@better-auth/core 1.7.1 → 1.7.3

package/dist/api/index.d.mts

@@ -1,6 +1,7 @@
 import { BetterAuthDBSchema, ModelNames, SecondaryStorage } from "../db/type.mjs";
 import { DBAdapter } from "../db/adapter/index.mjs";
 import { createLogger } from "../env/logger.mjs";
+import { SchemaCheck } from "../db/schema-check.mjs";
 import { AuthContext } from "../types/context.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
 import * as _$better_call0 from "better-call";
@@ -112,6 +113,7 @@ declare const createAuthMiddleware: {
       storage: "memory" | "database" | "secondary-storage";
     } & Omit<_$_better_auth_core0.BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
     adapter: DBAdapter<_$_better_auth_core0.BetterAuthOptions>;
+    checkSchema?: SchemaCheck | undefined;
     internalAdapter: _$_better_auth_core0.InternalAdapter<_$_better_auth_core0.BetterAuthOptions>;
     createAuthCookie: (cookieName: string, overrideAttributes?: Partial<_$better_call0.CookieOptions> | undefined) => _$_better_auth_core0.BetterAuthCookie;
     secret: string;
@@ -242,6 +244,7 @@ declare const createAuthMiddleware: {
       storage: "memory" | "database" | "secondary-storage";
     } & Omit<_$_better_auth_core0.BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
     adapter: DBAdapter<_$_better_auth_core0.BetterAuthOptions>;
+    checkSchema?: SchemaCheck | undefined;
     internalAdapter: _$_better_auth_core0.InternalAdapter<_$_better_auth_core0.BetterAuthOptions>;
     createAuthCookie: (cookieName: string, overrideAttributes?: Partial<_$better_call0.CookieOptions> | undefined) => _$_better_auth_core0.BetterAuthCookie;
     secret: string;

package/dist/context/endpoint-context.d.mts

@@ -6,13 +6,27 @@ import { AsyncLocalStorage } from "@better-auth/core/async_hooks";
 type AuthEndpointContext = Partial<InputContext<string, any> & EndpointContext<string, any>> & {
   context: AuthContext;
 };
+type AuthEndpointContextStorage = AsyncLocalStorage<AuthEndpointContext>;
 /**
- * This is for internal use only. Most users should use `getCurrentAuthContext` instead.
+ * @deprecated Use `getCurrentAuthEndpointContext`,
+ * `tryGetCurrentAuthEndpointContext`, or `runWithEndpointContext` instead.
+ */
+declare function getCurrentAuthContextAsyncLocalStorage(): Promise<AuthEndpointContextStorage>;
+/**
+ * Returns the current auth endpoint context, or `undefined` when called outside
+ * of `runWithEndpointContext`.
+ */
+declare function tryGetCurrentAuthEndpointContext(): AuthEndpointContext | undefined;
+/**
+ * Returns the current auth endpoint context.
  *
- * It is exposed for advanced use cases where you need direct access to the AsyncLocalStorage instance.
+ * @throws When called outside of `runWithEndpointContext`.
+ */
+declare function getCurrentAuthEndpointContext(): AuthEndpointContext;
+/**
+ * @deprecated Use `getCurrentAuthEndpointContext` instead.
  */
-declare function getCurrentAuthContextAsyncLocalStorage(): Promise<AsyncLocalStorage<AuthEndpointContext>>;
 declare function getCurrentAuthContext(): Promise<AuthEndpointContext>;
-declare function runWithEndpointContext<T>(context: AuthEndpointContext, fn: () => T): Promise<T>;
+declare function runWithEndpointContext<T>(authEndpointContext: AuthEndpointContext, fn: () => T): Promise<T>;
 //#endregion
-export { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext };
+export { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext };

package/dist/context/endpoint-context.mjs

@@ -1,29 +1,48 @@
-import { __getBetterAuthGlobal } from "./global.mjs";
+import { __getBetterAuthGlobal, __getCurrentEndpointContext } from "./global.mjs";
 import { getAsyncLocalStorage } from "@better-auth/core/async_hooks";
 //#region src/context/endpoint-context.ts
-const ensureAsyncStorage = async () => {
-	const betterAuthGlobal = __getBetterAuthGlobal();
-	const existing = betterAuthGlobal.context.endpointContextAsyncStorage;
+const getExistingEndpointContextStorage = () => {
+	return __getBetterAuthGlobal().context.endpointContextAsyncStorage;
+};
+const getOrCreateEndpointContextStorage = async () => {
+	const existing = getExistingEndpointContextStorage();
 	if (existing) return existing;
 	const AsyncLocalStorage = await getAsyncLocalStorage();
-	betterAuthGlobal.context.endpointContextAsyncStorage ??= new AsyncLocalStorage();
-	return betterAuthGlobal.context.endpointContextAsyncStorage;
+	const globalContext = __getBetterAuthGlobal().context;
+	return globalContext.endpointContextAsyncStorage ??= new AsyncLocalStorage();
 };
 /**
-* This is for internal use only. Most users should use `getCurrentAuthContext` instead.
-*
-* It is exposed for advanced use cases where you need direct access to the AsyncLocalStorage instance.
+* @deprecated Use `getCurrentAuthEndpointContext`,
+* `tryGetCurrentAuthEndpointContext`, or `runWithEndpointContext` instead.
 */
 async function getCurrentAuthContextAsyncLocalStorage() {
-	return ensureAsyncStorage();
+	return getOrCreateEndpointContextStorage();
+}
+/**
+* Returns the current auth endpoint context, or `undefined` when called outside
+* of `runWithEndpointContext`.
+*/
+function tryGetCurrentAuthEndpointContext() {
+	return __getCurrentEndpointContext();
 }
+/**
+* Returns the current auth endpoint context.
+*
+* @throws When called outside of `runWithEndpointContext`.
+*/
+function getCurrentAuthEndpointContext() {
+	const authEndpointContext = tryGetCurrentAuthEndpointContext();
+	if (!authEndpointContext) throw new Error("No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.");
+	return authEndpointContext;
+}
+/**
+* @deprecated Use `getCurrentAuthEndpointContext` instead.
+*/
 async function getCurrentAuthContext() {
-	const context = (await ensureAsyncStorage()).getStore();
-	if (!context) throw new Error("No auth context found. Please make sure you are calling this function within a `runWithEndpointContext` callback.");
-	return context;
+	return getCurrentAuthEndpointContext();
 }
-async function runWithEndpointContext(context, fn) {
-	return (await ensureAsyncStorage()).run(context, fn);
+async function runWithEndpointContext(authEndpointContext, fn) {
+	return (await getOrCreateEndpointContextStorage()).run(authEndpointContext, fn);
 }
 //#endregion
-export { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext };
+export { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext };

package/dist/context/global.mjs

@@ -2,7 +2,7 @@
 const symbol = Symbol.for("better-auth:global");
 let bind = null;
 const __context = {};
-const __betterAuthVersion = "1.7.1";
+const __betterAuthVersion = "1.7.3";
 /**
 * We store context instance in the globalThis.
 *
@@ -29,8 +29,11 @@ function __getBetterAuthGlobal() {
 	}
 	return globalThis[symbol];
 }
+function __getCurrentEndpointContext() {
+	return __getBetterAuthGlobal().context.endpointContextAsyncStorage?.getStore();
+}
 function getBetterAuthVersion() {
 	return __getBetterAuthGlobal().version;
 }
 //#endregion
-export { __getBetterAuthGlobal, getBetterAuthVersion };
+export { __getBetterAuthGlobal, __getCurrentEndpointContext, getBetterAuthVersion };

package/dist/context/index.d.mts

@@ -1,5 +1,5 @@
-import { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext } from "./endpoint-context.mjs";
+import { AuthEndpointContext, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext } from "./endpoint-context.mjs";
 import { getBetterAuthVersion } from "./global.mjs";
 import { RequestState, RequestStateWeakMap, defineRequestState, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, runWithRequestState } from "./request-state.mjs";
 import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, queueAfterTransactionHook, runWithAdapter, runWithTransaction } from "./transaction.mjs";
-export { type AuthEndpointContext, type RequestState, type RequestStateWeakMap, defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction };
+export { type AuthEndpointContext, type RequestState, type RequestStateWeakMap, defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction, tryGetCurrentAuthEndpointContext };

package/dist/context/index.mjs

@@ -1,5 +1,5 @@
 import { getBetterAuthVersion } from "./global.mjs";
-import { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, runWithEndpointContext } from "./endpoint-context.mjs";
+import { getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, runWithEndpointContext, tryGetCurrentAuthEndpointContext } from "./endpoint-context.mjs";
 import { defineRequestState, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, runWithRequestState } from "./request-state.mjs";
 import { getCurrentAdapter, getCurrentDBAdapterAsyncLocalStorage, queueAfterTransactionHook, runWithAdapter, runWithTransaction } from "./transaction.mjs";
-export { defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction };
+export { defineRequestState, getBetterAuthVersion, getCurrentAdapter, getCurrentAuthContext, getCurrentAuthContextAsyncLocalStorage, getCurrentAuthEndpointContext, getCurrentDBAdapterAsyncLocalStorage, getCurrentRequestState, getRequestStateAsyncLocalStorage, hasRequestState, queueAfterTransactionHook, runWithAdapter, runWithEndpointContext, runWithRequestState, runWithTransaction, tryGetCurrentAuthEndpointContext };

package/dist/context/transaction.mjs

@@ -1,4 +1,5 @@
 import { __getBetterAuthGlobal } from "./global.mjs";
+import { schemaCheckFor } from "../db/schema-check.mjs";
 import { getAsyncLocalStorage } from "@better-auth/core/async_hooks";
 //#region src/context/transaction.ts
 const ensureAsyncStorage = async () => {
@@ -55,6 +56,8 @@ const runWithTransaction = async (adapter, fn, options) => {
 	return ensureAsyncStorage().then(async (als) => {
 		called = true;
 		if (als.getStore()?.isTransactionActive) return fn();
+		const pendingSchemaCheck = schemaCheckFor(adapter)?.();
+		if (pendingSchemaCheck) await pendingSchemaCheck;
 		const pendingHooks = [];
 		let result;
 		let error;

package/dist/db/adapter/atomic-fallback.mjs

@@ -0,0 +1,134 @@
+import { BetterAuthError } from "../../error/index.mjs";
+import * as z from "zod";
+//#region src/db/adapter/atomic-fallback.ts
+const MAX_ATTEMPTS = 5;
+const scalar = z.union([
+	z.string(),
+	z.number(),
+	z.boolean(),
+	z.date()
+]).nullable();
+const readSchema = z.record(z.string(), z.unknown()).nullish();
+const setSchema = z.record(z.string(), z.unknown()).transform((values) => {
+	const assignments = {};
+	for (const [field, value] of Object.entries(values)) if (value !== void 0) assignments[field] = value;
+	return assignments;
+});
+const mutationSchema = z.object({
+	increment: z.record(z.string(), z.number()),
+	set: setSchema.optional()
+});
+const counterSchema = z.number().nullish();
+function createAtomicFallbacks(context) {
+	const { adapter, adapterId } = context;
+	const outputId = Object.entries(context.mapKeysTransformOutput ?? {}).find(([, field]) => field === "id")?.[0] ?? "id";
+	async function idWhere(row, model, action) {
+		const mappedId = context.mapKeysTransformInput?.id || context.getFieldName({
+			model,
+			field: "id"
+		});
+		if (row[mappedId] === void 0 || row[mappedId] === null) throw new BetterAuthError(`Adapter "${context.adapterId}" must return the row id for atomic fallbacks.`);
+		const id = (await context.transformOutput(row, model, [outputId], void 0))?.id;
+		if (typeof id !== "string" && typeof id !== "number") throw new BetterAuthError(`Adapter "${context.adapterId}" must expose a logical string or number id through its output transform.`);
+		const [condition] = context.transformWhereClause({
+			model,
+			where: [{
+				field: "id",
+				value: id
+			}],
+			action
+		});
+		if (!condition) throw new BetterAuthError("The atomic fallback id condition was transformed away.");
+		return condition;
+	}
+	async function readRow({ model, where }) {
+		const result = readSchema.safeParse(await adapter.findOne({
+			model,
+			where
+		}));
+		if (!result.success) throw new BetterAuthError(`Adapter "${adapterId}" must return a row snapshot or null.`);
+		return result.data ?? null;
+	}
+	async function snapshotGuard(row, fields, request, action) {
+		const id = await idWhere(row, request.logicalModel, action);
+		const hasOr = request.where.some((clause) => clause.connector === "OR");
+		const guard = hasOr ? [id] : [...request.where, id];
+		const keys = new Set(fields);
+		for (const field of keys) {
+			if (field === id.field) continue;
+			const value = scalar.safeParse(row[field] ?? null);
+			if (!value.success) {
+				if (hasOr && request.where.some((clause) => clause.field === field)) throw new BetterAuthError(`Adapter "${adapterId}" must implement native atomic methods for OR predicates on structured values.`);
+				continue;
+			}
+			guard.push({
+				field,
+				value: value.data,
+				operator: "eq",
+				connector: "AND",
+				mode: "sensitive"
+			});
+		}
+		return guard;
+	}
+	function changedOne(count) {
+		if (count !== 0 && count !== 1) throw new BetterAuthError(`Adapter "${adapterId}" must return an affected row count of 0 or 1 from an atomic fallback.`);
+		return count === 1;
+	}
+	async function consumeOne(request) {
+		const { model, where } = request;
+		const row = await readRow(request);
+		if (row === null) return null;
+		const guard = await snapshotGuard(row, [...Object.keys(row), ...where.map(({ field }) => field)], request, "consumeOne");
+		return changedOne(await adapter.deleteMany({
+			model,
+			where: guard
+		})) ? row : null;
+	}
+	async function incrementOne(request) {
+		const { model, where } = request;
+		const mutation = mutationSchema.safeParse(request);
+		if (!mutation.success) throw new BetterAuthError("incrementOne requires finite increments and a set object for the atomic fallback.");
+		const { increment, set } = mutation.data;
+		const deltas = Object.entries(increment);
+		const fields = [
+			...where.map(({ field }) => field),
+			...Object.keys(increment),
+			...Object.keys(set ?? {})
+		];
+		for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+			const row = await readRow(request);
+			if (row === null) return null;
+			const update = { ...set };
+			for (const [field, delta] of deltas) {
+				const previous = counterSchema.safeParse(row[field]);
+				if (!previous.success) throw new BetterAuthError(`Adapter "${adapterId}" must return finite numeric counter values or null for atomic increments.`);
+				const current = previous.data ?? 0;
+				const next = current + delta;
+				if (!Number.isFinite(next) || delta !== 0 && next === current) throw new BetterAuthError(`Adapter "${adapterId}" cannot represent the requested counter increment safely.`);
+				update[field] = next;
+			}
+			const guard = await snapshotGuard(row, fields, request, "incrementOne");
+			if (Object.entries(update).every(([field, value]) => {
+				const previous = row[field];
+				if (previous instanceof Date && value instanceof Date) return previous.getTime() === value.getTime();
+				return Object.is(previous, value);
+			})) return row;
+			if (changedOne(await adapter.updateMany({
+				model,
+				where: guard,
+				update
+			}))) return {
+				...row,
+				...update
+			};
+		}
+		throw new BetterAuthError(`Adapter "${adapterId}" could not complete an atomic increment due to contention. Retry the operation or implement incrementOne natively.`);
+	}
+	return {
+		consumeOne,
+		incrementOne
+	};
+}
+//#endregion
+export { createAtomicFallbacks };

package/dist/db/adapter/factory.mjs

@@ -3,6 +3,7 @@ import { getAuthTables } from "../get-tables.mjs";
 import { getColorDepth } from "../../env/color-depth.mjs";
 import { TTY_COLORS, createLogger } from "../../env/logger.mjs";
 import { safeJSONParse } from "../../utils/json.mjs";
+import { createAtomicFallbacks } from "./atomic-fallback.mjs";
 import { initGetDefaultModelName } from "./get-default-model-name.mjs";
 import { initGetDefaultFieldName } from "./get-default-field-name.mjs";
 import { initGetIdField } from "./get-id-field.mjs";
@@ -401,6 +402,15 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 		transformWhereClause
 	});
 	let lazyLoadTransaction = null;
+	const atomicFallbacks = createAtomicFallbacks({
+		adapter: adapterInstance,
+		adapterId: config.adapterId,
+		mapKeysTransformInput: config.mapKeysTransformInput,
+		mapKeysTransformOutput: config.mapKeysTransformOutput,
+		getFieldName,
+		transformOutput,
+		transformWhereClause
+	});
 	const adapter = {
 		transaction: async (cb) => {
 			if (!lazyLoadTransaction) if (!config.transaction) lazyLoadTransaction = createAsIsTransaction(adapter);
@@ -696,12 +706,15 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 				model,
 				where
 			});
-			if (typeof adapterInstance.consumeOne !== "function") throw new BetterAuthError(`Adapter "${config.adapterId}" must implement consumeOne for atomic single-use credential consumption.`);
 			const res = await withSpan(`db consumeOne ${model}`, {
 				[ATTR_DB_OPERATION_NAME]: "consumeOne",
 				[ATTR_DB_COLLECTION_NAME]: model
-			}, () => adapterInstance.consumeOne({
+			}, () => adapterInstance.consumeOne ? adapterInstance.consumeOne({
+				model,
+				where
+			}) : atomicFallbacks.consumeOne({
 				model,
+				logicalModel: unsafeModel,
 				where
 			}));
 			debugLog({ method: "consumeOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(2, 3)}`, `${formatMethod("consumeOne")} ${formatAction("DB Result")}:`, {
@@ -735,7 +748,6 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 				increment: unsafeIncrement,
 				set: unsafeSet
 			});
-			if (typeof adapterInstance.incrementOne !== "function") throw new BetterAuthError(`Adapter "${config.adapterId}" must implement incrementOne for atomic guarded counter updates.`);
 			const mappedKeys = config.mapKeysTransformInput ?? {};
 			const increment = {};
 			for (const [field, delta] of Object.entries(unsafeIncrement)) increment[mappedKeys[field] || getFieldName({
@@ -749,8 +761,14 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 			const res = await withSpan(`db incrementOne ${model}`, {
 				[ATTR_DB_OPERATION_NAME]: "incrementOne",
 				[ATTR_DB_COLLECTION_NAME]: model
-			}, () => adapterInstance.incrementOne({
+			}, () => adapterInstance.incrementOne ? adapterInstance.incrementOne({
+				model,
+				where,
+				increment,
+				set
+			}) : atomicFallbacks.incrementOne({
 				model,
+				logicalModel: unsafeModel,
 				where,
 				increment,
 				set

package/dist/db/adapter/index.d.mts

@@ -434,9 +434,9 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
    * race-safe primitive for consuming single-use credentials
    * (verification tokens, authorization codes, one-time tokens).
    *
-   * Always defined on the factory-wrapped adapter. The underlying
-   * `CustomAdapter` must implement this natively; there is no portable
-   * fallback that can guarantee cross-process single-use semantics.
+   * Always defined on the factory-wrapped adapter. Without a native method,
+   * the factory uses a snapshot-guarded delete and requires an exact affected
+   * row count. The adapter must evaluate the condition and deletion atomically.
    */
   consumeOne: <T>(data: {
     model: string;
@@ -461,9 +461,11 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
    * primitive for guarded counter updates (e.g. decrementing a remaining-uses
    * counter only while it is still positive).
    *
-   * Always defined on the factory-wrapped adapter. The underlying
-   * `CustomAdapter` must implement this natively; there is no portable
-   * fallback that can guarantee guarded counter semantics across runtimes.
+   * Always defined on the factory-wrapped adapter. Without a native method,
+   * the factory uses bounded compare-and-swap retries. Contention exhaustion
+   * throws rather than returning null. Conditional writes must be atomic.
+   * A no-op may return the read snapshot without writing. A non-null result
+   * alone does not establish exclusive ownership of the row.
    */
   incrementOne: <T>(data: {
     model: string;
@@ -553,19 +555,21 @@ interface CustomAdapter {
     where: CleanedWhere[];
   }) => Promise<number>;
   /**
-   * Native atomic single-row consume.
+   * Optional native atomic single-row consume.
+   *
    * Implementing this method natively (e.g. `DELETE ... RETURNING *`,
    * `findOneAndDelete`, `OUTPUT deleted.*`) gives one round trip and the
    * strongest race-safety guarantee. Implementations must delete at most
    * one matching row.
    */
-  consumeOne: <T>(data: {
+  consumeOne?: <T>(data: {
     model: string;
     where: CleanedWhere[];
   }) => Promise<T | null>;
   /**
-   * Native atomic guarded counter mutation. Applies
-   * `field = field + delta` for each entry in `increment` (negative deltas
+   * Optional native atomic guarded counter mutation.
+   *
+   * Applies `field = field + delta` for each entry in `increment` (negative deltas
    * decrement), with `where` acting as both selector and guard and `set`
    * assigning absolute values in the same operation. Returns the updated row,
    * or `null` when the guard matched no row.
@@ -574,7 +578,7 @@ interface CustomAdapter {
    * RETURNING *`) gives one round trip and the strongest race-safety
    * guarantee.
    */
-  incrementOne: <T>(data: {
+  incrementOne?: <T>(data: {
     model: string;
     where: CleanedWhere[];
     increment: Record<string, number>;

package/dist/db/get-tables.mjs

@@ -197,16 +197,8 @@ const buildAuthTables = (options) => {
 		...!options.secondaryStorage || options.session?.storeSessionInDatabase ? sessionTable : {},
 		account: {
 			modelName: options.account?.modelName || "account",
-			indexes: mergeTableIndexes([{
-				fields: ["issuer", "accountId"],
-				unique: true
-			}], account?.indexes),
+			indexes: account?.indexes,
 			fields: {
-				issuer: {
-					type: "string",
-					required: true,
-					fieldName: options.account?.fields?.issuer || "issuer"
-				},
 				accountId: {
 					type: "string",
 					required: true,

package/dist/db/index.d.mts

@@ -5,6 +5,6 @@ import { BaseRateLimit, RateLimit, rateLimitSchema } from "./schema/rate-limit.m
 import { BaseSession, Session, sessionSchema } from "./schema/session.mjs";
 import { BaseUser, User, userSchema } from "./schema/user.mjs";
 import { BaseVerification, Verification, verificationSchema } from "./schema/verification.mjs";
-import { Account, AccountKey, BaseAccount, accountSchema, createLocalAccountIssuer, createOAuthAccountIssuer } from "./schema/account.mjs";
+import { Account, AccountKey, BaseAccount, accountSchema } from "./schema/account.mjs";
 import { coreSchema } from "./schema/shared.mjs";
-export { type Account, type AccountKey, type BaseAccount, type BaseModelNames, type BaseRateLimit, type BaseSession, type BaseUser, type BaseVerification, type BetterAuthDBSchema, type BetterAuthPluginDBSchema, type DBFieldAttribute, type DBFieldAttributeConfig, type DBFieldType, type DBPrimitive, type DBTableIndex, type InferDBFieldInput, type InferDBFieldOutput, type InferDBFieldsFromOptions, type InferDBFieldsFromOptionsInput, type InferDBFieldsFromPlugins, type InferDBFieldsFromPluginsInput, type InferDBFieldsInput, type InferDBFieldsOutput, type InferDBValueType, type ModelNames, type RateLimit, type SecondaryStorage, type Session, type User, type Verification, accountSchema, coreSchema, createLocalAccountIssuer, createOAuthAccountIssuer, getAuthTables, rateLimitSchema, sessionSchema, userSchema, verificationSchema };
+export { type Account, type AccountKey, type BaseAccount, type BaseModelNames, type BaseRateLimit, type BaseSession, type BaseUser, type BaseVerification, type BetterAuthDBSchema, type BetterAuthPluginDBSchema, type DBFieldAttribute, type DBFieldAttributeConfig, type DBFieldType, type DBPrimitive, type DBTableIndex, type InferDBFieldInput, type InferDBFieldOutput, type InferDBFieldsFromOptions, type InferDBFieldsFromOptionsInput, type InferDBFieldsFromPlugins, type InferDBFieldsFromPluginsInput, type InferDBFieldsInput, type InferDBFieldsOutput, type InferDBValueType, type ModelNames, type RateLimit, type SecondaryStorage, type Session, type User, type Verification, accountSchema, coreSchema, getAuthTables, rateLimitSchema, sessionSchema, userSchema, verificationSchema };

package/dist/db/index.mjs

@@ -1,8 +1,8 @@
 import { getAuthTables } from "./get-tables.mjs";
 import { coreSchema } from "./schema/shared.mjs";
-import { accountSchema, createLocalAccountIssuer, createOAuthAccountIssuer } from "./schema/account.mjs";
+import { accountSchema } from "./schema/account.mjs";
 import { rateLimitSchema } from "./schema/rate-limit.mjs";
 import { sessionSchema } from "./schema/session.mjs";
 import { userSchema } from "./schema/user.mjs";
 import { verificationSchema } from "./schema/verification.mjs";
-export { accountSchema, coreSchema, createLocalAccountIssuer, createOAuthAccountIssuer, getAuthTables, rateLimitSchema, sessionSchema, userSchema, verificationSchema };
+export { accountSchema, coreSchema, getAuthTables, rateLimitSchema, sessionSchema, userSchema, verificationSchema };

package/dist/db/internal.d.mts

@@ -1,3 +1,5 @@
 import { BoundedDatabaseIndexDialect, DBTableIndexSource, ResolvedDBTableIndex, getDatabaseFieldIndexName, getDatabaseIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes, resolveDatabaseTableIndexes } from "./database-index.mjs";
 import { getAuthTablesWithResolvedIndexes } from "./get-tables.mjs";
-export { type BoundedDatabaseIndexDialect, type DBTableIndexSource, type ResolvedDBTableIndex, getAuthTablesWithResolvedIndexes, getDatabaseFieldIndexName, getDatabaseIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes, resolveDatabaseTableIndexes };
+import { ExpectedSchema, IntrospectedColumn, IntrospectedTable, SchemaFinding, SchemaMismatchError, SchemaSource, diffSchema, formatSchemaFinding, getExpectedSchema } from "./schema-diff.mjs";
+import { SchemaCheck, checksSchema, createSchemaCheck, invalidateSchemaChecks, registerSchemaCheck, schemaCheckFor } from "./schema-check.mjs";
+export { type BoundedDatabaseIndexDialect, type DBTableIndexSource, type ExpectedSchema, type IntrospectedColumn, type IntrospectedTable, type ResolvedDBTableIndex, type SchemaCheck, type SchemaFinding, SchemaMismatchError, type SchemaSource, checksSchema, createSchemaCheck, diffSchema, formatSchemaFinding, getAuthTablesWithResolvedIndexes, getDatabaseFieldIndexName, getDatabaseIndexName, getDatabaseIndexStringLength, getExpectedSchema, getPortableDatabaseIdentifierKey, invalidateSchemaChecks, registerSchemaCheck, resolveDatabaseSchemaIndexes, resolveDatabaseTableIndexes, schemaCheckFor };

package/dist/db/internal.mjs

@@ -1,3 +1,5 @@
 import { getDatabaseFieldIndexName, getDatabaseIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes, resolveDatabaseTableIndexes } from "./database-index.mjs";
 import { getAuthTablesWithResolvedIndexes } from "./get-tables.mjs";
-export { getAuthTablesWithResolvedIndexes, getDatabaseFieldIndexName, getDatabaseIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes, resolveDatabaseTableIndexes };
+import { SchemaMismatchError, diffSchema, formatSchemaFinding, getExpectedSchema } from "./schema-diff.mjs";
+import { checksSchema, createSchemaCheck, invalidateSchemaChecks, registerSchemaCheck, schemaCheckFor } from "./schema-check.mjs";
+export { SchemaMismatchError, checksSchema, createSchemaCheck, diffSchema, formatSchemaFinding, getAuthTablesWithResolvedIndexes, getDatabaseFieldIndexName, getDatabaseIndexName, getDatabaseIndexStringLength, getExpectedSchema, getPortableDatabaseIdentifierKey, invalidateSchemaChecks, registerSchemaCheck, resolveDatabaseSchemaIndexes, resolveDatabaseTableIndexes, schemaCheckFor };

package/dist/db/schema/account.d.mts

@@ -9,7 +9,6 @@ declare const accountSchema: z.ZodObject<{
   createdAt: z.ZodDefault<z.ZodDate>;
   updatedAt: z.ZodDefault<z.ZodDate>;
   providerId: z.ZodString;
-  issuer: z.ZodString;
   accountId: z.ZodString;
   userId: z.ZodCoercedString<unknown>;
   accessToken: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -22,20 +21,10 @@ declare const accountSchema: z.ZodObject<{
 }, z.core.$strip>;
 type BaseAccount = z.infer<typeof accountSchema>;
 /** The stable provider-side key used to recognize an account. */
-type AccountKey = Readonly<Pick<BaseAccount, "issuer" | "accountId">>;
-/**
- * Creates the synthetic issuer used by providers without an issuer of their own.
- */
-declare function createLocalAccountIssuer(providerId: string): string;
-/**
- * Creates the synthetic issuer used by OAuth providers without an issuer of
- * their own. OAuth identities use a distinct namespace so a provider ID
- * cannot collide with an internal local authentication method.
- */
-declare function createOAuthAccountIssuer(providerId: string): string;
+type AccountKey = Readonly<Pick<BaseAccount, "providerId" | "accountId">>;
 /**
  * Account schema type used by better-auth, note that it's possible that account could have additional fields
  */
 type Account<DBOptions extends BetterAuthOptions["account"] = BetterAuthOptions["account"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify<BaseAccount & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"account", Plugins>>;
 //#endregion
-export { Account, AccountKey, BaseAccount, accountSchema, createLocalAccountIssuer, createOAuthAccountIssuer };
+export { Account, AccountKey, BaseAccount, accountSchema };

package/dist/db/schema/account.mjs

@@ -3,7 +3,6 @@ import * as z from "zod";
 //#region src/db/schema/account.ts
 const accountSchema = coreSchema.extend({
 	providerId: z.string(),
-	issuer: z.string(),
 	accountId: z.string(),
 	userId: z.coerce.string(),
 	accessToken: z.string().nullish(),
@@ -29,22 +28,5 @@ const accountSchema = coreSchema.extend({
 	*/
 	password: z.string().nullish()
 });
-function encodeAccountIssuerProviderId(providerId) {
-	return encodeURIComponent(providerId);
-}
-/**
-* Creates the synthetic issuer used by providers without an issuer of their own.
-*/
-function createLocalAccountIssuer(providerId) {
-	return `local:${encodeAccountIssuerProviderId(providerId)}`;
-}
-/**
-* Creates the synthetic issuer used by OAuth providers without an issuer of
-* their own. OAuth identities use a distinct namespace so a provider ID
-* cannot collide with an internal local authentication method.
-*/
-function createOAuthAccountIssuer(providerId) {
-	return `local:oauth:${encodeAccountIssuerProviderId(providerId)}`;
-}
 //#endregion
-export { accountSchema, createLocalAccountIssuer, createOAuthAccountIssuer };
+export { accountSchema };

package/dist/db/schema-check.d.mts

@@ -0,0 +1,48 @@
+import { BetterAuthOptions } from "../types/init-options.mjs";
+import { SchemaFinding, SchemaSource } from "./schema-diff.mjs";
+//#region src/db/schema-check.d.ts
+/**
+ * Whether the adapter validates its schema. Enabled in every environment
+ * unless explicitly disabled.
+ */
+declare function checksSchema(options: BetterAuthOptions): boolean;
+/**
+ * Resolves when the schema can hold what Better Auth writes. Returns nothing
+ * once that is known and the database schema revision is unchanged.
+ */
+type SchemaCheck = () => Promise<void> | undefined;
+/** Invalidates cached checks after Better Auth changes this database's schema. */
+declare function invalidateSchemaChecks(database: object): void;
+/**
+ * Attaches a check to the adapter it verifies. The adapter object itself is
+ * left untouched, so this works for adapters Better Auth does not own.
+ */
+declare function registerSchemaCheck(adapter: object, check: SchemaCheck): void;
+/**
+ * The check registered for an adapter, if its store is checked at all.
+ */
+declare function schemaCheckFor(adapter: object): SchemaCheck | undefined;
+/**
+ * Turns a schema comparison into a check shared by one adapter instance.
+ *
+ * The first call runs `find` and every concurrent call shares that promise. A
+ * clean result is cached until invalidation. A mismatch is kept as one
+ * {@link SchemaMismatchError} and rethrown on every later call without asking
+ * the store again, until a migration invalidates it. When a database identity is supplied,
+ * checks for that identity share its schema revision. Pending callers follow
+ * the new check if their revision is invalidated. A failure to reach
+ * the store is not kept, so the next call asks again.
+ *
+ * @example
+ * ```ts
+ * const checkSchema = createSchemaCheck(
+ *   () => findSchemaProblems(db, "postgres", expected),
+ *   "database",
+ * );
+ * const pending = checkSchema();
+ * if (pending) await pending;
+ * ```
+ */
+declare function createSchemaCheck(find: () => Promise<SchemaFinding[]>, source: SchemaSource, database?: object): SchemaCheck;
+//#endregion
+export { SchemaCheck, checksSchema, createSchemaCheck, invalidateSchemaChecks, registerSchemaCheck, schemaCheckFor };