better-auth 1.6.0 → 1.6.2

package/dist/api/index.d.mts

@@ -1,4 +1,4 @@
-import { Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
+import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
 import { getIp } from "../utils/get-request-ip.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
@@ -31,7 +31,7 @@ import * as zod_v4_core0 from "zod/v4/core";
 //#region src/api/index.d.ts
 declare function checkEndpointConflicts(options: BetterAuthOptions, logger: InternalLogger): void;
 declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<AuthContext>, options: Option): {
-  api: Omit<{
+  api: OverrideMerge<{
     readonly ok: better_call0.StrictEndpoint<"/ok", {
       method: "GET";
       metadata: {
@@ -2007,11 +2007,9 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
       user: _better_auth_core_oauth20.OAuth2UserInfo;
       data: Record<string, any>;
     } | null>;
-  }, keyof UnionToIntersection<Option["plugins"] extends (infer T_10)[] ? T_10 extends BetterAuthPlugin ? T_10 extends {
+  }, UnionToIntersection<Option["plugins"] extends (infer T_10)[] ? T_10 extends BetterAuthPlugin ? T_10 extends {
     endpoints: infer E;
-  } ? E : {} : {} : {}>> & UnionToIntersection<Option["plugins"] extends (infer T_10)[] ? T_10 extends BetterAuthPlugin ? T_10 extends {
-    endpoints: infer E;
-  } ? E : {} : {} : {}>;
+  } ? E : {} : {} : {}>>;
   middlewares: {
     path: string;
     middleware: any;
@@ -2019,7 +2017,11 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
 };
 declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, options: Option) => {
   handler: (request: Request) => Promise<Response>;
-  endpoints: Omit<{
+  endpoints: UnionToIntersection<Option["plugins"] extends (infer T)[] ? T extends BetterAuthPlugin ? T extends {
+    endpoints: infer E;
+  } ? E : {} : {} : {}> extends infer T_1 ? T_1 extends UnionToIntersection<Option["plugins"] extends (infer T)[] ? T extends BetterAuthPlugin ? T extends {
+    endpoints: infer E;
+  } ? E : {} : {} : {}> ? T_1 extends unknown ? Prettify$1<({
     readonly ok: better_call0.StrictEndpoint<"/ok", {
       method: "GET";
       metadata: {
@@ -2139,7 +2141,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T ? { [K in keyof T]: T[K] } : never) | undefined;
+            } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_3 ? { [K_1 in keyof T_3]: T_3[K_1] } : never) | undefined;
           };
         };
         openapi: {
@@ -2192,7 +2194,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_1 ? { [K in keyof T_1]: T_1[K] } : never;
+      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_4 ? { [K_1 in keyof T_4]: T_4[K_1] } : never;
     }>;
     readonly callbackOAuth: better_call0.StrictEndpoint<"/callback/:id", {
       method: ("GET" | "POST")[];
@@ -2264,7 +2266,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
         token: string;
         ipAddress?: string | null | undefined;
         userAgent?: string | null | undefined;
-      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["session"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"session", Option["plugins"]> extends infer T_2 ? { [K_1 in keyof T_2]: T_2[K_1] } : never;
+      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["session"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"session", Option["plugins"]> extends infer T_5 ? { [K_2 in keyof T_5]: T_5[K_2] } : never;
       user: {
         id: string;
         createdAt: Date;
@@ -2273,7 +2275,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_3 ? { [K in keyof T_3]: T_3[K] } : never;
+      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_6 ? { [K_1 in keyof T_6]: T_6[K_1] } : never;
     } | null>;
     readonly signOut: better_call0.StrictEndpoint<"/sign-out", {
       method: "POST";
@@ -2338,7 +2340,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_4 ? { [K in keyof T_4]: T_4[K] } : never;
+            } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_7 ? { [K_1 in keyof T_7]: T_7[K_1] } : never;
           };
         };
         openapi: {
@@ -2466,7 +2468,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_5 ? { [K in keyof T_5]: T_5[K] } : never;
+      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_8 ? { [K_1 in keyof T_8]: T_8[K_1] } : never;
     } | {
       token: string;
       user: {
@@ -2477,7 +2479,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_6 ? { [K in keyof T_6]: T_6[K] } : never;
+      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_9 ? { [K_1 in keyof T_9]: T_9[K_1] } : never;
     }>;
     readonly signInEmail: better_call0.StrictEndpoint<"/sign-in/email", {
       method: "POST";
@@ -2510,7 +2512,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
               emailVerified: boolean;
               name: string;
               image?: string | null | undefined;
-            } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_7 ? { [K in keyof T_7]: T_7[K] } : never;
+            } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_10 ? { [K_1 in keyof T_10]: T_10[K_1] } : never;
           };
         };
         openapi: {
@@ -2562,7 +2564,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_8 ? { [K in keyof T_8]: T_8[K] } : never;
+      } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["user"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"user", Option["plugins"]> extends infer T_11 ? { [K_1 in keyof T_11]: T_11[K_1] } : never;
     }>;
     readonly resetPassword: better_call0.StrictEndpoint<"/reset-password", {
       method: "POST";
@@ -3374,7 +3376,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
       token: string;
       ipAddress?: string | null | undefined;
       userAgent?: string | null | undefined;
-    } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["session"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"session", Option["plugins"]> extends infer T_9 ? { [K_1 in keyof T_9]: T_9[K_1] } : never>[]>;
+    } & _better_auth_core_db0.InferDBFieldsFromOptions<Option["session"]> & _better_auth_core_db0.InferDBFieldsFromPlugins<"session", Option["plugins"]> extends infer T_12 ? { [K_2 in keyof T_12]: T_12[K_2] } : never>[]>;
     readonly revokeSession: better_call0.StrictEndpoint<"/revoke-session", {
       method: "POST";
       body: zod.ZodObject<{
@@ -3995,11 +3997,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
       user: _better_auth_core_oauth20.OAuth2UserInfo;
       data: Record<string, any>;
     } | null>;
-  }, keyof UnionToIntersection<Option["plugins"] extends (infer T_10)[] ? T_10 extends BetterAuthPlugin ? T_10 extends {
-    endpoints: infer E;
-  } ? E : {} : {} : {}>> & UnionToIntersection<Option["plugins"] extends (infer T_10)[] ? T_10 extends BetterAuthPlugin ? T_10 extends {
-    endpoints: infer E;
-  } ? E : {} : {} : {}>;
+  } extends infer T_2 ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K] } : never) & T_1> : never : never : never;
 };
 //#endregion
 export { APIError, type AuthEndpoint, type AuthMiddleware, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -165,10 +165,9 @@ const router = (ctx, options) => {
 			if (disabledPaths.includes(normalizedPath)) return new Response("Not Found", { status: 404 });
 			let currentRequest = req;
 			for (const plugin of ctx.options.plugins || []) if (plugin.onRequest) {
-				const response = await withSpan(`onRequest ${normalizedPath} ${plugin.id}`, {
+				const response = await withSpan(`onRequest ${plugin.id}`, {
 					[ATTR_HOOK_TYPE]: "onRequest",
-					[ATTR_CONTEXT]: `plugin:${plugin.id}`,
-					[ATTR_HTTP_ROUTE]: normalizedPath
+					[ATTR_CONTEXT]: `plugin:${plugin.id}`
 				}, () => plugin.onRequest(currentRequest, ctx));
 				if (response && "response" in response) return response.response;
 				if (response && "request" in response) currentRequest = response.request;
@@ -179,12 +178,10 @@ const router = (ctx, options) => {
 		},
 		async onResponse(res, req) {
 			await onResponseRateLimit(req, ctx);
-			const normalizedPath = normalizePathname(req.url, basePath);
 			for (const plugin of ctx.options.plugins || []) if (plugin.onResponse) {
-				const response = await withSpan(`onResponse ${normalizedPath} ${plugin.id}`, {
+				const response = await withSpan(`onResponse ${plugin.id}`, {
 					[ATTR_HOOK_TYPE]: "onResponse",
 					[ATTR_CONTEXT]: `plugin:${plugin.id}`,
-					[ATTR_HTTP_ROUTE]: normalizedPath,
 					[ATTR_HTTP_RESPONSE_STATUS_CODE]: res.status
 				}, () => plugin.onResponse(res, ctx));
 				if (response) return response.response;

package/dist/api/routes/callback.mjs

@@ -104,7 +104,7 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 			return redirectOnError("unable_to_link_account");
 		}
 		if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return redirectOnError("email_doesn't_match");
-		const existingAccount = await c.context.internalAdapter.findAccount(String(userInfo.id));
+		const existingAccount = await c.context.internalAdapter.findAccountByProviderId(String(userInfo.id), provider.id);
 		if (existingAccount) {
 			if (existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError("account_already_linked_to_different_user");
 			const updateData = Object.fromEntries(Object.entries({

package/dist/api/to-auth-endpoints.mjs

@@ -28,7 +28,7 @@ function toAuthEndpoints(endpoints, ctx) {
 			const run = async () => {
 				const authContext = await ctx;
 				const methodName = context?.method ?? context?.request?.method ?? defaultMethod ?? "?";
-				const pathName = context?.path ?? endpoint.path ?? "/:virtual";
+				const route = endpoint.path ?? "/:virtual";
 				let internalContext = {
 					...context,
 					context: {
@@ -42,8 +42,8 @@ function toAuthEndpoints(endpoints, ctx) {
 				};
 				const hasRequest = context?.request instanceof Request;
 				const shouldReturnResponse = context?.asResponse ?? hasRequest;
-				return withSpan(`${methodName} ${pathName}`, {
-					[ATTR_HTTP_ROUTE]: pathName,
+				return withSpan(`${methodName} ${route}`, {
+					[ATTR_HTTP_ROUTE]: route,
 					[ATTR_OPERATION_ID]: operationId
 				}, async () => runWithEndpointContext(internalContext, async () => {
 					const { beforeHooks, afterHooks } = getHooks(authContext);
@@ -70,8 +70,8 @@ function toAuthEndpoints(endpoints, ctx) {
 					internalContext.asResponse = false;
 					internalContext.returnHeaders = true;
 					internalContext.returnStatus = true;
-					const result = await runWithEndpointContext(internalContext, () => withSpan(`handler ${pathName}`, {
-						[ATTR_HTTP_ROUTE]: pathName,
+					const result = await runWithEndpointContext(internalContext, () => withSpan(`handler ${route}`, {
+						[ATTR_HTTP_ROUTE]: route,
 						[ATTR_OPERATION_ID]: operationId
 					}, () => endpoint(internalContext))).catch((e) => {
 						if (isAPIError(e))
@@ -130,10 +130,10 @@ async function runBeforeHooks(context, hooks, endpoint, operationId) {
 		}
 		if (matched) {
 			const hookSource = hooksSourceWeakMap.get(hook.handler) ?? "unknown";
-			const path = context.path ?? endpoint?.path ?? "/:virtual";
-			const result = await withSpan(`hook before ${path} ${hookSource}`, {
+			const route = endpoint.path ?? "/:virtual";
+			const result = await withSpan(`hook before ${route} ${hookSource}`, {
 				[ATTR_HOOK_TYPE]: "before",
-				[ATTR_HTTP_ROUTE]: path,
+				[ATTR_HTTP_ROUTE]: route,
 				[ATTR_CONTEXT]: hookSource,
 				[ATTR_OPERATION_ID]: operationId
 			}, () => hook.handler({
@@ -162,10 +162,10 @@ async function runBeforeHooks(context, hooks, endpoint, operationId) {
 async function runAfterHooks(context, hooks, endpoint, operationId) {
 	for (const hook of hooks) if (hook.matcher(context)) {
 		const hookSource = hooksSourceWeakMap.get(hook.handler) ?? "unknown";
-		const path = context.path ?? endpoint?.path ?? "/:virtual";
-		const result = await withSpan(`hook after ${path} ${hookSource}`, {
+		const route = endpoint.path ?? "/:virtual";
+		const result = await withSpan(`hook after ${route} ${hookSource}`, {
 			[ATTR_HOOK_TYPE]: "after",
-			[ATTR_HTTP_ROUTE]: path,
+			[ATTR_HTTP_ROUTE]: route,
 			[ATTR_CONTEXT]: hookSource,
 			[ATTR_OPERATION_ID]: operationId
 		}, () => hook.handler(context)).catch((e) => {

package/dist/client/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../types/helper.mjs";
 import { CamelCase, InferCtx, InferRoute, InferRoutes, InferSignUpEmailCtx, InferUserUpdateCtx, MergeRoutes, PathToObject, ProxyRequest } from "./path-to-object.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientStore, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferSessionFromClient, InferUserFromClient, IsSignal, SessionQueryParams } from "./types.mjs";
 import { BroadcastChannel, BroadcastListener, BroadcastMessage, getGlobalBroadcastChannel, kBroadcastChannel } from "./broadcast-channel.mjs";
@@ -31,4 +31,4 @@ declare function InferAuth<O extends {
   options: BetterAuthOptions;
 }>(): O["options"];
 //#endregion
-export { AccessControl, ArrayElement, AuthClient, AuthQueryAtom, AuthorizeResponse, BetterAuthClientOptions, BetterAuthClientPlugin, BroadcastChannel, BroadcastListener, BroadcastMessage, CamelCase, ClientAtomListener, ClientStore, type DBPrimitive, DefaultOrganizationPlugin, DynamicAccessControlEndpoints, ExtractPluginField, type FocusListener, type FocusManager, HasRequiredKeys, InferActions, InferAdditionalFromClient, InferAuth, InferClientAPI, InferCtx, InferErrorCodes, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPlugin, InferPluginFieldFromTuple, InferRoute, InferRoutes, InferSessionFromClient, InferSignUpEmailCtx, InferTeam, InferUserFromClient, InferUserUpdateCtx, Invitation, InvitationInput, InvitationStatus, IsAny, IsSignal, Member, MemberInput, MergeRoutes, type OnlineListener, type OnlineManager, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, PathToObject, Prettify, PrettifyDeep, ProxyRequest, RequiredKeysOf, Role, SessionQueryParams, SessionRefreshOptions, SessionResponse, Statements, StripEmptyObjects, SubArray, Subset, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, type UnionToIntersection, createAccessControl, createAuthClient, createSessionRefreshManager, defaultRolesSchema, getGlobalBroadcastChannel, getOrgAdapter, hasPermission, invitationSchema, invitationStatus, kBroadcastChannel, kFocusManager, kOnlineManager, memberSchema, organization, organizationRoleSchema, organizationSchema, parseJSON, parseRoles, role, roleSchema, teamMemberSchema, teamSchema, useAuthQuery };
+export { AccessControl, ArrayElement, AuthClient, AuthQueryAtom, AuthorizeResponse, BetterAuthClientOptions, BetterAuthClientPlugin, BroadcastChannel, BroadcastListener, BroadcastMessage, CamelCase, ClientAtomListener, ClientStore, type DBPrimitive, DefaultOrganizationPlugin, DynamicAccessControlEndpoints, ExtractPluginField, type FocusListener, type FocusManager, HasRequiredKeys, InferActions, InferAdditionalFromClient, InferAuth, InferClientAPI, InferCtx, InferErrorCodes, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPlugin, InferPluginFieldFromTuple, InferRoute, InferRoutes, InferSessionFromClient, InferSignUpEmailCtx, InferTeam, InferUserFromClient, InferUserUpdateCtx, Invitation, InvitationInput, InvitationStatus, IsAny, IsSignal, Member, MemberInput, MergeRoutes, type OnlineListener, type OnlineManager, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, OverrideMerge, PathToObject, Prettify, PrettifyDeep, ProxyRequest, RequiredKeysOf, Role, SessionQueryParams, SessionRefreshOptions, SessionResponse, Statements, StripEmptyObjects, SubArray, Subset, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, type UnionToIntersection, createAccessControl, createAuthClient, createSessionRefreshManager, defaultRolesSchema, getGlobalBroadcastChannel, getOrgAdapter, hasPermission, invitationSchema, invitationStatus, kBroadcastChannel, kFocusManager, kOnlineManager, memberSchema, organization, organizationRoleSchema, organizationSchema, parseJSON, parseRoles, role, roleSchema, teamMemberSchema, teamSchema, useAuthQuery };

package/dist/client/lynx/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
 import { InferActions, InferClientAPI, InferErrorCodes, IsSignal, SessionQueryParams } from "../types.mjs";
 import { useStore } from "./lynx-store.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin } from "@better-auth/core";
@@ -123,4 +123,4 @@ declare function createAuthClient<Option extends BetterAuthClientOptions>(option
   $ERROR_CODES: PrettifyDeep<InferErrorCodes<Option> & typeof BASE_ERROR_CODES>;
 };
 //#endregion
-export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient, useStore };
+export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient, useStore };

package/dist/client/plugins/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "../../plugins/organization/schema.mjs";
 import { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole } from "../../plugins/admin/types.mjs";
 import { schema } from "../../plugins/anonymous/schema.mjs";
@@ -52,4 +52,4 @@ import { phoneNumberClient } from "../../plugins/phone-number/client.mjs";
 import { siweClient } from "../../plugins/siwe/client.mjs";
 import { usernameClient } from "../../plugins/username/client.mjs";
 import { InferServerPlugin } from "./infer-plugin.mjs";
-export { ADMIN_ERROR_CODES, ANONYMOUS_ERROR_CODES, AdminOptions, AnonymousOptions, AnonymousSession, Auth0Options, AuthorizationQuery, BackupCodeOptions, BaseOAuthProviderOptions, Client, CodeVerificationValue, EMAIL_OTP_ERROR_CODES, ExtractPluginField, GENERIC_OAUTH_ERROR_CODES, GenericOAuthConfig, GenericOAuthOptions, GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, GumroadOptions, HasRequiredKeys, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginFieldFromTuple, InferServerPlugin, InferTeam, Invitation, InvitationInput, InvitationStatus, IsAny, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodClientConfig, LineOptions, MULTI_SESSION_ERROR_CODES, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAuthAccessToken, OIDCMetadata, OIDCOptions, ORGANIZATION_ERROR_CODES, OTPOptions, OidcClientPlugin, OktaOptions, OneTimeTokenOptions, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, PHONE_NUMBER_ERROR_CODES, PatreonOptions, PhoneNumberOptions, Prettify, PrettifyDeep, RequiredKeysOf, SessionWithImpersonatedBy, SlackOptions, StripEmptyObjects, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamInput, TeamMember, TeamMemberInput, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UnionToIntersection, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, adminClient, anonymousClient, auth0, backupCode2fa, clientSideHasPermission, customSessionClient, defaultRolesSchema, deviceAuthorizationClient, emailOTPClient, generateBackupCodes, genericOAuthClient, getBackupCodes, gumroad, hubspot, inferAdditionalFields, inferOrgAdditionalFields, invitationSchema, invitationStatus, jwtClient, keycloak, lastLoginMethodClient, line, magicLinkClient, memberSchema, microsoftEntraId, multiSessionClient, oidcClient, okta, oneTapClient, oneTimeTokenClient, organizationClient, organizationRoleSchema, organizationSchema, otp2fa, patreon, phoneNumberClient, roleSchema, schema, siweClient, slack, teamMemberSchema, teamSchema, totp2fa, twoFactorClient, usernameClient, verifyBackupCode };
+export { ADMIN_ERROR_CODES, ANONYMOUS_ERROR_CODES, AdminOptions, AnonymousOptions, AnonymousSession, Auth0Options, AuthorizationQuery, BackupCodeOptions, BaseOAuthProviderOptions, Client, CodeVerificationValue, EMAIL_OTP_ERROR_CODES, ExtractPluginField, GENERIC_OAUTH_ERROR_CODES, GenericOAuthConfig, GenericOAuthOptions, GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, GumroadOptions, HasRequiredKeys, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginFieldFromTuple, InferServerPlugin, InferTeam, Invitation, InvitationInput, InvitationStatus, IsAny, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodClientConfig, LineOptions, MULTI_SESSION_ERROR_CODES, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAuthAccessToken, OIDCMetadata, OIDCOptions, ORGANIZATION_ERROR_CODES, OTPOptions, OidcClientPlugin, OktaOptions, OneTimeTokenOptions, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, OverrideMerge, PHONE_NUMBER_ERROR_CODES, PatreonOptions, PhoneNumberOptions, Prettify, PrettifyDeep, RequiredKeysOf, SessionWithImpersonatedBy, SlackOptions, StripEmptyObjects, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamInput, TeamMember, TeamMemberInput, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UnionToIntersection, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, adminClient, anonymousClient, auth0, backupCode2fa, clientSideHasPermission, customSessionClient, defaultRolesSchema, deviceAuthorizationClient, emailOTPClient, generateBackupCodes, genericOAuthClient, getBackupCodes, gumroad, hubspot, inferAdditionalFields, inferOrgAdditionalFields, invitationSchema, invitationStatus, jwtClient, keycloak, lastLoginMethodClient, line, magicLinkClient, memberSchema, microsoftEntraId, multiSessionClient, oidcClient, okta, oneTapClient, oneTimeTokenClient, organizationClient, organizationRoleSchema, organizationSchema, otp2fa, patreon, phoneNumberClient, roleSchema, schema, siweClient, slack, teamMemberSchema, teamSchema, totp2fa, twoFactorClient, usernameClient, verifyBackupCode };

package/dist/client/react/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
 import { InferActions, InferClientAPI, InferErrorCodes, IsSignal, SessionQueryParams } from "../types.mjs";
 import { useStore } from "./react-store.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin } from "@better-auth/core";
@@ -124,4 +124,4 @@ declare function createAuthClient<Option extends BetterAuthClientOptions>(option
   $ERROR_CODES: InferErrorCodes<Option> & typeof BASE_ERROR_CODES;
 };
 //#endregion
-export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient, useStore };
+export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient, useStore };

package/dist/client/solid/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
 import { InferActions, InferClientAPI, InferErrorCodes, IsSignal, SessionQueryParams } from "../types.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin } from "@better-auth/core";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -118,4 +118,4 @@ declare function createAuthClient<Option extends BetterAuthClientOptions>(option
   $ERROR_CODES: PrettifyDeep<InferErrorCodes<Option> & typeof BASE_ERROR_CODES>;
 };
 //#endregion
-export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient };
+export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient };

package/dist/client/svelte/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
 import { InferActions, InferClientAPI, InferErrorCodes, IsSignal, SessionQueryParams } from "../types.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin } from "@better-auth/core";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -124,4 +124,4 @@ declare function createAuthClient<Option extends BetterAuthClientOptions>(option
   $ERROR_CODES: PrettifyDeep<InferErrorCodes<Option> & typeof BASE_ERROR_CODES>;
 };
 //#endregion
-export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient };
+export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient };

package/dist/client/vue/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "../../types/helper.mjs";
 import { InferActions, InferClientAPI, InferErrorCodes, IsSignal, SessionQueryParams } from "../types.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin } from "@better-auth/core";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -147,4 +147,4 @@ declare function createAuthClient<Option extends BetterAuthClientOptions>(option
   $ERROR_CODES: PrettifyDeep<InferErrorCodes<Option> & typeof BASE_ERROR_CODES>;
 };
 //#endregion
-export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient };
+export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, type UnionToIntersection, createAuthClient };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "./types/helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "./types/helper.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientStore, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferSessionFromClient, InferUserFromClient, IsSignal, SessionQueryParams } from "./client/types.mjs";
 import { DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, JoinConfig, JoinOption, Where } from "./types/adapter.mjs";
 import { FilteredAPI, InferAPI, InferSessionAPI } from "./types/api.mjs";
@@ -27,4 +27,4 @@ export * from "@better-auth/core/utils/json";
 export * from "@better-auth/core/social-providers";
 export * from "better-call";
 export * from "zod";
-export { APIError, Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, HIDE_METADATA, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, JoinConfig, JoinOption, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StandardSchemaV1, StateData, StoreIdentifierOption, StripEmptyObjects, type TelemetryEvent, UnionToIntersection, User, Verification, Where, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromRequest, getOrigin, getProtocol, getProtocolFromRequest, getTelemetryAuthConfig, isDynamicBaseURLConfig, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL };
+export { APIError, Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, HIDE_METADATA, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, JoinConfig, JoinOption, OverrideMerge, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StandardSchemaV1, StateData, StoreIdentifierOption, StripEmptyObjects, type TelemetryEvent, UnionToIntersection, User, Verification, Where, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromRequest, getOrigin, getProtocol, getProtocolFromRequest, getTelemetryAuthConfig, isDynamicBaseURLConfig, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL };

package/dist/integrations/next-js.mjs

@@ -24,20 +24,29 @@ const nextCookies = () => {
 				matcher(ctx) {
 					return ctx.path === "/get-session";
 				},
-				handler: createAuthMiddleware(async () => {
-					let cookieStore;
+				handler: createAuthMiddleware(async (ctx) => {
+					if ("_flag" in ctx && ctx._flag === "router") return;
+					let headersStore;
 					try {
-						const { cookies } = await import("next/headers.js");
-						cookieStore = await cookies();
+						const { headers } = await import("next/headers.js");
+						headersStore = await headers();
 					} catch {
 						return;
 					}
-					try {
-						cookieStore.set("__better-auth-cookie-store", "1", { maxAge: 0 });
-						cookieStore.delete("__better-auth-cookie-store");
-					} catch {
-						await setShouldSkipSessionRefresh(true);
-					}
+					/**
+					* Detect RSC via headers, NOT by probing cookies().set().
+					* In Next.js, cookies().set() unconditionally triggers router
+					* cache invalidation -- even if the value is unchanged.
+					*
+					* RSC sends `RSC: 1` without `next-action`. Only in that
+					* context cookies cannot be written -- skip session refresh
+					* to avoid DB/cookie mismatch.
+					*
+					* @see https://github.com/vercel/next.js/blob/8c5af211d580/packages/next/src/server/web/spec-extension/adapters/request-cookies.ts#L112-L157
+					*/
+					const isRSC = headersStore.get("RSC") === "1";
+					const isServerAction = !!headersStore.get("next-action");
+					if (isRSC && !isServerAction) await setShouldSkipSessionRefresh(true);
 				})
 			}],
 			after: [{
@@ -51,12 +60,12 @@ const nextCookies = () => {
 						const setCookies = returned?.get("set-cookie");
 						if (!setCookies) return;
 						const parsed = parseSetCookieHeader(setCookies);
-						const { cookies } = await import("next/headers.js");
 						let cookieHelper;
 						try {
+							const { cookies } = await import("next/headers.js");
 							cookieHelper = await cookies();
 						} catch (error) {
-							if (error instanceof Error && error.message.startsWith("`cookies` was called outside a request scope.")) return;
+							if (error instanceof Error && (error.message.startsWith("`cookies` was called outside a request scope.") || error.message.includes("Cannot find module"))) return;
 							throw error;
 						}
 						parsed.forEach((value, key) => {

package/dist/oauth2/state.d.mts

@@ -15,6 +15,7 @@ declare function parseState(c: GenericEndpointContext): Promise<{
   expiresAt: number;
   errorURL?: string | undefined;
   newUserURL?: string | undefined;
+  oauthState?: string | undefined;
   link?: {
     email: string;
     userId: string;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.0";
+var version = "1.6.2";
 //#endregion
 export { version };

package/dist/plugins/oauth-proxy/index.mjs

@@ -164,6 +164,10 @@ const oAuthProxy = (opts) => {
 						return;
 					}
 					const errorURL = stateData.errorURL || ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
+					if (stateData.oauthState !== void 0 && stateData.oauthState !== statePackage.state) {
+						ctx.context.logger.error("OAuth proxy state binding mismatch");
+						throw redirectOnError(ctx, errorURL, "state_mismatch");
+					}
 					if (error) throw redirectOnError(ctx, errorURL, error);
 					if (!code) {
 						ctx.context.logger.error("OAuth callback missing authorization code");

package/dist/plugins/two-factor/client.d.mts

@@ -19,8 +19,18 @@ declare const twoFactorClient: (options?: {
   /**
    * a redirect function to call if a user needs to verify
    * their two factor
+   *
+   * @param context.twoFactorMethods - The list of
+   * enabled two factor providers (e.g. ["totp", "otp"]).
+   * Use this to determine which 2FA UI to show.
    */
-  onTwoFactorRedirect?: () => void | Promise<void>;
+  onTwoFactorRedirect?: (context: {
+    /**
+     * The list of enabled two factor providers
+     * for the user (e.g. ["totp", "otp"]).
+     */
+    twoFactorMethods?: string[];
+  }) => void | Promise<void>;
 } | undefined) => {
   id: "two-factor";
   version: string;

package/dist/plugins/two-factor/client.mjs

@@ -26,7 +26,7 @@ const twoFactorClient = (options) => {
 			hooks: { async onSuccess(context) {
 				if (context.data?.twoFactorRedirect) {
 					if (options?.onTwoFactorRedirect) {
-						await options.onTwoFactorRedirect();
+						await options.onTwoFactorRedirect({ twoFactorMethods: context.data.twoFactorMethods });
 						return;
 					}
 					if (options?.twoFactorPage && typeof window !== "undefined") window.location.href = options.twoFactorPage;

package/dist/plugins/two-factor/index.d.mts

@@ -618,6 +618,7 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       matcher(context: _better_auth_core0.HookEndpointContext): boolean;
       handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
         twoFactorRedirect: boolean;
+        twoFactorMethods: string[];
       } | undefined>;
     }[];
   };
@@ -655,6 +656,12 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
           };
           index: true;
         };
+        verified: {
+          type: "boolean";
+          required: false;
+          defaultValue: true;
+          input: false;
+        };
       };
     };
   };

package/dist/plugins/two-factor/index.mjs

@@ -103,6 +103,13 @@ const twoFactor = (options) => {
 					});
 					await ctx.context.internalAdapter.deleteSession(ctx.context.session.session.token);
 				}
+				const existingTwoFactor = await ctx.context.adapter.findOne({
+					model: opts.twoFactorTable,
+					where: [{
+						field: "userId",
+						value: user.id
+					}]
+				});
 				await ctx.context.adapter.deleteMany({
 					model: opts.twoFactorTable,
 					where: [{
@@ -115,7 +122,8 @@ const twoFactor = (options) => {
 					data: {
 						secret: encryptedSecret,
 						backupCodes: backupCodes.encryptedBackupCodes,
-						userId: user.id
+						userId: user.id,
+						verified: existingTwoFactor != null && existingTwoFactor.verified !== false || !!options?.skipVerificationOnEnable
 					}
 				});
 				const totpURI = createOTP(secret, {
@@ -225,7 +233,30 @@ const twoFactor = (options) => {
 					expiresAt: new Date(Date.now() + maxAge * 1e3)
 				});
 				await ctx.setSignedCookie(twoFactorCookie.name, identifier, ctx.context.secret, twoFactorCookie.attributes);
-				return ctx.json({ twoFactorRedirect: true });
+				const twoFactorMethods = [];
+				/**
+				* totp requires per-user setup, so we check
+				* that the user actually has a secret stored.
+				*/
+				if (!options?.totpOptions?.disable) {
+					const userTotpSecret = await ctx.context.adapter.findOne({
+						model: opts.twoFactorTable,
+						where: [{
+							field: "userId",
+							value: data.user.id
+						}]
+					});
+					if (userTotpSecret && userTotpSecret.verified !== false) twoFactorMethods.push("totp");
+				}
+				/**
+				* otp is server-level — if sendOTP is configured,
+				* any user with 2fa enabled can receive a code.
+				*/
+				if (options?.otpOptions?.sendOTP) twoFactorMethods.push("otp");
+				return ctx.json({
+					twoFactorRedirect: true,
+					twoFactorMethods
+				});
 			})
 		}] },
 		schema: mergeSchema(schema, {

package/dist/plugins/two-factor/otp/index.mjs

@@ -175,11 +175,11 @@ const otp2fa = (options) => {
 						if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
 						const updatedUser = await ctx.context.internalAdapter.updateUser(session.user.id, { twoFactorEnabled: true });
 						const newSession = await ctx.context.internalAdapter.createSession(session.user.id, false, session.session);
-						await ctx.context.internalAdapter.deleteSession(session.session.token);
 						await setSessionCookie(ctx, {
 							session: newSession,
 							user: updatedUser
 						});
+						await ctx.context.internalAdapter.deleteSession(session.session.token);
 						return ctx.json({
 							token: newSession.token,
 							user: parseUserOutput(ctx.context.options, updatedUser)

package/dist/plugins/two-factor/schema.d.mts

@@ -33,6 +33,12 @@ declare const schema: {
         };
         index: true;
       };
+      verified: {
+        type: "boolean";
+        required: false;
+        defaultValue: true;
+        input: false;
+      };
     };
   };
 };

package/dist/plugins/two-factor/schema.mjs

@@ -27,6 +27,12 @@ const schema = {
 				field: "id"
 			},
 			index: true
+		},
+		verified: {
+			type: "boolean",
+			required: false,
+			defaultValue: true,
+			input: false
 		}
 	} }
 };

package/dist/plugins/two-factor/totp/index.mjs

@@ -124,6 +124,7 @@ const totp2fa = (options) => {
 				}
 				const { session, valid, invalid } = await verifyTwoFactor(ctx);
 				const user = session.user;
+				const isSignIn = !session.session;
 				const twoFactor = await ctx.context.adapter.findOne({
 					model: twoFactorTable,
 					where: [{
@@ -132,6 +133,7 @@ const totp2fa = (options) => {
 					}]
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
+				if (isSignIn && twoFactor.verified === false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
 				if (!await createOTP(await symmetricDecrypt({
 					key: ctx.context.secretConfig,
 					data: twoFactor.secret
@@ -139,16 +141,23 @@ const totp2fa = (options) => {
 					period: opts.period,
 					digits: opts.digits
 				}).verify(ctx.body.code)) return invalid("INVALID_CODE");
-				if (!user.twoFactorEnabled) {
-					if (!session.session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					const updatedUser = await ctx.context.internalAdapter.updateUser(user.id, { twoFactorEnabled: true });
-					const newSession = await ctx.context.internalAdapter.createSession(user.id, false, session.session).catch((e) => {
-						throw e;
-					});
-					await ctx.context.internalAdapter.deleteSession(session.session.token);
-					await setSessionCookie(ctx, {
-						session: newSession,
-						user: updatedUser
+				if (twoFactor.verified !== true) {
+					if (!user.twoFactorEnabled) {
+						const activeSession = session.session;
+						const updatedUser = await ctx.context.internalAdapter.updateUser(user.id, { twoFactorEnabled: true });
+						await setSessionCookie(ctx, {
+							session: await ctx.context.internalAdapter.createSession(user.id, false, activeSession),
+							user: updatedUser
+						});
+						await ctx.context.internalAdapter.deleteSession(activeSession.token);
+					}
+					await ctx.context.adapter.update({
+						model: twoFactorTable,
+						update: { verified: true },
+						where: [{
+							field: "id",
+							value: twoFactor.id
+						}]
 					});
 				}
 				return valid(ctx);

package/dist/plugins/two-factor/types.d.mts

@@ -80,7 +80,7 @@ interface TwoFactorTable {
   userId: string;
   secret: string;
   backupCodes: string;
-  enabled: boolean;
+  verified: boolean;
 }
 //#endregion
 export { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor };

package/dist/state.d.mts

@@ -9,6 +9,11 @@ declare const stateDataSchema: z.ZodObject<{
   errorURL: z.ZodOptional<z.ZodString>;
   newUserURL: z.ZodOptional<z.ZodString>;
   expiresAt: z.ZodNumber;
+  /**
+   * CSRF nonce returned to the OAuth provider. When using cookie state storage,
+   * this must match the callback `state` query parameter.
+   */
+  oauthState: z.ZodOptional<z.ZodString>;
   link: z.ZodOptional<z.ZodObject<{
     email: z.ZodString;
     userId: z.ZodCoercedString<unknown>;
@@ -32,6 +37,7 @@ declare function parseGenericState(c: GenericEndpointContext, state: string, set
   expiresAt: number;
   errorURL?: string | undefined;
   newUserURL?: string | undefined;
+  oauthState?: string | undefined;
   link?: {
     email: string;
     userId: string;

package/dist/state.mjs

@@ -10,6 +10,7 @@ const stateDataSchema = z.looseObject({
 	errorURL: z.string().optional(),
 	newUserURL: z.string().optional(),
 	expiresAt: z.number(),
+	oauthState: z.string().optional(),
 	link: z.object({
 		email: z.string(),
 		userId: z.coerce.string()
@@ -28,9 +29,13 @@ var StateError = class extends BetterAuthError {
 async function generateGenericState(c, stateData, settings) {
 	const state = generateRandomString(32);
 	if (c.context.oauthConfig.storeStateStrategy === "cookie") {
+		const payload = {
+			...stateData,
+			oauthState: state
+		};
 		const encryptedData = await symmetricEncrypt({
 			key: c.context.secretConfig,
-			data: JSON.stringify(stateData)
+			data: JSON.stringify(payload)
 		});
 		const stateCookie = c.context.createAuthCookie(settings?.cookieName ?? "oauth_state", { maxAge: 600 });
 		c.setCookie(stateCookie.name, encryptedData, stateCookie.attributes);
@@ -44,7 +49,10 @@ async function generateGenericState(c, stateData, settings) {
 	const expiresAt = /* @__PURE__ */ new Date();
 	expiresAt.setMinutes(expiresAt.getMinutes() + 10);
 	if (!await c.context.internalAdapter.createVerificationValue({
-		value: JSON.stringify(stateData),
+		value: JSON.stringify({
+			...stateData,
+			oauthState: state
+		}),
 		identifier: state,
 		expiresAt
 	})) throw new StateError("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database", { code: "state_generation_error" });
@@ -76,6 +84,10 @@ async function parseGenericState(c, state, settings) {
 				cause: error
 			});
 		}
+		if (!parsedData.oauthState || parsedData.oauthState !== state) throw new StateError("State mismatch: OAuth state parameter does not match stored state", {
+			code: "state_security_mismatch",
+			details: { state }
+		});
 		expireCookie(c, stateCookie);
 	} else {
 		const data = await c.context.internalAdapter.findVerificationValue(state);
@@ -84,6 +96,10 @@ async function parseGenericState(c, state, settings) {
 			details: { state }
 		});
 		parsedData = stateDataSchema.parse(JSON.parse(data.value));
+		if (parsedData.oauthState !== void 0 && parsedData.oauthState !== state) throw new StateError("State mismatch: OAuth state parameter does not match stored state", {
+			code: "state_security_mismatch",
+			details: { state }
+		});
 		const stateCookie = c.context.createAuthCookie(settings?.cookieName ?? "state");
 		const stateCookieValue = await c.getSignedCookie(stateCookie.name, c.context.secret);
 		if (!(settings?.skipStateCookieCheck ?? c.context.oauthConfig.skipStateCookieCheck) && (!stateCookieValue || stateCookieValue !== state)) throw new StateError("State mismatch: State not persisted correctly", {

package/dist/test-utils/test-instance.d.mts

@@ -43,7 +43,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
     fetchOptions: {
       customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
     };
-  })["plugins"] extends any[] ? Omit<InferAPI<Omit<{
+  })["plugins"] extends any[] ? Omit<InferAPI<Prettify$1<{
     readonly ok: better_call0.StrictEndpoint<"/ok", {
       method: "GET";
       metadata: {
@@ -2019,7 +2019,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
       user: _better_auth_core_oauth20.OAuth2UserInfo;
       data: Record<string, any>;
     } | null>;
-  }, never>>, keyof (((C extends undefined ? {} : C) & {
+  }>>, keyof (((C extends undefined ? {} : C) & {
     baseURL: string | undefined;
     fetchOptions: {
       customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
@@ -2047,7 +2047,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
     $InferServerPlugin: infer Plug;
   } ? Plug extends {
     endpoints: infer Endpoints;
-  } ? Endpoints : {} : {}> : {} : never : never) : InferAPI<Omit<{
+  } ? Endpoints : {} : {}> : {} : never : never) : InferAPI<Prettify$1<{
     readonly ok: better_call0.StrictEndpoint<"/ok", {
       method: "GET";
       metadata: {
@@ -4023,7 +4023,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
       user: _better_auth_core_oauth20.OAuth2UserInfo;
       data: Record<string, any>;
     } | null>;
-  }, never>>, (C extends undefined ? {} : C) & {
+  }>>, (C extends undefined ? {} : C) & {
     baseURL: string | undefined;
     fetchOptions: {
       customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
@@ -4054,7 +4054,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         fetchOptions: {
           customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
         };
-      })["plugins"] extends any[] ? Omit<InferAPI<Omit<{
+      })["plugins"] extends any[] ? Omit<InferAPI<Prettify$1<{
         readonly ok: better_call0.StrictEndpoint<"/ok", {
           method: "GET";
           metadata: {
@@ -6030,7 +6030,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           user: _better_auth_core_oauth20.OAuth2UserInfo;
           data: Record<string, any>;
         } | null>;
-      }, never>>, keyof (((C extends undefined ? {} : C) & {
+      }>>, keyof (((C extends undefined ? {} : C) & {
         baseURL: string | undefined;
         fetchOptions: {
           customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
@@ -6058,7 +6058,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         $InferServerPlugin: infer Plug;
       } ? Plug extends {
         endpoints: infer Endpoints;
-      } ? Endpoints : {} : {}> : {} : never : never) : InferAPI<Omit<{
+      } ? Endpoints : {} : {}> : {} : never : never) : InferAPI<Prettify$1<{
         readonly ok: better_call0.StrictEndpoint<"/ok", {
           method: "GET";
           metadata: {
@@ -8034,7 +8034,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           user: _better_auth_core_oauth20.OAuth2UserInfo;
           data: Record<string, any>;
         } | null>;
-      }, never>>, (C extends undefined ? {} : C) & {
+      }>>, (C extends undefined ? {} : C) & {
         baseURL: string | undefined;
         fetchOptions: {
           customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
@@ -8136,7 +8136,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         fetchOptions: {
           customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
         };
-      })["plugins"] extends any[] ? Omit<InferAPI<Omit<{
+      })["plugins"] extends any[] ? Omit<InferAPI<Prettify$1<{
         readonly ok: better_call0.StrictEndpoint<"/ok", {
           method: "GET";
           metadata: {
@@ -10112,7 +10112,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           user: _better_auth_core_oauth20.OAuth2UserInfo;
           data: Record<string, any>;
         } | null>;
-      }, never>>, keyof (((C extends undefined ? {} : C) & {
+      }>>, keyof (((C extends undefined ? {} : C) & {
         baseURL: string | undefined;
         fetchOptions: {
           customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;
@@ -10140,7 +10140,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
         $InferServerPlugin: infer Plug;
       } ? Plug extends {
         endpoints: infer Endpoints;
-      } ? Endpoints : {} : {}> : {} : never : never) : InferAPI<Omit<{
+      } ? Endpoints : {} : {}> : {} : never : never) : InferAPI<Prettify$1<{
         readonly ok: better_call0.StrictEndpoint<"/ok", {
           method: "GET";
           metadata: {
@@ -12116,7 +12116,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
           user: _better_auth_core_oauth20.OAuth2UserInfo;
           data: Record<string, any>;
         } | null>;
-      }, never>>, (C extends undefined ? {} : C) & {
+      }>>, (C extends undefined ? {} : C) & {
         baseURL: string | undefined;
         fetchOptions: {
           customFetchImpl: (url: string | URL | Request, init?: RequestInit | undefined) => Promise<Response>;

package/dist/types/helper.d.mts

@@ -6,6 +6,13 @@ type UnionToIntersection<U> = (U extends any ? (k: U) => void : never) extends (
 type RequiredKeysOf<BaseType extends object> = Exclude<{ [Key in keyof BaseType]: BaseType extends Record<Key, BaseType[Key]> ? Key : never }[keyof BaseType], undefined>;
 type HasRequiredKeys<BaseType> = IsAny<BaseType> extends true ? false : [BaseType] extends [object] ? RequiredKeysOf<BaseType & object> extends never ? false : true : false;
 type StripEmptyObjects<T extends object> = { [K in keyof T]: T[K] };
+/**
+ * Object merge replacing `Base`'s keys with `Override`'s.
+ * The naive `Omit<Base, keyof Override> & Override` form breaks under generics.
+ *
+ * @see https://github.com/microsoft/TypeScript/issues/57466#issuecomment-1957988380
+ */
+type OverrideMerge<Base, Override> = Base extends unknown ? Override extends unknown ? Prettify<{ [K in keyof Base as K extends keyof Override ? never : K]: Base[K] } & Override> : never : never;
 /**
  * Extracts a Record-typed field from a plugin, guarding against `any`.
  */
@@ -16,4 +23,4 @@ type ExtractPluginField<T, Field extends string> = IsAny<T> extends true ? {} :
  */
 type InferPluginFieldFromTuple<T extends readonly unknown[], Field extends string, Acc = {}> = T extends readonly [infer Head, ...infer Tail] ? InferPluginFieldFromTuple<Tail, Field, Acc & ExtractPluginField<Head, Field>> : Acc;
 //#endregion
-export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection };
+export { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection };

package/dist/types/index.d.mts

@@ -1,4 +1,4 @@
-import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "./helper.mjs";
+import { ExtractPluginField, HasRequiredKeys, InferPluginFieldFromTuple, IsAny, OverrideMerge, Prettify, PrettifyDeep, RequiredKeysOf, StripEmptyObjects, UnionToIntersection } from "./helper.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientStore, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferSessionFromClient, InferUserFromClient, IsSignal, SessionQueryParams } from "../client/types.mjs";
 import { DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, JoinConfig, JoinOption, Where } from "./adapter.mjs";
 import { FilteredAPI, InferAPI, InferSessionAPI } from "./api.mjs";
@@ -7,4 +7,4 @@ import { InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPlug
 import { Auth } from "./auth.mjs";
 import { BetterAuthAdvancedOptions, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, StoreIdentifierOption } from "@better-auth/core";
 export * from "@better-auth/core/social-providers";
-export { Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, type BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, type BetterAuthCookies, type BetterAuthOptions, type BetterAuthPlugin, type BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, JoinConfig, JoinOption, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StoreIdentifierOption, StripEmptyObjects, UnionToIntersection, User, Verification, Where };
+export { Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, type BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, type BetterAuthCookies, type BetterAuthOptions, type BetterAuthPlugin, type BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, JoinConfig, JoinOption, OverrideMerge, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StoreIdentifierOption, StripEmptyObjects, UnionToIntersection, User, Verification, Where };

package/dist/utils/password.mjs

@@ -12,10 +12,14 @@ async function validatePassword(ctx, data) {
 async function checkPassword(userId, c) {
 	const credentialAccount = (await c.context.internalAdapter.findAccounts(userId))?.find((account) => account.providerId === "credential");
 	const currentPassword = credentialAccount?.password;
-	if (!credentialAccount || !currentPassword || !c.body.password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND);
+	const password = c.body.password;
+	if (!credentialAccount || !currentPassword || !password) {
+		if (password) await c.context.password.hash(password);
+		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
+	}
 	if (!await c.context.password.verify({
 		hash: currentPassword,
-		password: c.body.password
+		password
 	})) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
 	return true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -489,13 +489,13 @@
     "kysely": "^0.28.14",
     "nanostores": "^1.1.1",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.6.0",
-    "@better-auth/drizzle-adapter": "1.6.0",
-    "@better-auth/kysely-adapter": "1.6.0",
-    "@better-auth/memory-adapter": "1.6.0",
-    "@better-auth/mongo-adapter": "1.6.0",
-    "@better-auth/prisma-adapter": "1.6.0",
-    "@better-auth/telemetry": "1.6.0"
+    "@better-auth/core": "1.6.2",
+    "@better-auth/drizzle-adapter": "1.6.2",
+    "@better-auth/kysely-adapter": "1.6.2",
+    "@better-auth/memory-adapter": "1.6.2",
+    "@better-auth/mongo-adapter": "1.6.2",
+    "@better-auth/prisma-adapter": "1.6.2",
+    "@better-auth/telemetry": "1.6.2"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.116.3",