@better-auth/core 1.7.2 → 1.7.3

package/dist/social-providers/index.d.mts

@@ -1,5 +1,6 @@
 import { AppleNonConformUser, AppleOptions, AppleProfile, apple, getApplePublicKey } from "./apple.mjs";
 import { AtlassianOptions, AtlassianProfile, atlassian } from "./atlassian.mjs";
+import { CloudflareOptions, CloudflareProfile, cloudflare } from "./cloudflare.mjs";
 import { CognitoOptions, CognitoProfile, cognito, getCognitoPublicKey } from "./cognito.mjs";
 import { DiscordOptions, DiscordProfile, discord } from "./discord.mjs";
 import { FacebookGraphProfile, FacebookLimitedLoginProfile, FacebookOptions, FacebookProfile, facebook } from "./facebook.mjs";
@@ -46,7 +47,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<AppleProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -158,13 +158,59 @@ declare const socialProviders: {
     } | null>;
     options: AtlassianOptions;
   };
+  cloudflare: (options: CloudflareOptions) => {
+    id: "cloudflare";
+    name: string;
+    accountSubject: ({
+      profile
+    }: OAuthAccountKeyContext<CloudflareProfile>) => string;
+    createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI
+    }: {
+      state: string;
+      codeVerifier: string;
+      scopes?: string[] | undefined;
+      redirectURI: string;
+      display?: string | undefined;
+      loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
+    validateAuthorizationCode: ({
+      code,
+      codeVerifier,
+      redirectURI
+    }: {
+      code: string;
+      redirectURI: string;
+      codeVerifier?: string | undefined;
+      deviceId?: string | undefined;
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+    getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
+      user?: {
+        name?: {
+          firstName?: string;
+          lastName?: string;
+        };
+        email?: string;
+      } | undefined;
+    }): Promise<{
+      user: OAuth2UserInfo & Record<string, unknown>;
+      data: CloudflareProfile;
+    } | null>;
+    options: CloudflareOptions;
+  };
   cognito: (options: CognitoOptions) => {
     id: "cognito";
     name: string;
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<CognitoProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -292,7 +338,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<FacebookProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -451,9 +496,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
-    accountIssuer: ({
-      profile
-    }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
     createAuthorizationURL(data: {
       state: string;
       codeVerifier: string;
@@ -503,7 +545,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<GoogleProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -1047,6 +1088,7 @@ declare const socialProviders: {
     }): URL;
     validateAuthorizationCode: ({
       code,
+      codeVerifier,
       redirectURI
     }: {
       code: string;
@@ -1468,7 +1510,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<LineIdTokenPayload | LineUserInfo>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -1521,7 +1562,6 @@ declare const socialProviders: {
     accountSubject: ({
       profile
     }: OAuthAccountKeyContext<PaybinProfile>) => string;
-    accountIssuer: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -1588,23 +1628,15 @@ declare const socialProviders: {
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
+      codeVerifier,
       redirectURI
     }: {
       code: string;
       redirectURI: string;
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
-    }) => Promise<{
-      accessToken: string;
-      refreshToken: string | undefined;
-      accessTokenExpiresAt: Date | undefined;
-      idToken: string | undefined;
-    }>;
-    refreshAccessToken: ((refreshToken: string) => Promise<OAuth2Tokens>) | ((refreshToken: string) => Promise<{
-      accessToken: any;
-      refreshToken: any;
-      accessTokenExpiresAt: Date | undefined;
-    }>);
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
       expectedIdTokenNonce?: string | undefined;
       user?: {
@@ -1840,4 +1872,4 @@ type SocialProviders = { [K in SocialProviderList[number]]?: AwaitableFunction<P
 }> };
 type SocialProviderList = typeof socialProviderList;
 //#endregion
-export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookGraphProfile, FacebookLimitedLoginProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RailwayOptions, RailwayProfile, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VerifyGoogleIdTokenOptions, VkOption, VkProfile, WeChatOptions, WeChatProfile, ZoomOptions, ZoomProfile, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };
+export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CloudflareOptions, CloudflareProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookGraphProfile, FacebookLimitedLoginProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RailwayOptions, RailwayProfile, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VerifyGoogleIdTokenOptions, VkOption, VkProfile, WeChatOptions, WeChatProfile, ZoomOptions, ZoomProfile, apple, atlassian, cloudflare, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

package/dist/social-providers/index.mjs

@@ -1,5 +1,6 @@
 import { apple, getApplePublicKey } from "./apple.mjs";
 import { atlassian } from "./atlassian.mjs";
+import { cloudflare } from "./cloudflare.mjs";
 import { cognito, getCognitoPublicKey } from "./cognito.mjs";
 import { discord } from "./discord.mjs";
 import { dropbox } from "./dropbox.mjs";
@@ -38,6 +39,7 @@ import * as z from "zod";
 const socialProviders = {
 	apple,
 	atlassian,
+	cloudflare,
 	cognito,
 	discord,
 	facebook,
@@ -75,4 +77,4 @@ const socialProviders = {
 const socialProviderList = Object.keys(socialProviders);
 const SocialProviderListEnum = z.enum(socialProviderList).or(z.string());
 //#endregion
-export { SocialProviderListEnum, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };
+export { SocialProviderListEnum, apple, atlassian, cloudflare, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

package/dist/social-providers/line.d.mts

@@ -36,7 +36,6 @@ declare const line: (options: LineOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<LineIdTokenPayload | LineUserInfo>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/line.mjs

@@ -22,7 +22,6 @@ const line = (options) => {
 		id: "line",
 		name: "LINE",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: "https://access.line.me",
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"openid",

package/dist/social-providers/microsoft-entra-id.d.mts

@@ -142,9 +142,6 @@ declare const microsoft: (options: MicrosoftOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
-  accountIssuer: ({
-    profile
-  }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
   createAuthorizationURL(data: {
     state: string;
     codeVerifier: string;

package/dist/social-providers/microsoft-entra-id.mjs

@@ -30,7 +30,6 @@ const microsoft = (options) => {
 		id: "microsoft",
 		name: "Microsoft EntraID",
 		accountSubject: ({ profile }) => profile.oid,
-		accountIssuer: ({ profile }) => profile.iss,
 		createAuthorizationURL(data) {
 			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("Client Id is required for Microsoft Entra ID. Make sure to provide it in the options.");

package/dist/social-providers/paybin.d.mts

@@ -24,7 +24,6 @@ declare const paybin: (options: PaybinOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<PaybinProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/paybin.mjs

@@ -13,7 +13,6 @@ const paybin = (options) => {
 		id: "paybin",
 		name: "Paybin",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: issuer,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }) {
 			if (!options.clientId || !options.clientSecret) {
 				logger.error("Client Id and Client Secret is required for Paybin. Make sure to provide them in the options.");

package/dist/social-providers/paypal.d.mts

@@ -72,23 +72,15 @@ declare const paypal: (options: PayPalOptions) => {
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
+    codeVerifier,
     redirectURI
   }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
-  }) => Promise<{
-    accessToken: string;
-    refreshToken: string | undefined;
-    accessTokenExpiresAt: Date | undefined;
-    idToken: string | undefined;
-  }>;
-  refreshAccessToken: ((refreshToken: string) => Promise<OAuth2Tokens>) | ((refreshToken: string) => Promise<{
-    accessToken: any;
-    refreshToken: any;
-    accessTokenExpiresAt: Date | undefined;
-  }>);
+  }) => Promise<OAuth2Tokens>;
+  refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
     expectedIdTokenNonce?: string | undefined;
     user?: {

package/dist/social-providers/paypal.mjs

@@ -1,7 +1,8 @@
 import { BetterAuthError } from "../error/index.mjs";
 import { logger } from "../env/logger.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
-import { base64 } from "@better-auth/utils/base64";
+import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
 import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/paypal.ts
@@ -10,6 +11,11 @@ const paypal = (options) => {
 	const authorizationEndpoint = isSandbox ? "https://www.sandbox.paypal.com/signin/authorize" : "https://www.paypal.com/signin/authorize";
 	const tokenEndpoint = isSandbox ? "https://api-m.sandbox.paypal.com/v1/oauth2/token" : "https://api-m.paypal.com/v1/oauth2/token";
 	const userInfoEndpoint = isSandbox ? "https://api-m.sandbox.paypal.com/v1/identity/oauth2/userinfo" : "https://api-m.paypal.com/v1/identity/oauth2/userinfo";
+	const tokenRequestOptions = {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	};
+	const tokenEndpointAuth = { method: "client_secret_basic" };
 	return {
 		id: "paypal",
 		name: "PayPal",
@@ -31,62 +37,29 @@ const paypal = (options) => {
 				additionalParams
 			});
 		},
-		validateAuthorizationCode: async ({ code, redirectURI }) => {
-			/**
-			* PayPal requires Basic Auth for token exchange
-			**/
-			const credentials = base64.encode(`${options.clientId}:${options.clientSecret}`);
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
 			try {
-				const response = await betterFetch(tokenEndpoint, {
-					method: "POST",
-					headers: {
-						Authorization: `Basic ${credentials}`,
-						Accept: "application/json",
-						"Accept-Language": "en_US",
-						"Content-Type": "application/x-www-form-urlencoded"
-					},
-					body: new URLSearchParams({
-						grant_type: "authorization_code",
-						code,
-						redirect_uri: redirectURI
-					}).toString()
+				return await validateAuthorizationCode({
+					code,
+					codeVerifier,
+					redirectURI: options.redirectURI || redirectURI,
+					options: tokenRequestOptions,
+					tokenEndpoint,
+					tokenEndpointAuth
 				});
-				if (!response.data) throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
-				const data = response.data;
-				return {
-					accessToken: data.access_token,
-					refreshToken: data.refresh_token,
-					accessTokenExpiresAt: data.expires_in ? new Date(Date.now() + data.expires_in * 1e3) : void 0,
-					idToken: data.id_token
-				};
 			} catch (error) {
 				logger.error("PayPal token exchange failed:", error);
 				throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
 			}
 		},
 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
-			const credentials = base64.encode(`${options.clientId}:${options.clientSecret}`);
 			try {
-				const response = await betterFetch(tokenEndpoint, {
-					method: "POST",
-					headers: {
-						Authorization: `Basic ${credentials}`,
-						Accept: "application/json",
-						"Accept-Language": "en_US",
-						"Content-Type": "application/x-www-form-urlencoded"
-					},
-					body: new URLSearchParams({
-						grant_type: "refresh_token",
-						refresh_token: refreshToken
-					}).toString()
+				return await refreshAccessToken({
+					refreshToken,
+					options: tokenRequestOptions,
+					tokenEndpoint,
+					tokenEndpointAuth
 				});
-				if (!response.data) throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");
-				const data = response.data;
-				return {
-					accessToken: data.access_token,
-					refreshToken: data.refresh_token,
-					accessTokenExpiresAt: data.expires_in ? new Date(Date.now() + data.expires_in * 1e3) : void 0
-				};
 			} catch (error) {
 				logger.error("PayPal token refresh failed:", error);
 				throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");

package/dist/social-providers/reddit.mjs

@@ -1,11 +1,16 @@
-import { getOAuth2Tokens } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
 import { createPlaceholderEmail } from "../utils/email.mjs";
-import { base64 } from "@better-auth/utils/base64";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/reddit.ts
 const reddit = (options) => {
+	const tokenEndpoint = "https://www.reddit.com/api/v1/access_token";
+	const tokenRequestOptions = {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	};
+	const tokenEndpointAuth = { method: "client_secret_basic" };
 	return {
 		id: "reddit",
 		name: "Reddit",
@@ -26,34 +31,24 @@ const reddit = (options) => {
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {
-			const body = new URLSearchParams({
-				grant_type: "authorization_code",
+			return validateAuthorizationCode({
 				code,
-				redirect_uri: options.redirectURI || redirectURI
-			});
-			const { data, error } = await betterFetch("https://www.reddit.com/api/v1/access_token", {
-				method: "POST",
+				redirectURI: options.redirectURI || redirectURI,
+				options: tokenRequestOptions,
+				tokenEndpoint,
+				tokenEndpointAuth,
 				headers: {
-					"content-type": "application/x-www-form-urlencoded",
 					accept: "text/plain",
-					"user-agent": "better-auth",
-					Authorization: `Basic ${base64.encode(`${options.clientId}:${options.clientSecret}`)}`
-				},
-				body: body.toString()
+					"user-agent": "better-auth"
+				}
 			});
-			if (error) throw error;
-			return getOAuth2Tokens(data);
 		},
 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
 			return refreshAccessToken({
 				refreshToken,
-				options: {
-					clientId: options.clientId,
-					clientKey: options.clientKey,
-					clientSecret: options.clientSecret
-				},
-				authentication: "basic",
-				tokenEndpoint: "https://www.reddit.com/api/v1/access_token"
+				options: tokenRequestOptions,
+				tokenEndpoint,
+				tokenEndpointAuth
 			});
 		},
 		async getUserInfo(token) {

package/dist/social-providers/tiktok.d.mts

@@ -141,6 +141,7 @@ declare const tiktok: (options: TiktokOptions) => {
   }): URL;
   validateAuthorizationCode: ({
     code,
+    codeVerifier,
     redirectURI
   }: {
     code: string;

package/dist/social-providers/tiktok.mjs

@@ -6,6 +6,13 @@ import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/tiktok.ts
 const tiktok = (options) => {
 	const tokenEndpoint = "https://open.tiktokapis.com/v2/oauth/token/";
+	const tokenEndpointAuth = {
+		method: "custom",
+		customizeRequest({ body }) {
+			body.set("client_key", options.clientKey);
+			body.set("client_secret", options.clientSecret);
+		}
+	};
 	return {
 		id: "tiktok",
 		name: "TikTok",
@@ -27,24 +34,22 @@ const tiktok = (options) => {
 			}
 			return url;
 		},
-		validateAuthorizationCode: async ({ code, redirectURI }) => {
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
 			return validateAuthorizationCode({
 				code,
+				codeVerifier,
 				redirectURI: options.redirectURI || redirectURI,
-				options: {
-					clientKey: options.clientKey,
-					clientSecret: options.clientSecret
-				},
-				tokenEndpoint
+				options: {},
+				tokenEndpoint,
+				tokenEndpointAuth
 			});
 		},
 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
 			return refreshAccessToken({
 				refreshToken,
-				options: { clientSecret: options.clientSecret },
+				options: {},
 				tokenEndpoint,
-				authentication: "post",
-				extraParams: { client_key: options.clientKey }
+				tokenEndpointAuth
 			});
 		},
 		async getUserInfo(token) {

package/dist/types/context.d.mts

@@ -8,6 +8,7 @@ import { Awaitable, LiteralString } from "./helper.mjs";
 import { BetterAuthPlugin } from "./plugin.mjs";
 import { BetterAuthOptions, BetterAuthRateLimitOptions, UserProvisioningSource } from "./init-options.mjs";
 import { Account, AccountKey } from "../db/schema/account.mjs";
+import { SchemaCheck } from "../db/schema-check.mjs";
 import { BetterAuthCookie, BetterAuthCookies, CookieCachePayload } from "./cookie.mjs";
 import { SecretConfig } from "./secret.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
@@ -263,6 +264,16 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
     storage: "memory" | "database" | "secondary-storage";
   } & Omit<BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
   adapter: DBAdapter<Options>;
+  /**
+   * Confirms the database can hold what this configuration writes.
+   *
+   * Shared by initialization and requests for this adapter instance;
+   * returns nothing once the schema is known to be clean.
+   * Context construction does not await the verdict, so migration
+   * tooling can still use a context whose schema needs repair.
+   * Absent when the check is disabled or the adapter registers none.
+   */
+  checkSchema?: SchemaCheck | undefined;
   internalAdapter: InternalAdapter<Options>;
   createAuthCookie: CreateCookieGetterFn;
   secret: string;

package/dist/types/init-options.d.mts

@@ -387,6 +387,17 @@ type BetterAuthAdvancedOptions = {
      * @default false
      */
     joins?: boolean;
+    /**
+     * Validate the schema during initialization and report problems
+     * through the configured logger. Authentication requests await
+     * the same check and fail when the schema does not match.
+     * Kysely introspects the database; Drizzle and Prisma inspect
+     * local schema metadata without opening a connection.
+     * Set `false` to disable runtime schema validation.
+     *
+     * @default true
+     */
+    validateSchema?: boolean;
   } | undefined;
   /**
    * Trusted proxy headers

package/dist/utils/ip.mjs

@@ -1,17 +1,19 @@
 import { isDevelopment, isTest } from "../env/env-impl.mjs";
 import * as z from "zod";
 //#region src/utils/ip.ts
+const ipv4Schema = z.ipv4();
+const ipv6Schema = z.ipv6();
 /**
 * Checks if an IP is valid IPv4 or IPv6
 */
 function isValidIP(ip) {
-	return z.ipv4().safeParse(ip).success || z.ipv6().safeParse(ip).success;
+	return isIPv4(ip) || isIPv6(ip);
+}
+function isIPv4(ip) {
+	return z.validate(ipv4Schema, ip);
 }
-/**
-* Checks if an IP is IPv6
-*/
 function isIPv6(ip) {
-	return z.ipv6().safeParse(ip).success;
+	return z.validate(ipv6Schema, ip);
 }
 /**
 * Converts IPv4-mapped IPv6 address to IPv4
@@ -21,12 +23,12 @@ function extractIPv4FromMapped(ipv6) {
 	const lower = ipv6.toLowerCase();
 	if (lower.startsWith("::ffff:")) {
 		const ipv4Part = lower.substring(7);
-		if (z.ipv4().safeParse(ipv4Part).success) return ipv4Part;
+		if (isIPv4(ipv4Part)) return ipv4Part;
 	}
 	const parts = ipv6.split(":");
 	if (parts.length === 7 && parts[5]?.toLowerCase() === "ffff") {
 		const ipv4Part = parts[6];
-		if (ipv4Part && z.ipv4().safeParse(ipv4Part).success) return ipv4Part;
+		if (ipv4Part && isIPv4(ipv4Part)) return ipv4Part;
 	}
 	if (lower.includes("::ffff:") || lower.includes(":ffff:")) {
 		const groups = expandIPv6(ipv6);
@@ -96,7 +98,7 @@ function normalizeIPv6(ipv6, subnetPrefix) {
 * // -> "2001:0db8:0000:0000:0000:0000:0000:0000" (subnet /64)
 */
 function normalizeIP(ip, options = {}) {
-	if (z.ipv4().safeParse(ip).success) return ip.toLowerCase();
+	if (isIPv4(ip)) return ip.toLowerCase();
 	if (!isIPv6(ip)) return ip.toLowerCase();
 	const ipv4 = extractIPv4FromMapped(ip);
 	if (ipv4) return ipv4.toLowerCase();
@@ -106,7 +108,7 @@ function normalizeIP(ip, options = {}) {
 * Raw bytes of an IP for CIDR comparison. Returns `null` for an invalid IP.
 */
 function ipToBytes(ip) {
-	if (z.ipv4().safeParse(ip).success) return Uint8Array.from(ip.split(".").map((octet) => Number(octet)));
+	if (isIPv4(ip)) return Uint8Array.from(ip.split(".").map((octet) => Number(octet)));
 	if (!isIPv6(ip)) return null;
 	const mapped = extractIPv4FromMapped(ip);
 	if (mapped) return Uint8Array.from(mapped.split(".").map((octet) => Number(octet)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -157,7 +157,7 @@
   "dependencies": {
     "@opentelemetry/semantic-conventions": "^1.41.1",
     "@standard-schema/spec": "^1.1.0",
-    "zod": "^4.3.6"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "@better-auth/utils": "0.4.2",

package/src/context/transaction.ts

@@ -1,6 +1,7 @@
 import type { AsyncLocalStorage } from "@better-auth/core/async_hooks";
 import { getAsyncLocalStorage } from "@better-auth/core/async_hooks";
 import type { DBAdapter, DBTransactionAdapter } from "../db/adapter";
+import { schemaCheckFor } from "../db/schema-check";
 import type { BetterAuthOptions } from "../types";
 import { __getBetterAuthGlobal } from "./global";
 
@@ -114,6 +115,10 @@ export const runWithTransaction = async <
 			if (store?.isTransactionActive) {
 				return fn();
 			}
+			// Settle the schema verdict before this transaction holds the
+			// connection a single-connection store would need for the lookup.
+			const pendingSchemaCheck = schemaCheckFor(adapter)?.();
+			if (pendingSchemaCheck) await pendingSchemaCheck;
 			const pendingHooks: Array<() => Promise<void>> = [];
 			let result: Awaited<R>;
 			let error: unknown;