __context = {};
-const __betterAuthVersion = "1.7.0-rc.3";
+const __betterAuthVersion = "1.7.0-rc.5";
 /**
 * We store context instance in the globalThis.
 *

package/dist/db/get-tables.mjs

@@ -198,7 +198,7 @@ const buildAuthTables = (options) => {
 		account: {
 			modelName: options.account?.modelName || "account",
 			indexes: mergeTableIndexes([{
-				fields: ["issuer", "providerAccountId"],
+				fields: ["issuer", "accountId"],
 				unique: true
 			}], account?.indexes),
 			fields: {
@@ -207,10 +207,10 @@ const buildAuthTables = (options) => {
 					required: true,
 					fieldName: options.account?.fields?.issuer || "issuer"
 				},
-				providerAccountId: {
+				accountId: {
 					type: "string",
 					required: true,
-					fieldName: options.account?.fields?.providerAccountId || "providerAccountId"
+					fieldName: options.account?.fields?.accountId || "accountId"
 				},
 				providerId: {
 					type: "string",

package/dist/db/schema/account.d.mts

@@ -10,7 +10,7 @@ declare const accountSchema: z.ZodObject<{
   updatedAt: z.ZodDefault<z.ZodDate>;
   providerId: z.ZodString;
   issuer: z.ZodString;
-  providerAccountId: z.ZodString;
+  accountId: z.ZodString;
   userId: z.ZodCoercedString<unknown>;
   accessToken: z.ZodOptional<z.ZodNullable<z.ZodString>>;
   refreshToken: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -22,7 +22,7 @@ declare const accountSchema: z.ZodObject<{
 }, z.core.$strip>;
 type BaseAccount = z.infer<typeof accountSchema>;
 /** The stable provider-side key used to recognize an account. */
-type AccountKey = Readonly<Pick<BaseAccount, "issuer" | "providerAccountId">>;
+type AccountKey = Readonly<Pick<BaseAccount, "issuer" | "accountId">>;
 /**
  * Creates the synthetic issuer used by providers without an issuer of their own.
  */

package/dist/db/schema/account.mjs

@@ -4,7 +4,7 @@ import * as z from "zod";
 const accountSchema = coreSchema.extend({
 	providerId: z.string(),
 	issuer: z.string(),
-	providerAccountId: z.string(),
+	accountId: z.string(),
 	userId: z.coerce.string(),
 	accessToken: z.string().nullish(),
 	refreshToken: z.string().nullish(),

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 import { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection } from "./types/helper.mjs";
 import { BetterAuthPlugin, BetterAuthPluginErrorCodePart, HookEndpointContext } from "./types/plugin.mjs";
 import { BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthDBOptions, BetterAuthOptions, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, DynamicBaseURLConfig, GenerateIdFn, StoreIdentifierOption, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource } from "./types/init-options.mjs";
-import { BetterAuthCookie, BetterAuthCookies } from "./types/cookie.mjs";
+import { BetterAuthCookie, BetterAuthCookies, CookieCachePayload } from "./types/cookie.mjs";
 import { SecretConfig } from "./types/secret.mjs";
-import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
+import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, CookieCacheSigner, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./types/plugin-client.mjs";
 import { StandardSchemaV1 } from "./types/index.mjs";
-export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, CookieCachePayload, CookieCacheSigner, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.0-rc.3";
+const INSTRUMENTATION_VERSION = "1.7.0-rc.5";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/social-providers/apple.d.mts

@@ -70,7 +70,7 @@ declare const apple: (options: AppleOptions) => {
   name: string;
   accountSubject: ({ profile }: OAuthAccountKeyContext<AppleProfile>) => string;
   accountIssuer: string;
-  createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
+  createAuthorizationURL({ state, scopes, redirectURI, additionalParams, codeVerifier }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;

package/dist/social-providers/apple.mjs

@@ -14,7 +14,7 @@ const apple = (options) => {
 		name: "Apple",
 		accountSubject: ({ profile }) => profile.sub,
 		accountIssuer: "https://appleid.apple.com",
-		async createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
+		async createAuthorizationURL({ state, scopes, redirectURI, additionalParams, codeVerifier }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client ID and client secret are required for Apple. Make sure to provide them in the options.");
 				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
@@ -29,6 +29,7 @@ const apple = (options) => {
 				scopes: _scope,
 				state,
 				redirectURI,
+				codeVerifier,
 				responseMode: "form_post",
 				responseType: "code id_token",
 				additionalParams

package/dist/social-providers/index.d.mts

@@ -45,7 +45,7 @@ declare const socialProviders: {
     name: string;
     accountSubject: ({ profile }: OAuthAccountKeyContext<AppleProfile>) => string;
     accountIssuer: string;
-    createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
+    createAuthorizationURL({ state, scopes, redirectURI, additionalParams, codeVerifier }: {
       state: string;
       codeVerifier: string;
       scopes?: string[] | undefined;

package/dist/types/context.d.mts

@@ -9,7 +9,7 @@ import { BetterAuthPlugin } from "./plugin.mjs";
 import { BetterAuthOptions, BetterAuthRateLimitOptions, UserProvisioningSource } from "./init-options.mjs";
 import { Account, AccountKey } from "../db/schema/account.mjs";
 import "../db/index.mjs";
-import { BetterAuthCookie, BetterAuthCookies } from "./cookie.mjs";
+import { BetterAuthCookie, BetterAuthCookies, CookieCachePayload } from "./cookie.mjs";
 import { SecretConfig } from "./secret.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
 import "../oauth2/index.mjs";
@@ -54,6 +54,16 @@ type BetterAuthPluginRegistryIdentifier = keyof BetterAuthPluginRegistry<unknown
 type GenericEndpointContext<Options extends BetterAuthOptions = BetterAuthOptions> = EndpointContext<string, any> & {
   context: AuthContext<Options>;
 };
+/**
+ * Signs and verifies session cookie-cache values.
+ */
+type CookieCacheSigner = {
+  sign: (ctx: GenericEndpointContext, payload: CookieCachePayload, expiresIn: number) => Promise<string>;
+  verify: (ctx: GenericEndpointContext, token: string) => Promise<{
+    payload: CookieCachePayload;
+    expiresAt: number;
+  } | null>;
+};
 interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions> {
   createOAuthUser(user: Omit<User, "id" | "createdAt" | "updatedAt">, account: Omit<Account, "userId" | "id" | "createdAt" | "updatedAt"> & Partial<Account>): Promise<{
     user: User;
@@ -261,6 +271,7 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
     updateAge: number;
     expiresIn: number;
     freshAge: number;
+    cookieCacheSigner?: CookieCacheSigner | undefined;
     cookieRefreshCache: false | {
       enabled: true;
       updateAge: number;
@@ -330,4 +341,4 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
   runInBackgroundOrAwait: (promise: Promise<unknown> | void) => Awaitable<unknown>;
 };
 //#endregion
-export { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext };
+export { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, CookieCacheSigner, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext };

package/dist/types/cookie.d.mts

@@ -1,3 +1,6 @@
+import { Session } from "../db/schema/session.mjs";
+import { User } from "../db/schema/user.mjs";
+import "../db/index.mjs";
 import { CookieOptions } from "better-call";
 //#region src/types/cookie.d.ts
 type BetterAuthCookie = {
@@ -10,5 +13,14 @@ type BetterAuthCookies = {
   accountData: BetterAuthCookie;
   dontRememberToken: BetterAuthCookie;
 };
+/**
+ * A validated cookie-cache payload, including legacy payloads without a version.
+ */
+type CookieCachePayload = {
+  session: Session & Record<string, unknown>;
+  user: User & Record<string, unknown>;
+  updatedAt: number;
+  version?: string | undefined;
+};
 //#endregion
-export { BetterAuthCookie, BetterAuthCookies };
+export { BetterAuthCookie, BetterAuthCookies, CookieCachePayload };

package/dist/types/index.d.mts

@@ -1,9 +1,9 @@
 import { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection } from "./helper.mjs";
 import { BetterAuthPlugin, BetterAuthPluginErrorCodePart, HookEndpointContext } from "./plugin.mjs";
 import { BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthDBOptions, BetterAuthOptions, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, DynamicBaseURLConfig, GenerateIdFn, StoreIdentifierOption, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource } from "./init-options.mjs";
-import { BetterAuthCookie, BetterAuthCookies } from "./cookie.mjs";
+import { BetterAuthCookie, BetterAuthCookies, CookieCachePayload } from "./cookie.mjs";
 import { SecretConfig } from "./secret.mjs";
-import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./context.mjs";
+import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, CookieCacheSigner, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./plugin-client.mjs";
 import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
-export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1$1 as StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, CookieCachePayload, CookieCacheSigner, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1$1 as StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };

package/dist/types/init-options.d.mts

@@ -978,20 +978,6 @@ type BetterAuthOptions = {
        * @default "compact"
        */
       strategy?: "compact" | "jwt" | "jwe";
-      /**
-       * JWT-specific configuration for `strategy: "jwt"`.
-       */
-      jwt?: {
-        /**
-         * Which signing key is used for cookie-cache JWTs.
-         *
-         * - `"secret"`: uses the Better Auth secret with HS256.
-         * - `"jwt-plugin"`: uses the installed `jwt()` plugin's asymmetric signing keys.
-         *
-         * @default "secret"
-         */
-        signingKey?: "secret" | "jwt-plugin";
-      };
       /**
        * Controls stateless cookie cache refresh behavior.
        *

package/dist/utils/email.d.mts

@@ -0,0 +1,19 @@
+//#region src/utils/email.d.ts
+interface PlaceholderEmailOptions {
+  /**
+   * A stable identifier that distinguishes the account within the namespace.
+   */
+  identifier: string;
+  /**
+   * A namespace that distinguishes identical identifiers from different sources.
+   */
+  namespace: string;
+}
+/**
+ * Creates a stable, non-routable email address for an account without an email.
+ *
+ * @throws TypeError if the generated email is invalid.
+ */
+declare function createPlaceholderEmail({ identifier, namespace }: PlaceholderEmailOptions): string;
+//#endregion
+export { PlaceholderEmailOptions, createPlaceholderEmail };

package/dist/utils/email.mjs

@@ -0,0 +1,18 @@
+import * as z from "zod";
+//#region src/utils/email.ts
+/**
+* @see https://www.rfc-editor.org/rfc/rfc6761.html#section-6.4
+*/
+const PLACEHOLDER_EMAIL_DOMAIN = "placeholder.invalid";
+/**
+* Creates a stable, non-routable email address for an account without an email.
+*
+* @throws TypeError if the generated email is invalid.
+*/
+function createPlaceholderEmail({ identifier, namespace }) {
+	const result = z.email().safeParse(`${identifier}@${namespace}.${PLACEHOLDER_EMAIL_DOMAIN}`);
+	if (!result.success) throw new TypeError("Invalid placeholder email");
+	return result.data;
+}
+//#endregion
+export { createPlaceholderEmail };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.7.0-rc.3",
+  "version": "1.7.0-rc.5",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -164,9 +164,9 @@
     "@better-fetch/fetch": "1.3.1",
     "@cloudflare/workers-types": "^4.20250121.0",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/sdk-trace-base": "^2.8.0",
-    "@opentelemetry/sdk-trace-node": "^2.8.0",
-    "better-call": "1.3.7",
+    "@opentelemetry/sdk-trace-base": "^2.10.0",
+    "@opentelemetry/sdk-trace-node": "^2.10.0",
+    "better-call": "1.4.0",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
@@ -177,7 +177,7 @@
     "@better-fetch/fetch": "1.3.1",
     "@cloudflare/workers-types": ">=4",
     "@opentelemetry/api": "^1.9.0",
-    "better-call": "1.3.7",
+    "better-call": "1.4.0",
     "jose": "^6.1.0",
     "kysely": "^0.28.5 || ^0.29.0",
     "nanostores": "^1.0.1"

package/src/api/index.ts

@@ -1,6 +1,7 @@
 import type {
-	EndpointContext,
+	EndpointHandler,
 	EndpointOptions,
+	MiddlewareHandler,
 	StrictEndpoint,
 } from "better-call";
 import {
@@ -75,94 +76,93 @@ export const createAuthMiddleware = createMiddleware.create({
 	],
 });
 
-const use = [optionsMiddleware];
+const createEndpointWithAuthContext = createEndpoint.create({
+	use: [optionsMiddleware],
+});
 
-type EndpointHandler<
+type AuthEndpointHandler<
 	Path extends string,
 	Options extends EndpointOptions,
 	R,
-> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;
+> = EndpointHandler<Path, Options, R, AuthContext>;
 
-export function createAuthEndpoint<
-	Path extends string,
+type PathlessAuthEndpointHandler<
 	Options extends EndpointOptions,
 	R,
->(
-	path: Path,
-	options: Options,
-	handler: EndpointHandler<Path, Options, R>,
-): StrictEndpoint<Path, Options, R>;
+> = AuthEndpointHandler<string, Options, R>;
 
-export function createAuthEndpoint<
+function wrapEndpointHandler<
 	Path extends string,
 	Options extends EndpointOptions,
 	R,
 >(
+	handler: AuthEndpointHandler<Path, Options, R>,
 	options: Options,
-	handler: EndpointHandler<Path, Options, R>,
-): StrictEndpoint<Path, Options, R>;
-
-export function createAuthEndpoint<
-	Path extends string,
-	Opts extends EndpointOptions,
-	R,
->(
-	pathOrOptions: Path | Opts,
-	handlerOrOptions: EndpointHandler<Path, Opts, R> | Opts,
-	handlerOrNever?: any,
-) {
-	const path: Path | undefined =
-		typeof pathOrOptions === "string" ? pathOrOptions : undefined;
-	const options: Opts =
-		typeof handlerOrOptions === "object"
-			? handlerOrOptions
-			: (pathOrOptions as Opts);
-	const handler: EndpointHandler<Path, Opts, R> =
-		typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
-
-	// Endpoints that return credentials declare `metadata: { noStore: true }`.
-	// Emit the no-store headers at the boundary, before the handler runs, so they
-	// land on every response the handler produces: a success harvests
-	// `responseHeaders`, and a thrown error carries the same headers through
-	// `attachResponseHeadersToAPIError`. Validation that rejects the request
-	// before the handler runs is not covered (and returns no credentials).
+): AuthEndpointHandler<Path, Options, R> {
 	const noStore =
 		(options as { metadata?: { noStore?: boolean } }).metadata?.noStore ===
 		true;
 
-	// todo: prettify the code, we want to call `runWithEndpointContext` to top level
-	const wrapped: EndpointHandler<Path, Opts, R> = async (ctx) => {
+	return async (context) => {
 		if (noStore) {
 			for (const [name, value] of Object.entries(NO_STORE_HEADERS)) {
-				ctx.setHeader(name, value);
+				context.setHeader(name, value);
 			}
 		}
-		const runtimeCtx = ctx as unknown as { responseHeaders?: Headers };
 		try {
-			return await runWithEndpointContext(ctx as any, () => handler(ctx));
-		} catch (e) {
-			attachResponseHeadersToAPIError(runtimeCtx.responseHeaders, e);
-			throw e;
+			return await runWithEndpointContext(context, () => handler(context));
+		} catch (error) {
+			attachResponseHeadersToAPIError(context.responseHeaders, error);
+			throw error;
 		}
 	};
+}
 
-	if (path) {
-		return createEndpoint(
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	path: Path,
+	options: Options,
+	handler: AuthEndpointHandler<Path, Options, R>,
+): StrictEndpoint<Path, Options, R>;
+
+export function createAuthEndpoint<
+	InferredPath extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: PathlessAuthEndpointHandler<Options, R>,
+): StrictEndpoint<InferredPath, Options, R>;
+
+export function createAuthEndpoint<
+	Path extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	...args:
+		| [
+				path: Path,
+				options: Options,
+				handler: AuthEndpointHandler<Path, Options, R>,
+		  ]
+		| [options: Options, handler: PathlessAuthEndpointHandler<Options, R>]
+) {
+	if (args.length === 3) {
+		const [path, options, handler] = args;
+		return createEndpointWithAuthContext(
 			path,
-			{
-				...options,
-				use: [...(options?.use || []), ...use],
-			},
-			wrapped,
+			options,
+			wrapEndpointHandler(handler, options),
 		);
 	}
 
-	return createEndpoint(
-		{
-			...options,
-			use: [...(options?.use || []), ...use],
-		},
-		wrapped,
+	const [options, handler] = args;
+	return createEndpointWithAuthContext(
+		options,
+		wrapEndpointHandler(handler, options),
 	);
 }
 
@@ -179,44 +179,45 @@ function withServerOnly<Options extends EndpointOptions>(
 	} as Options;
 }
 
-export namespace createAuthEndpoint {
-	/**
-	 * Declare a **server-only** endpoint.
-	 *
-	 * The endpoint is callable through `auth.api.*` from trusted server code but is
-	 * never registered on the HTTP router and never emitted into the OpenAPI
-	 * schema. It takes no path because it has no URL to be reached at.
-	 *
-	 * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
-	 * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
-	 * keeps the endpoint off the HTTP surface even if a path is later added by
-	 * mistake: better-call's router skips an endpoint when its path is missing *or*
-	 * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
-	 * on path omission alone is invisible and one keystroke away from exposure.
-	 *
-	 * @example
-	 * ```ts
-	 * viewBackupCodes: createAuthEndpoint.serverOnly(
-	 * 	{ method: "POST", body: schema },
-	 * 	async (ctx) => { ... },
-	 * )
-	 * ```
-	 */
-	export function serverOnly<
-		Path extends string,
-		Options extends EndpointOptions,
-		R,
-	>(
-		options: Options,
-		handler: EndpointHandler<Path, Options, R>,
-	): StrictEndpoint<Path, Options, R> {
-		return createAuthEndpoint(withServerOnly(options), handler);
-	}
-}
+/**
+ * Declare a **server-only** endpoint.
+ *
+ * The endpoint is callable through `auth.api.*` from trusted server code but is
+ * never registered on the HTTP router and never emitted into the OpenAPI
+ * schema. It takes no path because it has no URL to be reached at.
+ *
+ * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
+ * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
+ * keeps the endpoint off the HTTP surface even if a path is later added by
+ * mistake: better-call's router skips an endpoint when its path is missing *or*
+ * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
+ * on path omission alone is invisible and one keystroke away from exposure.
+ *
+ * @example
+ * ```ts
+ * viewBackupCodes: createAuthEndpoint.serverOnly(
+ * 	{ method: "POST", body: schema },
+ * 	async (ctx) => { ... },
+ * )
+ * ```
+ */
+createAuthEndpoint.serverOnly = <
+	InferredPath extends string,
+	Options extends EndpointOptions,
+	R,
+>(
+	options: Options,
+	handler: PathlessAuthEndpointHandler<Options, R>,
+): StrictEndpoint<InferredPath, Options, R> =>
+	createAuthEndpoint<InferredPath, Options, R>(
+		withServerOnly(options),
+		handler,
+	);
 
 export type AuthEndpoint<
 	Path extends string,
 	Opts extends EndpointOptions,
 	R,
 > = ReturnType<typeof createAuthEndpoint<Path, Opts, R>>;
-export type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
+
+export type AuthMiddleware = MiddlewareHandler;

package/src/db/get-tables.ts

@@ -253,7 +253,7 @@ const buildAuthTables = (options: BetterAuthOptions): BetterAuthDBSchema => {
 			indexes: mergeTableIndexes(
 				[
 					{
-						fields: ["issuer", "providerAccountId"],
+						fields: ["issuer", "accountId"],
 						unique: true,
 					},
 				],
@@ -265,11 +265,10 @@ const buildAuthTables = (options: BetterAuthOptions): BetterAuthDBSchema => {
 					required: true,
 					fieldName: options.account?.fields?.issuer || "issuer",
 				},
-				providerAccountId: {
+				accountId: {
 					type: "string",
 					required: true,
-					fieldName:
-						options.account?.fields?.providerAccountId || "providerAccountId",
+					fieldName: options.account?.fields?.accountId || "accountId",
 				},
 				providerId: {
 					type: "string",

package/src/db/schema/account.ts

@@ -10,7 +10,7 @@ import { coreSchema } from "./shared";
 export const accountSchema = coreSchema.extend({
 	providerId: z.string(),
 	issuer: z.string(),
-	providerAccountId: z.string(),
+	accountId: z.string(),
 	userId: z.coerce.string(),
 	accessToken: z.string().nullish(),
 	refreshToken: z.string().nullish(),
@@ -39,9 +39,7 @@ export const accountSchema = coreSchema.extend({
 export type BaseAccount = z.infer<typeof accountSchema>;
 
 /** The stable provider-side key used to recognize an account. */
-export type AccountKey = Readonly<
-	Pick<BaseAccount, "issuer" | "providerAccountId">
->;
+export type AccountKey = Readonly<Pick<BaseAccount, "issuer" | "accountId">>;
 
 function encodeAccountIssuerProviderId(providerId: string): string {
 	return encodeURIComponent(providerId);

package/src/db/schema/user.ts

@@ -9,7 +9,7 @@ import { coreSchema } from "./shared";
 export const userSchema = coreSchema.extend({
 	// TODO(#9124): widen to nullish in v2. OAuth providers (Discord phone-only,
 	// Apple subsequent sign-ins, etc.) can legitimately omit email; identity
-	// must key on (issuer, providerAccountId) per OpenID Connect Core §5.7.
+	// must key on (issuer, accountId) per OpenID Connect Core §5.7.
 	email: z.string().transform((val) => val.toLowerCase()),
 	emailVerified: z.boolean().default(false),
 	name: z.string(),

package/src/social-providers/apple.ts

@@ -89,6 +89,7 @@ export const apple = (options: AppleOptions) => {
 			scopes,
 			redirectURI,
 			additionalParams,
+			codeVerifier,
 		}) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error(
@@ -106,6 +107,7 @@ export const apple = (options: AppleOptions) => {
 				scopes: _scope,
 				state,
 				redirectURI,
+				codeVerifier,
 				responseMode: "form_post",
 				responseType: "code id_token",
 				additionalParams,

package/src/types/context.ts

@@ -12,7 +12,11 @@ import type { DBAdapter, Where } from "../db/adapter";
 import type { AccountKey } from "../db/schema/account";
 import type { createLogger } from "../env";
 import type { OAuthProvider } from "../oauth2";
-import type { BetterAuthCookie, BetterAuthCookies } from "./cookie";
+import type {
+	BetterAuthCookie,
+	BetterAuthCookies,
+	CookieCachePayload,
+} from "./cookie";
 import type { Awaitable, LiteralString } from "./helper";
 import type {
 	BetterAuthOptions,
@@ -86,6 +90,24 @@ export type GenericEndpointContext<
 	context: AuthContext<Options>;
 };
 
+/**
+ * Signs and verifies session cookie-cache values.
+ */
+export type CookieCacheSigner = {
+	sign: (
+		ctx: GenericEndpointContext,
+		payload: CookieCachePayload,
+		expiresIn: number,
+	) => Promise<string>;
+	verify: (
+		ctx: GenericEndpointContext,
+		token: string,
+	) => Promise<{
+		payload: CookieCachePayload;
+		expiresAt: number;
+	} | null>;
+};
+
 export interface InternalAdapter<
 	_Options extends BetterAuthOptions = BetterAuthOptions,
 > {
@@ -403,6 +425,7 @@ export type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> =
 				updateAge: number;
 				expiresIn: number;
 				freshAge: number;
+				cookieCacheSigner?: CookieCacheSigner | undefined;
 				cookieRefreshCache:
 					| false
 					| {

package/src/types/cookie.ts

@@ -1,4 +1,5 @@
 import type { CookieOptions } from "better-call";
+import type { Session, User } from "../db";
 
 export type BetterAuthCookie = { name: string; attributes: CookieOptions };
 
@@ -8,3 +9,13 @@ export type BetterAuthCookies = {
 	accountData: BetterAuthCookie;
 	dontRememberToken: BetterAuthCookie;
 };
+
+/**
+ * A validated cookie-cache payload, including legacy payloads without a version.
+ */
+export type CookieCachePayload = {
+	session: Session & Record<string, unknown>;
+	user: User & Record<string, unknown>;
+	updatedAt: number;
+	version?: string | undefined;
+};

package/src/types/index.ts

@@ -3,6 +3,7 @@ export type {
 	AuthContext,
 	BetterAuthPluginRegistry,
 	BetterAuthPluginRegistryIdentifier,
+	CookieCacheSigner,
 	GenericEndpointContext,
 	InfoContext,
 	InternalAdapter,
@@ -11,6 +12,7 @@ export type {
 export type {
 	BetterAuthCookie,
 	BetterAuthCookies,
+	CookieCachePayload,
 } from "./cookie";
 export type * from "./helper";
 export type {

package/src/types/init-options.ts

@@ -1089,20 +1089,6 @@ export type BetterAuthOptions = {
 					 * @default "compact"
 					 */
 					strategy?: "compact" | "jwt" | "jwe";
-					/**
-					 * JWT-specific configuration for `strategy: "jwt"`.
-					 */
-					jwt?: {
-						/**
-						 * Which signing key is used for cookie-cache JWTs.
-						 *
-						 * - `"secret"`: uses the Better Auth secret with HS256.
-						 * - `"jwt-plugin"`: uses the installed `jwt()` plugin's asymmetric signing keys.
-						 *
-						 * @default "secret"
-						 */
-						signingKey?: "secret" | "jwt-plugin";
-					};
 					/**
 					 * Controls stateless cookie cache refresh behavior.
 					 *

package/src/utils/email.ts

@@ -0,0 +1,36 @@
+import * as z from "zod";
+
+/**
+ * @see https://www.rfc-editor.org/rfc/rfc6761.html#section-6.4
+ */
+const PLACEHOLDER_EMAIL_DOMAIN = "placeholder.invalid";
+
+export interface PlaceholderEmailOptions {
+	/**
+	 * A stable identifier that distinguishes the account within the namespace.
+	 */
+	identifier: string;
+	/**
+	 * A namespace that distinguishes identical identifiers from different sources.
+	 */
+	namespace: string;
+}
+
+/**
+ * Creates a stable, non-routable email address for an account without an email.
+ *
+ * @throws TypeError if the generated email is invalid.
+ */
+export function createPlaceholderEmail({
+	identifier,
+	namespace,
+}: PlaceholderEmailOptions): string {
+	const result = z
+		.email()
+		.safeParse(`${identifier}@${namespace}.${PLACEHOLDER_EMAIL_DOMAIN}`);
+	if (!result.success) {
+		throw new TypeError("Invalid placeholder email");
+	}
+
+	return result.data;
+}