auth 1.7.2 → 1.7.4

package/dist/api.d.mts

@@ -12,6 +12,11 @@ interface SchemaGeneratorResult {
    * without corrupting the rows it already holds.
    */
   unsafeChanges?: string[];
+  /**
+   * Columns the database requires that Better Auth never writes. No generated
+   * migration removes them; each entry names the change that does.
+   */
+  schemaProblems?: string[];
 }
 interface SchemaGenerator {
   <Options extends BetterAuthOptions>(opts: {

package/dist/api.mjs

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
-import { getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes } from "@better-auth/core/db/internal";
+import { diffSchema, formatSchemaFinding, getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes } from "@better-auth/core/db/internal";
 import { capitalizeFirstLetter, toSnakeCase } from "@better-auth/core/utils/string";
 import { initGetFieldName, initGetModelName } from "better-auth/adapters";
 import { getAuthTables } from "better-auth/db";
@@ -8,7 +8,8 @@ import { getMigrations } from "better-auth/db/migration";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { BetterAuthError } from "@better-auth/core/error";
-import { produceSchema } from "@mrleebo/prisma-ast";
+import { getSchema, produceSchema } from "@mrleebo/prisma-ast";
+import * as z from "zod";
 //#region src/generators/drizzle.ts
 function convertToSnakeCase(str, camelCase) {
 	return camelCase ? str : toSnakeCase(str);
@@ -333,17 +334,20 @@ function commentBanner(unsafeChanges) {
 	return lines.join("\n");
 }
 const generateKyselySchema = async ({ options, file }) => {
-	const { compileMigrations, unsafeChanges } = await getMigrations(options, { throwOnUnsafe: false });
+	const { compileMigrations, unsafeChanges, schemaProblems } = await getMigrations(options, { throwOnUnsafe: false });
 	const migrations = await compileMigrations();
 	const code = migrations.trim() === ";" ? "" : migrations;
 	return {
 		code: unsafeChanges.length ? `${commentBanner(unsafeChanges)}${code}` : code,
 		unsafeChanges,
+		schemaProblems,
 		fileName: file || `./better-auth_migrations/${(/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-")}.sql`
 	};
 };
-//#endregion
-//#region src/utils/get-package-info.ts
+z.object({
+	name: z.string(),
+	version: z.string()
+});
 function getPackageInfo(cwd) {
 	const packageJsonPath = cwd ? path.join(cwd, "package.json") : path.join("package.json");
 	return JSON.parse(readFileSync(packageJsonPath, "utf-8"));
@@ -407,6 +411,27 @@ function getPrismaIndexDefinition(property) {
 function prismaIndexMatches(existing, configured) {
 	return existing.validFullColumns && existing.unique === (configured.unique ?? false) && existing.columns.length === configured.columns.length && existing.columns.every((column, position) => column === configured.columns[position]);
 }
+/**
+* The models an existing schema declares, read the way the comparison wants
+* them: each model by name, each scalar or enum field by name. A relation
+* field is not a column and is skipped.
+*/
+function introspectPrismaSchema(schemaPrisma) {
+	const models = getSchema(schemaPrisma).list.filter((block) => block.type === "model");
+	const modelNames = new Set(models.map((model) => model.name));
+	return models.map((model) => ({
+		name: model.name,
+		columns: model.properties.flatMap((property) => {
+			if (property.type !== "field") return [];
+			if (typeof property.fieldType === "string" && modelNames.has(property.fieldType) || property.attributes?.some((attribute) => attribute.name === "relation")) return [];
+			return [{
+				name: property.name,
+				nullable: property.optional === true,
+				hasDefault: property.attributes?.some((attribute) => attribute.name === "default" || attribute.name === "updatedAt") ?? false
+			}];
+		})
+	}));
+}
 const generatePrismaSchema = async ({ adapter, options, file }) => {
 	const provider = adapter.options?.provider || "postgresql";
 	const tables = getAuthTables(options);
@@ -450,6 +475,13 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 			if (urlIndex !== -1) datasource.properties.splice(urlIndex, 1);
 		}
 	});
+	const expectedModels = {};
+	for (const table in tables) {
+		if (isMigrationDisabled(table)) continue;
+		const modelName = capitalizeFirstLetter(getModelName(tables[table]?.modelName || table));
+		const entry = expectedModels[modelName] ??= { fields: {} };
+		for (const [field, attr] of Object.entries(tables[table]?.fields ?? {})) entry.fields[attr.fieldName || field] = attr;
+	}
 	const manyToManyRelations = /* @__PURE__ */ new Map();
 	for (const table in tables) {
 		if (isMigrationDisabled(table)) continue;
@@ -695,10 +727,12 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 		}
 	});
 	const schemaChanged = schema.trim() !== schemaPrisma.trim();
+	const schemaProblems = schemaPrismaExist ? diffSchema(expectedModels, introspectPrismaSchema(schemaPrisma)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "prisma")) : [];
 	return {
 		code: schemaChanged ? schema : "",
 		fileName: filePath,
-		overwrite: schemaPrismaExist && schemaChanged
+		overwrite: schemaPrismaExist && schemaChanged,
+		schemaProblems
 	};
 };
 const getNewPrisma = (provider, cwd) => {

package/dist/index.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { Command } from "commander";
 import { exec, execSync, spawn } from "node:child_process";
@@ -20,13 +21,13 @@ import { createPathsMatcher, getTsconfig, parseTsconfig } from "get-tsconfig";
 import fs$1 from "node:fs/promises";
 import { createTelemetry, getTelemetryAuthConfig } from "@better-auth/telemetry";
 import { getAdapter } from "better-auth/db/adapter";
-import { getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes } from "@better-auth/core/db/internal";
+import { diffSchema, formatSchemaFinding, getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, resolveDatabaseSchemaIndexes } from "@better-auth/core/db/internal";
 import { capitalizeFirstLetter, toSnakeCase } from "@better-auth/core/utils/string";
 import { initGetFieldName, initGetModelName } from "better-auth/adapters";
 import { getAuthTables } from "better-auth/db";
 import prettier, { format } from "prettier";
 import { UnsafeMigrationError, getMigrations } from "better-auth/db/migration";
-import { produceSchema } from "@mrleebo/prisma-ast";
+import { getSchema, produceSchema } from "@mrleebo/prisma-ast";
 import Crypto from "node:crypto";
 import open from "open";
 import { env } from "@better-auth/core/env";
@@ -1679,12 +1680,13 @@ function commentBanner(unsafeChanges) {
 	return lines.join("\n");
 }
 const generateKyselySchema = async ({ options, file }) => {
-	const { compileMigrations, unsafeChanges } = await getMigrations(options, { throwOnUnsafe: false });
+	const { compileMigrations, unsafeChanges, schemaProblems } = await getMigrations(options, { throwOnUnsafe: false });
 	const migrations = await compileMigrations();
 	const code = migrations.trim() === ";" ? "" : migrations;
 	return {
 		code: unsafeChanges.length ? `${commentBanner(unsafeChanges)}${code}` : code,
 		unsafeChanges,
+		schemaProblems,
 		fileName: file || `./better-auth_migrations/${(/* @__PURE__ */ new Date()).toISOString().replace(/:/g, "-")}.sql`
 	};
 };
@@ -1721,10 +1723,52 @@ const spawnCommand = (cmd, cwd = process.cwd()) => new Promise((resolve, reject)
 });
 //#endregion
 //#region src/utils/get-package-info.ts
+const packageManifestSchema = z.object({
+	name: z.string(),
+	version: z.string()
+});
 function getPackageInfo(cwd) {
 	const packageJsonPath = cwd ? path.join(cwd, "package.json") : path.join("package.json");
 	return JSON.parse(readFileSync(packageJsonPath, "utf-8"));
 }
+function readPackageVersion(packageJsonPath, expectedPackageName) {
+	if (!existsSync(packageJsonPath)) return null;
+	try {
+		const result = packageManifestSchema.safeParse(JSON.parse(readFileSync(packageJsonPath, "utf-8")));
+		return result.success && result.data.name === expectedPackageName ? result.data.version : null;
+	} catch {
+		return null;
+	}
+}
+function findPackageVersion(resolvedPath, packageName) {
+	let currentDirectory = path.dirname(resolvedPath);
+	const rootDirectory = path.parse(currentDirectory).root;
+	while (true) {
+		const version = readPackageVersion(path.join(currentDirectory, "package.json"), packageName);
+		if (version) return version;
+		if (currentDirectory === rootDirectory) return null;
+		currentDirectory = path.dirname(currentDirectory);
+	}
+}
+function findPackageVersionInNodeModules(packageName, projectDirectory) {
+	let currentDirectory = path.resolve(projectDirectory);
+	const rootDirectory = path.parse(currentDirectory).root;
+	const packagePath = packageName.split("/");
+	while (true) {
+		const version = readPackageVersion(path.join(currentDirectory, "node_modules", ...packagePath, "package.json"), packageName);
+		if (version) return version;
+		if (currentDirectory === rootDirectory) return null;
+		currentDirectory = path.dirname(currentDirectory);
+	}
+}
+function getInstalledPackageVersion(packageName, projectDirectory) {
+	const resolve = createRequire(path.join(path.resolve(projectDirectory), "package.json")).resolve;
+	for (const specifier of [`${packageName}/package.json`, packageName]) try {
+		const version = findPackageVersion(resolve(specifier), packageName);
+		if (version) return version;
+	} catch {}
+	return findPackageVersionInNodeModules(packageName, projectDirectory);
+}
 function getPrismaVersion(cwd) {
 	try {
 		const packageInfo = getPackageInfo(cwd);
@@ -1838,6 +1882,27 @@ function getPrismaIndexDefinition(property) {
 function prismaIndexMatches(existing, configured) {
 	return existing.validFullColumns && existing.unique === (configured.unique ?? false) && existing.columns.length === configured.columns.length && existing.columns.every((column, position) => column === configured.columns[position]);
 }
+/**
+* The models an existing schema declares, read the way the comparison wants
+* them: each model by name, each scalar or enum field by name. A relation
+* field is not a column and is skipped.
+*/
+function introspectPrismaSchema(schemaPrisma) {
+	const models = getSchema(schemaPrisma).list.filter((block) => block.type === "model");
+	const modelNames = new Set(models.map((model) => model.name));
+	return models.map((model) => ({
+		name: model.name,
+		columns: model.properties.flatMap((property) => {
+			if (property.type !== "field") return [];
+			if (typeof property.fieldType === "string" && modelNames.has(property.fieldType) || property.attributes?.some((attribute) => attribute.name === "relation")) return [];
+			return [{
+				name: property.name,
+				nullable: property.optional === true,
+				hasDefault: property.attributes?.some((attribute) => attribute.name === "default" || attribute.name === "updatedAt") ?? false
+			}];
+		})
+	}));
+}
 const generatePrismaSchema = async ({ adapter, options, file }) => {
 	const provider = adapter.options?.provider || "postgresql";
 	const tables = getAuthTables(options);
@@ -1881,6 +1946,13 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 			if (urlIndex !== -1) datasource.properties.splice(urlIndex, 1);
 		}
 	});
+	const expectedModels = {};
+	for (const table in tables) {
+		if (isMigrationDisabled(table)) continue;
+		const modelName = capitalizeFirstLetter(getModelName(tables[table]?.modelName || table));
+		const entry = expectedModels[modelName] ??= { fields: {} };
+		for (const [field, attr] of Object.entries(tables[table]?.fields ?? {})) entry.fields[attr.fieldName || field] = attr;
+	}
 	const manyToManyRelations = /* @__PURE__ */ new Map();
 	for (const table in tables) {
 		if (isMigrationDisabled(table)) continue;
@@ -2126,10 +2198,12 @@ const generatePrismaSchema = async ({ adapter, options, file }) => {
 		}
 	});
 	const schemaChanged = schema.trim() !== schemaPrisma.trim();
+	const schemaProblems = schemaPrismaExist ? diffSchema(expectedModels, introspectPrismaSchema(schemaPrisma)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "prisma")) : [];
 	return {
 		code: schemaChanged ? schema : "",
 		fileName: filePath,
-		overwrite: schemaPrismaExist && schemaChanged
+		overwrite: schemaPrismaExist && schemaChanged,
+		schemaProblems
 	};
 };
 const getNewPrisma = (provider, cwd) => {
@@ -2291,6 +2365,10 @@ async function generateAction(opts) {
 		options: config
 	});
 	spinner.stop();
+	if (schema.schemaProblems?.length) {
+		console.warn(chalk.red.bold(`⚠ ${schema.schemaProblems.length} ${schema.schemaProblems.length === 1 ? "column rejects" : "columns reject"} every insert Better Auth makes. No migration fixes this.`));
+		for (const problem of schema.schemaProblems) console.warn(chalk.red(`-> ${problem}`));
+	}
 	if (schema.unsafeChanges?.length) {
 		console.warn(chalk.red.bold(`⚠ ${schema.unsafeChanges.length} ${schema.unsafeChanges.length === 1 ? "change in this schema corrupts" : "changes in this schema corrupt"} a populated database.`));
 		for (const change of schema.unsafeChanges) console.warn(chalk.red(`-> ${change}`));
@@ -2393,6 +2471,16 @@ async function generateAction(opts) {
 const generate = new Command("generate").option("-c, --cwd <cwd>", "the working directory. defaults to the current directory.", process.cwd()).option("--config <config>", "the path to the configuration file. defaults to the first configuration file found.").option("--output <output>", "the file to output to the generated schema").option("--adapter <adapter>", "specify the adapter type (e.g., prisma, drizzle, kysely) without requiring a configured adapter").option("--dialect <dialect>", "specify the database dialect/provider (e.g., postgresql, mysql, sqlite). For drizzle, postgresql maps to 'pg'").option("-y, --yes", "automatically answer yes to all prompts", false).option("--y", "(deprecated) same as --yes", false).action(generateAction);
 //#endregion
 //#region src/commands/info.ts
+function resolveReportedDependencies(projectRoot, dependencies, reportedDependencies) {
+	return reportedDependencies.flatMap(({ name, packageName }) => {
+		const declaredVersion = dependencies[packageName];
+		if (!declaredVersion) return [];
+		return [{
+			name,
+			version: getInstalledPackageVersion(packageName, projectRoot) ?? declaredVersion
+		}];
+	});
+}
 function getSystemInfo() {
 	const platform = os.platform();
 	const arch = os.arch();
@@ -2449,29 +2537,63 @@ function getFrameworkInfo(projectRoot) {
 	if (!existsSync(packageJsonPath)) return null;
 	try {
 		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-		const deps = {
+		const installedFrameworks = resolveReportedDependencies(projectRoot, {
 			...packageJson.dependencies,
 			...packageJson.devDependencies
-		};
-		const frameworks = {
-			next: deps["next"],
-			react: deps["react"],
-			vue: deps["vue"],
-			nuxt: deps["nuxt"],
-			svelte: deps["svelte"],
-			"@sveltejs/kit": deps["@sveltejs/kit"],
-			express: deps["express"],
-			fastify: deps["fastify"],
-			hono: deps["hono"],
-			"react-router": deps["react-router"],
-			astro: deps["astro"],
-			solid: deps["solid-js"],
-			qwik: deps["@builder.io/qwik"]
-		};
-		const installedFrameworks = Object.entries(frameworks).filter(([_, version]) => version).map(([name, version]) => ({
-			name,
-			version
-		}));
+		}, [
+			{
+				name: "next",
+				packageName: "next"
+			},
+			{
+				name: "react",
+				packageName: "react"
+			},
+			{
+				name: "vue",
+				packageName: "vue"
+			},
+			{
+				name: "nuxt",
+				packageName: "nuxt"
+			},
+			{
+				name: "svelte",
+				packageName: "svelte"
+			},
+			{
+				name: "@sveltejs/kit",
+				packageName: "@sveltejs/kit"
+			},
+			{
+				name: "express",
+				packageName: "express"
+			},
+			{
+				name: "fastify",
+				packageName: "fastify"
+			},
+			{
+				name: "hono",
+				packageName: "hono"
+			},
+			{
+				name: "react-router",
+				packageName: "react-router"
+			},
+			{
+				name: "astro",
+				packageName: "astro"
+			},
+			{
+				name: "solid",
+				packageName: "solid-js"
+			},
+			{
+				name: "qwik",
+				packageName: "@builder.io/qwik"
+			}
+		]);
 		return installedFrameworks.length > 0 ? installedFrameworks : null;
 	} catch {
 		return null;
@@ -2482,29 +2604,63 @@ function getDatabaseInfo(projectRoot) {
 	if (!existsSync(packageJsonPath)) return null;
 	try {
 		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-		const deps = {
+		const installedDatabases = resolveReportedDependencies(projectRoot, {
 			...packageJson.dependencies,
 			...packageJson.devDependencies
-		};
-		const databases = {
-			"better-sqlite3": deps["better-sqlite3"],
-			"@libsql/client": deps["@libsql/client"],
-			"@libsql/kysely-libsql": deps["@libsql/kysely-libsql"],
-			mysql2: deps["mysql2"],
-			pg: deps["pg"],
-			postgres: deps["postgres"],
-			"@prisma/client": deps["@prisma/client"],
-			drizzle: deps["drizzle-orm"],
-			kysely: deps["kysely"],
-			mongodb: deps["mongodb"],
-			"@neondatabase/serverless": deps["@neondatabase/serverless"],
-			"@vercel/postgres": deps["@vercel/postgres"],
-			"@planetscale/database": deps["@planetscale/database"]
-		};
-		const installedDatabases = Object.entries(databases).filter(([_, version]) => version).map(([name, version]) => ({
-			name,
-			version
-		}));
+		}, [
+			{
+				name: "better-sqlite3",
+				packageName: "better-sqlite3"
+			},
+			{
+				name: "@libsql/client",
+				packageName: "@libsql/client"
+			},
+			{
+				name: "@libsql/kysely-libsql",
+				packageName: "@libsql/kysely-libsql"
+			},
+			{
+				name: "mysql2",
+				packageName: "mysql2"
+			},
+			{
+				name: "pg",
+				packageName: "pg"
+			},
+			{
+				name: "postgres",
+				packageName: "postgres"
+			},
+			{
+				name: "@prisma/client",
+				packageName: "@prisma/client"
+			},
+			{
+				name: "drizzle",
+				packageName: "drizzle-orm"
+			},
+			{
+				name: "kysely",
+				packageName: "kysely"
+			},
+			{
+				name: "mongodb",
+				packageName: "mongodb"
+			},
+			{
+				name: "@neondatabase/serverless",
+				packageName: "@neondatabase/serverless"
+			},
+			{
+				name: "@vercel/postgres",
+				packageName: "@vercel/postgres"
+			},
+			{
+				name: "@planetscale/database",
+				packageName: "@planetscale/database"
+			}
+		]);
 		return installedDatabases.length > 0 ? installedDatabases : null;
 	} catch {
 		return null;
@@ -2598,6 +2754,12 @@ function sanitizeBetterAuthConfig(config) {
 	return redactSensitive(sanitized);
 }
 async function getBetterAuthInfo(projectRoot, configPath, suppressLogs = false) {
+	let betterAuthVersion = "Unknown";
+	try {
+		const packageInfo = getPackageInfo(projectRoot);
+		const declaredVersion = packageInfo.dependencies?.["better-auth"] || packageInfo.devDependencies?.["better-auth"] || packageInfo.peerDependencies?.["better-auth"] || packageInfo.optionalDependencies?.["better-auth"];
+		if (declaredVersion) betterAuthVersion = getInstalledPackageVersion("better-auth", projectRoot) ?? declaredVersion;
+	} catch {}
 	try {
 		const originalLog = console.log;
 		const originalWarn = console.warn;
@@ -2613,9 +2775,8 @@ async function getBetterAuthInfo(projectRoot, configPath, suppressLogs = false)
 				configPath,
 				shouldThrowOnError: true
 			});
-			const packageInfo = await getPackageInfo();
 			return {
-				version: packageInfo.dependencies?.["better-auth"] || packageInfo.devDependencies?.["better-auth"] || packageInfo.peerDependencies?.["better-auth"] || packageInfo.optionalDependencies?.["better-auth"] || "Unknown",
+				version: betterAuthVersion,
 				config: sanitizeBetterAuthConfig(config)
 			};
 		} finally {
@@ -2627,7 +2788,7 @@ async function getBetterAuthInfo(projectRoot, configPath, suppressLogs = false)
 		}
 	} catch (error) {
 		return {
-			version: "Unknown",
+			version: betterAuthVersion,
 			config: null,
 			error: error instanceof Error ? error.message : "Failed to load Better Auth config"
 		};
@@ -2704,13 +2865,11 @@ const info = new Command("info").description("Display system and Better Auth con
 		console.log(formatOutput(databases, 2));
 	}
 	console.log(chalk.bold.white("\n🔐 Better Auth:"));
+	console.log(`  ${chalk.cyan("Version")}: ${betterAuthInfo.version}`);
 	if (betterAuthInfo.error) console.log(`  ${chalk.red("Error:")} ${betterAuthInfo.error}`);
-	else {
-		console.log(`  ${chalk.cyan("Version")}: ${betterAuthInfo.version}`);
-		if (betterAuthInfo.config) {
-			console.log(`  ${chalk.cyan("Configuration")}:`);
-			console.log(formatOutput(betterAuthInfo.config, 4));
-		}
+	else if (betterAuthInfo.config) {
+		console.log(`  ${chalk.cyan("Configuration")}:`);
+		console.log(formatOutput(betterAuthInfo.config, 4));
 	}
 	console.log(chalk.gray("\n" + "=".repeat(50)));
 	console.log(chalk.gray("\n💡 Tip: Use --json flag for JSON output"));
@@ -2960,11 +3119,14 @@ function installDependencies({ dependencies, packageManager, cwd, type = "prod",
 		const flag = flagMap?.[type];
 		if (flag) flags.push(flag);
 	}
-	const command = `${installCommand}${flags.length > 0 ? ` ${flags.join(" ")}` : ""} ${Array.isArray(dependencies) ? dependencies.join(" ") : dependencies}`;
+	const dependencyList = Array.isArray(dependencies) ? dependencies : [dependencies];
+	if (dependencyList.length === 0) return Promise.resolve(true);
+	const command = `${installCommand}${flags.length > 0 ? ` ${flags.join(" ")}` : ""} ${dependencyList.join(" ")}`;
 	return new Promise((resolve, reject) => {
 		exec(command, { cwd }, (error, stdout, stderr) => {
 			if (error) {
-				reject(new Error(stderr));
+				const message = stderr.trim() || stdout.trim() || error.message;
+				reject(new Error(message, { cause: error }));
 				return;
 			}
 			resolve(true);
@@ -2973,7 +3135,7 @@ function installDependencies({ dependencies, packageManager, cwd, type = "prod",
 }
 //#endregion
 //#region src/version.ts
-const cliVersion = "1.7.2";
+const cliVersion = "1.7.4";
 //#endregion
 //#region src/commands/init/configs/frameworks.config.ts
 const FRAMEWORKS = [
@@ -3183,6 +3345,7 @@ export const Route = createFileRoute('/api/auth/$')({
 const SOCIAL_PROVIDERS = [
 	"apple",
 	"atlassian",
+	"cloudflare",
 	"cognito",
 	"discord",
 	"dropbox",
@@ -3233,6 +3396,13 @@ const SOCIAL_PROVIDER_CONFIGS = {
 		name: "clientSecret",
 		envVar: "ATLASSIAN_CLIENT_SECRET"
 	}] },
+	cloudflare: { options: [{
+		name: "clientId",
+		envVar: "CLOUDFLARE_CLIENT_ID"
+	}, {
+		name: "clientSecret",
+		envVar: "CLOUDFLARE_CLIENT_SECRET"
+	}] },
 	cognito: { options: [
 		{
 			name: "clientId",
@@ -7156,6 +7326,7 @@ const logout = new Command("logout").description("Logout from Better Auth Infras
 const REMOTE_MCP_URL = "https://mcp.better-auth.com/mcp";
 async function mcpAction(options) {
 	if (options.cursor) await handleCursorAction();
+	else if (options.codex) handleCodexAction();
 	else if (options.claudeCode) handleClaudeCodeAction();
 	else if (options.openCode) handleOpenCodeAction();
 	else if (options.manual) handleManualAction();
@@ -7191,6 +7362,20 @@ async function handleCursorAction() {
 	console.log(chalk.gray("• You can now use Better Auth features directly in Cursor"));
 	console.log(chalk.gray("• Try: \"Set up Better Auth with Google login\" or \"Help me debug my auth\""));
 }
+function handleCodexAction() {
+	console.log(chalk.bold.blue("🤖 Adding Better Auth MCP to Codex..."));
+	const command = `codex mcp add better-auth --url ${REMOTE_MCP_URL}`;
+	try {
+		execSync(command, { stdio: "inherit" });
+		console.log(chalk.green("\n✓ Codex MCP configured!"));
+	} catch {
+		console.log(chalk.yellow("\n⚠ Could not automatically add to Codex. Please run this command manually:"));
+		console.log(chalk.cyan(command));
+	}
+	console.log(chalk.bold.white("\n✨ Next Steps:"));
+	console.log(chalk.gray("• Once configured, ChatGPT desktop, Codex CLI, and the IDE extension share this MCP server"));
+	console.log(chalk.gray("• Run `codex mcp list` to verify the connection"));
+}
 function handleClaudeCodeAction() {
 	console.log(chalk.bold.blue("🤖 Adding Better Auth MCP to Claude Code..."));
 	const command = `claude mcp add --transport http better-auth ${REMOTE_MCP_URL}`;
@@ -7272,6 +7457,7 @@ function showAllOptions() {
 	console.log();
 	console.log(chalk.bold.white("MCP Clients:"));
 	console.log(chalk.cyan("  --cursor      ") + chalk.gray("Add to Cursor"));
+	console.log(chalk.cyan("  --codex       ") + chalk.gray("Add to Codex"));
 	console.log(chalk.cyan("  --claude-code ") + chalk.gray("Add to Claude Code"));
 	console.log(chalk.cyan("  --open-code   ") + chalk.gray("Add to Open Code"));
 	console.log(chalk.cyan("  --manual      ") + chalk.gray("Manual configuration"));
@@ -7280,7 +7466,7 @@ function showAllOptions() {
 	console.log(chalk.gray("  • ") + chalk.white("better-auth") + chalk.gray(" - Search documentation, code examples, setup assistance"));
 	console.log();
 }
-const mcp = new Command("mcp").description("Add Better Auth MCP server to MCP Clients").option("--cursor", "Automatically open Cursor with the MCP configuration").option("--claude-code", "Show Claude Code MCP configuration command").option("--open-code", "Show Open Code MCP configuration").option("--manual", "Show manual MCP configuration for mcp.json").action(mcpAction);
+const mcp = new Command("mcp").description("Add Better Auth MCP server to MCP Clients").option("--cursor", "Automatically open Cursor with the MCP configuration").option("--codex", "Add the MCP server to Codex").option("--claude-code", "Show Claude Code MCP configuration command").option("--open-code", "Show Open Code MCP configuration").option("--manual", "Show manual MCP configuration for mcp.json").action(mcpAction);
 //#endregion
 //#region src/commands/migrate.ts
 /** @internal */
@@ -7372,6 +7558,21 @@ async function migrateAction(opts) {
 		} catch {}
 		process.exit(1);
 	}
+	if (plan.schemaProblems.length) {
+		spinner.stop();
+		console.error(chalk.red.bold(`The database has ${plan.schemaProblems.length} ${plan.schemaProblems.length === 1 ? "column" : "columns"} Better Auth cannot write to. Nothing ran.`));
+		for (const problem of plan.schemaProblems) console.error(chalk.red(`-> ${problem}`));
+		try {
+			await (await createTelemetry(config)).publish({
+				type: "cli_migrate",
+				payload: {
+					outcome: "schema_problem",
+					config: await getTelemetryAuthConfig(config)
+				}
+			});
+		} catch {}
+		process.exit(1);
+	}
 	const { toBeAdded, toBeAddedIndexes, toBeCreated, runMigrations } = plan;
 	if (!toBeAdded.length && !toBeAddedIndexes.length && !toBeCreated.length) {
 		spinner.stop();
@@ -7439,8 +7640,8 @@ const generateSecret = new Command("secret").action(() => {
 ${chalk.gray("# Auth Secret") + chalk.green(`\nBETTER_AUTH_SECRET=${secret}`)}`);
 });
 //#endregion
-//#region src/commands/upgrade.ts
-const fixedReleaseGroup = [[
+//#region ../../.changeset/config.json
+var fixed = [[
 	"better-auth",
 	"@better-auth/core",
 	"auth",
@@ -7463,7 +7664,11 @@ const fixedReleaseGroup = [[
 	"@better-auth/stripe",
 	"@better-auth/telemetry",
 	"@better-auth/test-utils"
-]].find((group) => group.includes("better-auth"));
+]];
+//#endregion
+//#region src/commands/upgrade.ts
+const dependencyMapSchema = z.record(z.string(), z.string().catch("")).catch({});
+const fixedReleaseGroup = fixed.find((group) => group.includes("better-auth"));
 if (!fixedReleaseGroup) throw new Error("The Better Auth fixed release group is not configured.");
 const SYNCHRONIZED_BETTER_AUTH_PACKAGES = new Set(fixedReleaseGroup.filter((name) => name !== "auth"));
 function isSynchronizedBetterAuthPackage(name) {
@@ -7487,8 +7692,8 @@ async function upgradeAction(opts) {
 		console.error(`Could not read package.json in "${cwd}". Make sure you are in a project directory.`);
 		process.exit(1);
 	}
-	const deps = packageJson.dependencies ?? {};
-	const devDeps = packageJson.devDependencies ?? {};
+	const deps = dependencyMapSchema.parse(packageJson.dependencies);
+	const devDeps = dependencyMapSchema.parse(packageJson.devDependencies);
 	const candidates = [];
 	for (const [name, version] of Object.entries(deps)) if (isSynchronizedBetterAuthPackage(name) && !version.startsWith("workspace:")) candidates.push({
 		name,
@@ -7506,8 +7711,14 @@ async function upgradeAction(opts) {
 	}
 	const spinner = yoctoSpinner({ text: "checking for updates..." }).start();
 	const upgrades = [];
+	const warnings = [];
 	for (const { name, current, depType } of candidates) {
-		const currentVersion = semver.minVersion(current);
+		const currentRange = semver.validRange(current);
+		if (!currentRange) {
+			warnings.push(`Skipped ${name} (${current}). Automatic upgrades require a semver range.`);
+			continue;
+		}
+		const currentVersion = semver.minVersion(currentRange);
 		if (currentVersion && semver.lt(currentVersion, cliVersion)) upgrades.push({
 			name,
 			current,
@@ -7516,8 +7727,9 @@ async function upgradeAction(opts) {
 		});
 	}
 	spinner.stop();
+	for (const warning of warnings) console.warn(chalk.yellow(warning));
 	if (upgrades.length === 0) {
-		console.log("All better-auth packages are up to date.");
+		console.log(warnings.length > 0 ? "No supported Better Auth package upgrades were found." : "All better-auth packages are up to date.");
 		return;
 	}
 	console.log(`\nThe following packages can be upgraded:\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "The CLI for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -63,10 +63,10 @@
     "prompts": "^2.4.2",
     "semver": "^7.8.4",
     "yocto-spinner": "^1.2.0",
-    "zod": "^4.3.6",
-    "@better-auth/core": "1.7.2",
-    "@better-auth/telemetry": "1.7.2",
-    "better-auth": "1.7.2"
+    "zod": "^4.5.4",
+    "@better-auth/core": "1.7.4",
+    "@better-auth/telemetry": "1.7.4",
+    "better-auth": "1.7.4"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",
@@ -78,7 +78,7 @@
     "tsx": "^4.21.0",
     "type-fest": "^5.7.0",
     "typescript": "^6.0.3",
-    "@better-auth/passkey": "1.7.2"
+    "@better-auth/passkey": "1.7.4"
   },
   "scripts": {
     "build": "tsdown",