better-auth 1.7.0-rc.2 → 1.7.0-rc.3

package/dist/api/index.d.mts

@@ -290,6 +290,11 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
     } | null>;
     readonly signOut: import("better-call").StrictEndpoint<"/sign-out", {
       method: "POST";
+      body: import("zod").ZodOptional<import("zod").ZodObject<{
+        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+        disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        state: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
       operationId: string;
       requireHeaders: true;
       metadata: {
@@ -307,6 +312,14 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
                       success: {
                         type: string;
                       };
+                      url: {
+                        type: string;
+                        description: string;
+                      };
+                      redirect: {
+                        type: string;
+                        description: string;
+                      };
                     };
                   };
                 };
@@ -317,6 +330,8 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
       };
     }, {
       success: boolean;
+      url: string | undefined;
+      redirect: boolean | undefined;
     }>;
     readonly signUpEmail: import("better-call").StrictEndpoint<"/sign-up/email", {
       method: "POST";
@@ -2297,6 +2312,11 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
     } | null>;
     readonly signOut: import("better-call").StrictEndpoint<"/sign-out", {
       method: "POST";
+      body: import("zod").ZodOptional<import("zod").ZodObject<{
+        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+        disableRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        state: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
       operationId: string;
       requireHeaders: true;
       metadata: {
@@ -2314,6 +2334,14 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
                       success: {
                         type: string;
                       };
+                      url: {
+                        type: string;
+                        description: string;
+                      };
+                      redirect: {
+                        type: string;
+                        description: string;
+                      };
                     };
                   };
                 };
@@ -2324,6 +2352,8 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
       };
     }, {
       success: boolean;
+      url: string | undefined;
+      redirect: boolean | undefined;
     }>;
     readonly signUpEmail: import("better-call").StrictEndpoint<"/sign-up/email", {
       method: "POST";

package/dist/api/routes/sign-out.d.mts

@@ -1,6 +1,12 @@
+import * as z from "zod";
 //#region src/api/routes/sign-out.d.ts
 declare const signOut: import("better-call").StrictEndpoint<"/sign-out", {
   method: "POST";
+  body: z.ZodOptional<z.ZodObject<{
+    callbackURL: z.ZodOptional<z.ZodString>;
+    disableRedirect: z.ZodOptional<z.ZodBoolean>;
+    state: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
   operationId: string;
   requireHeaders: true;
   metadata: {
@@ -18,6 +24,14 @@ declare const signOut: import("better-call").StrictEndpoint<"/sign-out", {
                   success: {
                     type: string;
                   };
+                  url: {
+                    type: string;
+                    description: string;
+                  };
+                  redirect: {
+                    type: string;
+                    description: string;
+                  };
                 };
               };
             };
@@ -28,6 +42,8 @@ declare const signOut: import("better-call").StrictEndpoint<"/sign-out", {
   };
 }, {
   success: boolean;
+  url: string | undefined;
+  redirect: boolean | undefined;
 }>;
 //#endregion
 export { signOut };

package/dist/api/routes/sign-out.mjs

@@ -1,8 +1,20 @@
 import { deleteSessionCookie } from "../../cookies/index.mjs";
 import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
 //#region src/api/routes/sign-out.ts
+const signOutBodySchema = z.object({
+	callbackURL: z.string().meta({ description: "The URL to redirect to after provider logout" }).optional(),
+	disableRedirect: z.boolean().meta({ description: "Return the provider logout URL without redirecting" }).optional(),
+	state: z.string().meta({ description: "State to pass to the provider logout endpoint" }).optional()
+}).optional();
+const signOutResponse = (providerLogout) => ({
+	success: true,
+	url: providerLogout?.url,
+	redirect: providerLogout?.redirect
+});
 const signOut = createAuthEndpoint("/sign-out", {
 	method: "POST",
+	body: signOutBodySchema,
 	operationId: "signOut",
 	requireHeaders: true,
 	metadata: { openapi: {
@@ -12,19 +24,73 @@ const signOut = createAuthEndpoint("/sign-out", {
 			description: "Success",
 			content: { "application/json": { schema: {
 				type: "object",
-				properties: { success: { type: "boolean" } }
+				properties: {
+					success: { type: "boolean" },
+					url: {
+						type: "string",
+						description: "Provider logout URL when RP-initiated logout is available"
+					},
+					redirect: {
+						type: "boolean",
+						description: "Whether the client should redirect to the provider logout URL"
+					}
+				}
 			} } }
 		} }
 	} }
 }, async (ctx) => {
 	const sessionCookieToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+	let currentSession = null;
+	if (sessionCookieToken) try {
+		currentSession = await ctx.context.internalAdapter.findSession(sessionCookieToken);
+	} catch (e) {
+		ctx.context.logger.error("Failed to read session from database", e);
+	}
 	if (sessionCookieToken) try {
 		await ctx.context.internalAdapter.deleteSession(sessionCookieToken);
 	} catch (e) {
 		ctx.context.logger.error("Failed to delete session from database", e);
 	}
 	deleteSessionCookie(ctx);
-	return ctx.json({ success: true });
+	const providerLogoutResult = await (async () => {
+		try {
+			if (!currentSession) return null;
+			const accounts = await ctx.context.internalAdapter.findAccounts(currentSession.user.id);
+			const providersById = new Map(ctx.context.socialProviders.map((provider) => [provider.id, provider]));
+			const logoutAccounts = accounts.filter((account) => Boolean(providersById.get(account.providerId)?.createEndSessionURL)).sort((a, b) => b.updatedAt.getTime() - a.updatedAt.getTime());
+			if (logoutAccounts.length === 0) return null;
+			const seenProviderIds = /* @__PURE__ */ new Set();
+			const postLogoutRedirectURI = ctx.body?.callbackURL ? new URL(ctx.body.callbackURL, ctx.context.baseURL).toString() : void 0;
+			for (const account of logoutAccounts) {
+				if (seenProviderIds.has(account.providerId)) continue;
+				seenProviderIds.add(account.providerId);
+				const provider = providersById.get(account.providerId);
+				try {
+					const url = await provider?.createEndSessionURL?.({
+						idToken: account.idToken,
+						postLogoutRedirectURI,
+						state: ctx.body?.state
+					});
+					if (url) return url.toString();
+				} catch (e) {
+					ctx.context.logger.error(`Failed to create logout URL for provider "${account.providerId}"`, e);
+				}
+			}
+			return null;
+		} catch (e) {
+			ctx.context.logger.error("Failed to create provider logout URL", e);
+			return null;
+		}
+	})();
+	if (providerLogoutResult) {
+		const shouldRedirect = !ctx.body?.disableRedirect;
+		if (shouldRedirect) ctx.setHeader("Location", providerLogoutResult);
+		return ctx.json(signOutResponse({
+			url: providerLogoutResult,
+			redirect: shouldRedirect
+		}));
+	}
+	return ctx.json(signOutResponse());
 });
 //#endregion
 export { signOut };

package/dist/client/path-to-object.d.mts

@@ -77,7 +77,8 @@ type InferBodyCtx<Body, FetchOptions extends ClientFetchOption> = Body extends R
 } : never;
 type PrettifyUnion<T> = T extends unknown ? Prettify$1<T> : never;
 type HasRequiredKeysInUnion<T> = true extends (T extends unknown ? HasRequiredKeys<T> : never) ? true : false;
-type InferCtx<C extends InputContext<any, any>, FetchOptions extends ClientFetchOption> = IsAny<C["body"]> extends true ? InferCtxQuery<C, FetchOptions> : C["body"] extends Record<string, any> ? InferBodyCtx<C["body"], FetchOptions> : InferCtxQuery<C, FetchOptions>;
+type HasRequiredCtx<C extends InputContext<any, any>, FetchOptions extends ClientFetchOption> = IsAny<C["body"]> extends true ? HasRequiredKeysInUnion<InferCtx<C, FetchOptions>> : undefined extends C["body"] ? HasRequiredKeysInUnion<InferCtxQuery<C, FetchOptions>> : HasRequiredKeysInUnion<InferCtx<C, FetchOptions>>;
+type InferCtx<C extends InputContext<any, any>, FetchOptions extends ClientFetchOption> = IsAny<C["body"]> extends true ? InferCtxQuery<C, FetchOptions> : [NonNullable<C["body"]>] extends [never] ? InferCtxQuery<C, FetchOptions> : NonNullable<C["body"]> extends Record<string, any> ? InferBodyCtx<NonNullable<C["body"]>, FetchOptions> : InferCtxQuery<C, FetchOptions>;
 type MergeRoutes<T> = UnionToIntersection<T>;
 type InferRoute<API, COpts extends BetterAuthClientOptions> = API extends Record<string, infer T> ? T extends Endpoint ? T["options"]["metadata"] extends {
   isAction: false;
@@ -87,7 +88,7 @@ type InferRoute<API, COpts extends BetterAuthClientOptions> = API extends Record
   scope: "http";
 } | {
   scope: "server";
-} ? {} : PathToObject<T["path"], T extends ((ctx: infer C) => infer R) ? C extends InputContext<any, any> ? <FetchOptions extends ClientFetchOption<Partial<C["body"]> & Record<string, any>, Partial<C["query"]> & Record<string, any>, C["params"]>>(...data: HasRequiredKeysInUnion<InferCtx<C, FetchOptions>> extends true ? [PrettifyUnion<T["path"] extends `/sign-up/email` ? InferSignUpEmailCtx<COpts, FetchOptions> : T["path"] extends `/sign-in/social` ? Omit<InferCtx<C, FetchOptions>, "provider"> & {
+} ? {} : PathToObject<T["path"], T extends ((ctx: infer C) => infer R) ? C extends InputContext<any, any> ? <FetchOptions extends ClientFetchOption<Partial<C["body"]> & Record<string, any>, Partial<C["query"]> & Record<string, any>, C["params"]>>(...data: HasRequiredCtx<C, FetchOptions> extends true ? [PrettifyUnion<T["path"] extends `/sign-up/email` ? InferSignUpEmailCtx<COpts, FetchOptions> : T["path"] extends `/sign-in/social` ? Omit<InferCtx<C, FetchOptions>, "provider"> & {
   provider: SocialProviderList[number] | InferGenericOAuthProviderIds<COpts> | (string & {});
   fetchOptions?: FetchOptions | undefined;
 } : InferCtx<C, FetchOptions>>, FetchOptions?] : [PrettifyUnion<T["path"] extends `/update-user` ? InferUserUpdateCtx<COpts, FetchOptions> : T["path"] extends `/update-session` ? InferSessionUpdateCtx<COpts, FetchOptions> : InferCtx<C, FetchOptions>>?, FetchOptions?]) => Promise<BetterFetchResponse<T["options"]["metadata"] extends {

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.0-rc.2";
+var version = "1.7.0-rc.3";
 //#endregion
 export { version };

package/dist/plugins/device-authorization/index.d.mts

@@ -16,7 +16,7 @@ declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
   generateDeviceCode: z.ZodOptional<z.ZodCustom<() => string | Promise<string>, () => string | Promise<string>>>;
   generateUserCode: z.ZodOptional<z.ZodCustom<() => string | Promise<string>, () => string | Promise<string>>>;
   validateClient: z.ZodOptional<z.ZodCustom<(clientId: string) => boolean | Promise<boolean>, (clientId: string) => boolean | Promise<boolean>>>;
-  onDeviceAuthRequest: z.ZodOptional<z.ZodCustom<(clientId: string, scope: string | undefined) => void | Promise<void>, (clientId: string, scope: string | undefined) => void | Promise<void>>>;
+  onDeviceAuthRequest: z.ZodOptional<z.ZodCustom<(clientId: string, scope: string | undefined, resource?: string | string[]) => void | Promise<void>, (clientId: string, scope: string | undefined, resource?: string | string[]) => void | Promise<void>>>;
   verificationUri: z.ZodOptional<z.ZodString>;
   schema: z.ZodOptional<z.ZodCustom<{
     deviceCode?: {
@@ -31,6 +31,7 @@ declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
         pollingInterval?: string | undefined;
         clientId?: string | undefined;
         scope?: string | undefined;
+        resource?: string | undefined;
       } | undefined;
     } | undefined;
   }, {
@@ -46,6 +47,7 @@ declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
         pollingInterval?: string | undefined;
         clientId?: string | undefined;
         scope?: string | undefined;
+        resource?: string | undefined;
       } | undefined;
     } | undefined;
   }>>;
@@ -93,26 +95,39 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
           type: "string";
           required: false;
         };
+        resource: {
+          type: "string";
+          required: false;
+        };
       };
+      indexes: {
+        fields: [string];
+      }[];
     };
   };
   endpoints: {
     deviceCode: import("better-call").StrictEndpoint<"/device/code", {
       method: "POST";
+      cloneRequest: true;
       body: z.ZodObject<{
         client_id: z.ZodString;
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
       }, z.core.$strip>;
       error: z.ZodObject<{
         error: z.ZodEnum<{
           invalid_request: "invalid_request";
           invalid_client: "invalid_client";
+          unauthorized_client: "unauthorized_client";
+          invalid_scope: "invalid_scope";
+          invalid_target: "invalid_target";
         }>;
         error_description: z.ZodString;
       }, z.core.$strip>;
       metadata: {
         noStore: boolean;
+        allowedMediaTypes: string[];
         openapi: {
           description: string;
           responses: {
@@ -284,6 +299,26 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
                         enum: string[];
                         description: string;
                       };
+                      client_id: {
+                        type: string;
+                        description: string;
+                      };
+                      scope: {
+                        type: string;
+                        description: string;
+                      };
+                      resource: {
+                        oneOf: ({
+                          type: string;
+                          items?: undefined;
+                        } | {
+                          type: string;
+                          items: {
+                            type: string;
+                          };
+                        })[];
+                        description: string;
+                      };
                     };
                   };
                 };
@@ -293,6 +328,9 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
         };
       };
     }, {
+      client_id?: string | undefined;
+      scope?: string | undefined;
+      resource?: string | string[] | undefined;
       user_code: string;
       status: string;
     }>;
@@ -401,7 +439,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
     generateDeviceCode?: (() => string | Promise<string>) | undefined;
     generateUserCode?: (() => string | Promise<string>) | undefined;
     validateClient?: ((clientId: string) => boolean | Promise<boolean>) | undefined;
-    onDeviceAuthRequest?: ((clientId: string, scope: string | undefined) => void | Promise<void>) | undefined;
+    onDeviceAuthRequest?: ((clientId: string, scope: string | undefined, resource?: string | string[]) => void | Promise<void>) | undefined;
     verificationUri?: string | undefined;
     schema?: {
       deviceCode?: {
@@ -416,6 +454,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
           pollingInterval?: string | undefined;
           clientId?: string | undefined;
           scope?: string | undefined;
+          resource?: string | undefined;
         } | undefined;
       } | undefined;
     } | undefined;

package/dist/plugins/device-authorization/index.mjs

@@ -2,8 +2,8 @@ import { mergeSchema } from "../../db/schema.mjs";
 import { ms } from "../../utils/time.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { DEVICE_AUTHORIZATION_ERROR_CODES } from "./error-codes.mjs";
-import { deviceApprove, deviceCode, deviceDeny, deviceToken, deviceVerify } from "./routes.mjs";
 import { schema } from "./schema.mjs";
+import { deviceApprove, deviceCode, deviceDeny, deviceToken, deviceVerify } from "./routes.mjs";
 import * as z from "zod";
 //#region src/plugins/device-authorization/index.ts
 const timeStringSchema = z.custom((val) => {
@@ -18,8 +18,8 @@ const timeStringSchema = z.custom((val) => {
 const deviceAuthorizationOptionsSchema = z.object({
 	expiresIn: timeStringSchema.default("30m").describe("Time in seconds until the device code expires. Use formats like '30m', '5s', '1h', etc."),
 	interval: timeStringSchema.default("5s").describe("Time in seconds between polling attempts. Use formats like '30m', '5s', '1h', etc."),
-	deviceCodeLength: z.number().int().positive().default(40).describe("Length of the device code to be generated. Default is 40 characters."),
-	userCodeLength: z.number().int().positive().default(8).describe("Length of the user code to be generated. Default is 8 characters."),
+	deviceCodeLength: z.number().int().positive().max(191).default(40).describe(`Length of the device code to be generated. Must be at most 191 characters. Default is 40 characters.`),
+	userCodeLength: z.number().int().positive().max(191).default(8).describe(`Length of the user code to be generated. Must be at most 191 characters. Default is 8 characters.`),
 	generateDeviceCode: z.custom((val) => typeof val === "function", { message: "generateDeviceCode must be a function that returns a string or a promise that resolves to a string." }).optional().describe("Function to generate a device code. If not provided, a default random string generator will be used."),
 	generateUserCode: z.custom((val) => typeof val === "function", { message: "generateUserCode must be a function that returns a string or a promise that resolves to a string." }).optional().describe("Function to generate a user code. If not provided, a default random string generator will be used."),
 	validateClient: z.custom((val) => typeof val === "function", { message: "validateClient must be a function that returns a boolean or a promise that resolves to a boolean." }).optional().describe("Function to validate the client ID. If not provided, no validation will be performed."),

package/dist/plugins/device-authorization/routes.mjs

@@ -7,30 +7,71 @@ import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/device-authorization/routes.ts
 const defaultCharset = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+function validateGeneratedCode(code, label) {
+	if (typeof code !== "string") throw new APIError("BAD_REQUEST", {
+		error: "invalid_request",
+		error_description: `Generated ${label} code must be a string`
+	});
+	if (Array.from(code).length > 191) throw new APIError("BAD_REQUEST", {
+		error: "invalid_request",
+		error_description: `Generated ${label} code must be at most 191 characters`
+	});
+	return code;
+}
+function serializeResource(resource) {
+	return typeof resource === "string" ? resource : JSON.stringify(resource);
+}
+function parseStoredResource(resource) {
+	if (!resource) return void 0;
+	if (!resource.startsWith("[")) return resource;
+	try {
+		const parsed = JSON.parse(resource);
+		if (Array.isArray(parsed) && parsed.every((value) => typeof value === "string")) return parsed;
+	} catch {}
+	return resource;
+}
+async function extractFormResources(request) {
+	const contentType = request?.headers.get("content-type")?.toLowerCase() ?? "";
+	if (!request || !contentType.includes("application/x-www-form-urlencoded")) return;
+	try {
+		const params = new URLSearchParams(await request.text());
+		if (!params.has("resource")) return void 0;
+		return params.getAll("resource").filter(Boolean);
+	} catch {
+		return;
+	}
+}
 const deviceCodeBodySchema = z.object({
 	client_id: z.string().meta({ description: "The client ID of the application" }),
 	user_id: z.string().meta({ description: "The user ID to which the device code should be pre-bound." }).optional(),
-	scope: z.string().meta({ description: "Space-separated list of scopes" }).optional()
+	scope: z.string().meta({ description: "Space-separated list of scopes" }).optional(),
+	resource: z.union([z.string(), z.array(z.string())]).meta({ description: "RFC 8707 resource indicator(s) to bind to this authorization request" }).optional()
 });
 const deviceCodeErrorSchema = z.object({
-	error: z.enum(["invalid_request", "invalid_client"]).meta({ description: "Error code" }),
+	error: z.enum([
+		"invalid_request",
+		"invalid_client",
+		"unauthorized_client",
+		"invalid_scope",
+		"invalid_target"
+	]).meta({ description: "Error code" }),
 	error_description: z.string().meta({ description: "Detailed error description" })
 });
 const deviceCode = (opts) => {
 	const generateDeviceCode = async () => {
-		if (opts.generateDeviceCode) return opts.generateDeviceCode();
-		return defaultGenerateDeviceCode(opts.deviceCodeLength);
+		return validateGeneratedCode(opts.generateDeviceCode ? await opts.generateDeviceCode() : defaultGenerateDeviceCode(opts.deviceCodeLength), "device");
 	};
 	const generateUserCode = async () => {
-		if (opts.generateUserCode) return opts.generateUserCode();
-		return defaultGenerateUserCode(opts.userCodeLength);
+		return validateGeneratedCode(opts.generateUserCode ? await opts.generateUserCode() : defaultGenerateUserCode(opts.userCodeLength), "user");
 	};
 	return createAuthEndpoint("/device/code", {
 		method: "POST",
+		cloneRequest: true,
 		body: deviceCodeBodySchema,
 		error: deviceCodeErrorSchema,
 		metadata: {
 			noStore: true,
+			allowedMediaTypes: ["application/json", "application/x-www-form-urlencoded"],
 			openapi: {
 				description: `Request a device and user code
 
@@ -77,7 +118,13 @@ Follow [rfc8628#section-3.2](https://datatracker.ietf.org/doc/html/rfc8628#secti
 							properties: {
 								error: {
 									type: "string",
-									enum: ["invalid_request", "invalid_client"]
+									enum: [
+										"invalid_request",
+										"invalid_client",
+										"unauthorized_client",
+										"invalid_scope",
+										"invalid_target"
+									]
 								},
 								error_description: { type: "string" }
 							}
@@ -87,13 +134,15 @@ Follow [rfc8628#section-3.2](https://datatracker.ietf.org/doc/html/rfc8628#secti
 			}
 		}
 	}, async (ctx) => {
+		const formResources = await extractFormResources(ctx.request);
+		if (formResources) ctx.body.resource = formResources.length === 1 ? formResources[0] : formResources;
 		if (opts.validateClient) {
 			if (!await opts.validateClient(ctx.body.client_id)) throw new APIError("BAD_REQUEST", {
 				error: "invalid_client",
 				error_description: "Invalid client ID"
 			});
 		}
-		if (opts.onDeviceAuthRequest) await opts.onDeviceAuthRequest(ctx.body.client_id, ctx.body.scope);
+		if (opts.onDeviceAuthRequest) await opts.onDeviceAuthRequest(ctx.body.client_id, ctx.body.scope, ctx.body.resource);
 		const deviceCode = await generateDeviceCode();
 		const userCode = await generateUserCode();
 		const expiresIn = ms(opts.expiresIn);
@@ -108,7 +157,8 @@ Follow [rfc8628#section-3.2](https://datatracker.ietf.org/doc/html/rfc8628#secti
 				status: "pending",
 				pollingInterval: ms(opts.interval),
 				clientId: ctx.body.client_id,
-				scope: ctx.body.scope
+				scope: ctx.body.scope,
+				resource: ctx.body.resource ? serializeResource(ctx.body.resource) : null
 			}
 		});
 		const { verificationUri, verificationUriComplete } = buildVerificationUris(opts.verificationUri, ctx.context.baseURL, userCode);
@@ -331,6 +381,21 @@ const deviceVerify = createAuthEndpoint("/device", {
 							"denied"
 						],
 						description: "Current status of the device authorization"
+					},
+					client_id: {
+						type: "string",
+						description: "The client requesting authorization, returned only to the authenticated user who owns this request"
+					},
+					scope: {
+						type: "string",
+						description: "The requested scopes, returned only to the authenticated user who owns this request"
+					},
+					resource: {
+						oneOf: [{ type: "string" }, {
+							type: "array",
+							items: { type: "string" }
+						}],
+						description: "The requested resource indicators, returned only to the authenticated user who owns this request"
 					}
 				}
 			} } }
@@ -377,9 +442,15 @@ const deviceVerify = createAuthEndpoint("/device", {
 			set: { userId: session.user.id }
 		})) deviceCodeRecord.userId = session.user.id;
 	}
+	const canReviewRequest = session?.user.id !== void 0 && deviceCodeRecord.userId === session.user.id;
 	return ctx.json({
 		user_code,
-		status: deviceCodeRecord.status
+		status: deviceCodeRecord.status,
+		...canReviewRequest ? {
+			client_id: deviceCodeRecord.clientId,
+			scope: deviceCodeRecord.scope,
+			resource: parseStoredResource(deviceCodeRecord.resource)
+		} : {}
 	});
 });
 const deviceApprove = createAuthEndpoint("/device/approve", {

package/dist/plugins/device-authorization/schema.mjs

@@ -1,43 +1,50 @@
 import * as z from "zod";
 //#region src/plugins/device-authorization/schema.ts
-const schema = { deviceCode: { fields: {
-	deviceCode: {
-		type: "string",
-		required: true
-	},
-	userCode: {
-		type: "string",
-		required: true
-	},
-	userId: {
-		type: "string",
-		required: false
-	},
-	expiresAt: {
-		type: "date",
-		required: true
-	},
-	status: {
-		type: "string",
-		required: true
-	},
-	lastPolledAt: {
-		type: "date",
-		required: false
-	},
-	pollingInterval: {
-		type: "number",
-		required: false
-	},
-	clientId: {
-		type: "string",
-		required: false
-	},
-	scope: {
-		type: "string",
-		required: false
-	}
-} } };
+const schema = { deviceCode: {
+	fields: {
+		deviceCode: {
+			type: "string",
+			required: true
+		},
+		userCode: {
+			type: "string",
+			required: true
+		},
+		userId: {
+			type: "string",
+			required: false
+		},
+		expiresAt: {
+			type: "date",
+			required: true
+		},
+		status: {
+			type: "string",
+			required: true
+		},
+		lastPolledAt: {
+			type: "date",
+			required: false
+		},
+		pollingInterval: {
+			type: "number",
+			required: false
+		},
+		clientId: {
+			type: "string",
+			required: false
+		},
+		scope: {
+			type: "string",
+			required: false
+		},
+		resource: {
+			type: "string",
+			required: false
+		}
+	},
+	indexes: [{ fields: ["deviceCode"] }, { fields: ["userCode"] }]
+} };
 z.object({
 	id: z.string(),
 	deviceCode: z.string(),
@@ -48,7 +55,8 @@ z.object({
 	lastPolledAt: z.date().optional(),
 	pollingInterval: z.number().optional(),
 	clientId: z.string().optional(),
-	scope: z.string().optional()
+	scope: z.string().optional(),
+	resource: z.string().optional()
 });
 //#endregion
 export { schema };

package/dist/plugins/generic-oauth/index.d.mts

@@ -24,7 +24,7 @@ declare module "@better-auth/core" {
  * Base type for OAuth provider options.
  * Extracts common fields from GenericOAuthConfig for provider helpers.
  */
-type BaseOAuthProviderOptions = Pick<GenericOAuthConfig, "clientId" | "clientSecret" | "tokenEndpointAuth" | "scopes" | "redirectURI" | "pkce" | "disableImplicitSignUp" | "disableSignUp" | "overrideUserInfo">;
+type BaseOAuthProviderOptions = Pick<GenericOAuthConfig, "clientId" | "clientSecret" | "tokenEndpointAuth" | "scopes" | "redirectURI" | "endSessionEndpoint" | "postLogoutRedirectURI" | "disableProviderLogout" | "pkce" | "disableImplicitSignUp" | "disableSignUp" | "overrideUserInfo">;
 /**
  * A generic OAuth plugin that registers any OAuth/OIDC provider
  * as a first-class social provider.

package/dist/plugins/generic-oauth/index.mjs

@@ -83,6 +83,7 @@ const genericOAuth = (options) => {
 				let authorizationUrl = c.authorizationUrl;
 				let tokenUrl = c.tokenUrl;
 				let userInfoUrl = c.userInfoUrl;
+				let endSessionEndpoint = c.endSessionEndpoint;
 				let issuer;
 				let isOidc = false;
 				let idTokenConfig;
@@ -96,6 +97,7 @@ const genericOAuth = (options) => {
 						authorizationUrl ??= discovered.authorization_endpoint;
 						tokenUrl ??= discovered.token_endpoint;
 						userInfoUrl ??= discovered.userinfo_endpoint;
+						endSessionEndpoint ??= discovered.end_session_endpoint;
 						issuer = discovered.issuer;
 						const signingAlgs = discovered.id_token_signing_alg_values_supported;
 						isOidc = Array.isArray(signingAlgs) && signingAlgs.length > 0;
@@ -116,6 +118,7 @@ const genericOAuth = (options) => {
 					} else if (!c.accountIssuer) throw new Error(`Provider "${c.providerId}": discovery returned no valid data. Provider initialization stopped to keep its account issuer stable.`);
 					else if (!authorizationUrl || !tokenUrl) ctx.logger.error(`Provider "${c.providerId}": discovery returned no data and no explicit endpoints configured. OAuth sign-in will fail for this provider.`);
 				}
+				if (c.requireIdTokenVerification && !idTokenConfig) throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
 				const tokenEndpointAuth = c.tokenEndpointAuth;
 				if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
 				if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
@@ -141,6 +144,25 @@ const genericOAuth = (options) => {
 					idToken: idTokenConfig,
 					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
 					allowIdpInitiated: c.allowIdpInitiated,
+					async createEndSessionURL(data) {
+						if (c.disableProviderLogout) return null;
+						if (!endSessionEndpoint) return null;
+						let url;
+						try {
+							url = new URL(endSessionEndpoint);
+						} catch {
+							return null;
+						}
+						if (data.idToken) url.searchParams.set("id_token_hint", data.idToken);
+						const configuredRedirectURI = data.postLogoutRedirectURI ?? c.postLogoutRedirectURI;
+						const postLogoutRedirectURI = configuredRedirectURI ? new URL(configuredRedirectURI, ctx.baseURL).toString() : void 0;
+						if (postLogoutRedirectURI) {
+							url.searchParams.set("post_logout_redirect_uri", postLogoutRedirectURI);
+							url.searchParams.set("client_id", c.clientId);
+							if (data.state) url.searchParams.set("state", data.state);
+						} else if (!data.idToken) url.searchParams.set("client_id", c.clientId);
+						return url;
+					},
 					createAuthorizationURL(data) {
 						if (!authorizationUrl) throw APIError.from("BAD_REQUEST", GENERIC_OAUTH_ERROR_CODES.INVALID_OAUTH_CONFIGURATION);
 						return createAuthorizationURL({

package/dist/plugins/generic-oauth/providers/auth0.mjs

@@ -38,6 +38,9 @@ function auth0(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/gumroad.mjs

@@ -48,6 +48,9 @@ function gumroad(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? ["view_profile"],
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/hubspot.mjs

@@ -47,6 +47,9 @@ function hubspot(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		authentication: "post",
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,

package/dist/plugins/generic-oauth/providers/keycloak.mjs

@@ -37,6 +37,9 @@ function keycloak(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/line.mjs

@@ -80,6 +80,9 @@ function line(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.mjs

@@ -1,5 +1,9 @@
+import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/generic-oauth/providers/microsoft-entra-id.ts
+function getMicrosoftProfileName(profile) {
+	return profile.name ?? (`${profile.given_name ?? profile.givenname ?? ""} ${profile.family_name ?? profile.familyname ?? ""}`.trim() || void 0);
+}
 /**
 * Microsoft Entra ID (Azure AD) OAuth provider helper
 *
@@ -32,23 +36,42 @@ function microsoftEntraId(options) {
 	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(tenantId)) throw new Error("The generic microsoftEntraId helper requires a concrete Microsoft Entra tenant GUID. Use the built-in Microsoft provider for common, organizations, or consumers.");
 	const authorizationUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`;
 	const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
+	const discoveryUrl = `https://login.microsoftonline.com/${tenantId}/v2.0/.well-known/openid-configuration`;
 	const userInfoUrl = "https://graph.microsoft.com/oidc/userinfo";
-	const tenantIssuer = `https://login.microsoftonline.com/${tenantId}/v2.0`;
 	const getUserInfo = async (tokens) => {
+		if (!tokens.idToken) return null;
+		let tokenProfile;
+		try {
+			tokenProfile = decodeJwt(tokens.idToken);
+		} catch {
+			return null;
+		}
+		if (!(typeof tokenProfile.oid === "string" && tokenProfile.oid.trim().length > 0 ? tokenProfile.oid : void 0)) return null;
+		const tokenUserInfo = {
+			...tokenProfile,
+			name: getMicrosoftProfileName(tokenProfile),
+			email: tokenProfile.email ?? tokenProfile.preferred_username ?? void 0,
+			image: tokenProfile.picture,
+			emailVerified: tokenProfile.email_verified ?? false
+		};
+		if (!tokens.accessToken) return tokenUserInfo;
 		const { data: profile, error } = await betterFetch(userInfoUrl, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
-		if (error || !profile) return null;
+		if (error || !profile) return tokenUserInfo;
+		if (typeof tokenProfile.sub !== "string" || profile.sub !== tokenProfile.sub) return tokenUserInfo;
 		return {
-			sub: profile.sub,
-			name: profile.name ?? (`${profile.given_name ?? ""} ${profile.family_name ?? ""}`.trim() || void 0),
-			email: profile.email ?? profile.preferred_username ?? void 0,
-			image: profile.picture,
-			emailVerified: profile.email_verified ?? false
+			...profile,
+			...tokenProfile,
+			name: getMicrosoftProfileName(tokenProfile) ?? getMicrosoftProfileName(profile),
+			email: tokenProfile.email ?? profile.email ?? tokenProfile.preferred_username ?? profile.preferred_username ?? void 0,
+			image: tokenProfile.picture ?? profile.picture,
+			emailVerified: tokenProfile.email_verified ?? profile.email_verified ?? false
 		};
 	};
 	return {
 		providerId: "microsoft-entra-id",
-		accountSubject: ({ profile }) => profile.sub ?? "",
-		accountIssuer: tenantIssuer,
+		accountSubject: ({ profile }) => typeof profile.oid === "string" ? profile.oid : "",
+		discoveryUrl,
+		requireIdTokenVerification: true,
 		authorizationUrl,
 		tokenUrl,
 		userInfoUrl,
@@ -57,6 +80,9 @@ function microsoftEntraId(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/okta.mjs

@@ -37,6 +37,9 @@ function okta(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/patreon.mjs

@@ -47,6 +47,9 @@ function patreon(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/slack.mjs

@@ -50,6 +50,9 @@ function slack(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/providers/yandex.mjs

@@ -53,6 +53,9 @@ function yandex(options) {
 		tokenEndpointAuth: options.tokenEndpointAuth,
 		scopes: options.scopes ?? defaultScopes,
 		redirectURI: options.redirectURI,
+		endSessionEndpoint: options.endSessionEndpoint,
+		postLogoutRedirectURI: options.postLogoutRedirectURI,
+		disableProviderLogout: options.disableProviderLogout,
 		pkce: options.pkce,
 		disableImplicitSignUp: options.disableImplicitSignUp,
 		disableSignUp: options.disableSignUp,

package/dist/plugins/generic-oauth/types.d.mts

@@ -49,6 +49,17 @@ interface GenericOAuthConfig<ID extends string = string> {
    * If provided, the authorization and token endpoints will be fetched from this URL.
    */
   discoveryUrl?: string | undefined;
+  /**
+   * Require discovery to provide the issuer and JWKS metadata needed to verify
+   * ID tokens before this provider is registered.
+   *
+   * Enable this when provider identity is derived from ID-token claims. This
+   * prevents an unavailable or incomplete discovery document from silently
+   * downgrading the provider to unverified token decoding.
+   *
+   * @default false
+   */
+  requireIdTokenVerification?: boolean | undefined;
   /**
    * URL for the authorization endpoint.
    * Optional if using discoveryUrl.
@@ -64,6 +75,22 @@ interface GenericOAuthConfig<ID extends string = string> {
    * Optional if using discoveryUrl.
    */
   userInfoUrl?: string | undefined;
+  /**
+   * URL for the OIDC RP-Initiated Logout endpoint.
+   * Optional if using discoveryUrl and the discovery document includes
+   * `end_session_endpoint`.
+   */
+  endSessionEndpoint?: string | undefined;
+  /**
+   * URL the provider should redirect back to after logout.
+   * This must also be registered with the provider as a post-logout redirect URI.
+   */
+  postLogoutRedirectURI?: string | undefined;
+  /**
+   * Disable automatic provider logout on `authClient.signOut()`.
+   * When set, sign out only clears the Better Auth session.
+   */
+  disableProviderLogout?: boolean | undefined;
   /** OAuth client ID */
   clientId: string;
   /** OAuth client secret */

package/dist/plugins/jwt/adapter.mjs

@@ -1,15 +1,16 @@
+import { getCurrentAdapter } from "@better-auth/core/context";
 //#region src/plugins/jwt/adapter.ts
-const getJwksAdapter = (adapter, options) => {
+const getJwksAdapter = (baseAdapter, options) => {
 	return {
 		getAllKeys: async (ctx) => {
 			if (options?.adapter?.getJwks) return await options.adapter.getJwks(ctx);
-			return await adapter.findMany({ model: "jwks" });
+			return await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" });
 		},
 		getLatestKey: async (ctx) => {
 			const now = /* @__PURE__ */ new Date();
 			const isLive = (k) => !k.expiresAt || k.expiresAt > now;
 			if (options?.adapter?.getJwks) return (await options.adapter.getJwks(ctx))?.filter(isLive).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
-			return (await adapter.findMany({ model: "jwks" }))?.filter(isLive).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
+			return (await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" }))?.filter(isLive).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
 		},
 		/**
 		* Look up a key by its `id` (matches the JWS `kid` header). Returns
@@ -21,7 +22,7 @@ const getJwksAdapter = (adapter, options) => {
 		*/
 		getKeyById: async (ctx, id) => {
 			if (options?.adapter?.getJwks) return (await options.adapter.getJwks(ctx))?.find((k) => k.id === id);
-			return await adapter.findOne({
+			return await (await getCurrentAdapter(baseAdapter)).findOne({
 				model: "jwks",
 				where: [{
 					field: "id",
@@ -45,7 +46,7 @@ const getJwksAdapter = (adapter, options) => {
 		* rationale.
 		*/
 		getLatestKeyByAlg: async (ctx, alg) => {
-			const candidates = options?.adapter?.getJwks ? await options.adapter.getJwks(ctx) : await adapter.findMany({ model: "jwks" });
+			const candidates = options?.adapter?.getJwks ? await options.adapter.getJwks(ctx) : await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" });
 			if (!candidates) return void 0;
 			const configAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
 			const now = /* @__PURE__ */ new Date();
@@ -53,7 +54,7 @@ const getJwksAdapter = (adapter, options) => {
 		},
 		createJwk: async (ctx, webKey) => {
 			if (options?.adapter?.createJwk) return await options.adapter.createJwk(webKey, ctx);
-			return await adapter.create({
+			return await (await getCurrentAdapter(baseAdapter)).create({
 				model: "jwks",
 				data: {
 					...webKey,

package/dist/plugins/one-tap/client.d.mts

@@ -1,4 +1,5 @@
 import { ClientFetchOption } from "@better-auth/core";
+import { BetterFetch } from "@better-fetch/fetch";
 //#region src/plugins/one-tap/client.d.ts
 declare global {
   interface Window {
@@ -162,10 +163,10 @@ declare const oneTapClient: (options: GoogleOneTapOptions) => {
       onResponse(ctx: import("@better-fetch/fetch").ResponseContext): Promise<void>;
     };
   }[];
-  getActions: ($fetch: import("@better-fetch/fetch").BetterFetch, _: import("@better-auth/core").ClientStore) => {
+  getActions: ($fetch: BetterFetch, _: import("@better-auth/core").ClientStore) => {
     oneTap: (opts?: GoogleOneTapActionOptions | undefined, fetchOptions?: ClientFetchOption | undefined) => Promise<void>;
   };
-  getAtoms($fetch: import("@better-fetch/fetch").BetterFetch): {};
+  getAtoms($fetch: BetterFetch): {};
 };
 //#endregion
 export { GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, oneTapClient };

package/dist/test-utils/http-test-instance.mjs

@@ -88,7 +88,8 @@ async function getHttpTestInstance(options, config) {
 			clientOptions: config?.clientOptions,
 			disableTestUser: config?.disableTestUser,
 			testUser: config?.testUser,
-			testWith: config?.testWith
+			testWith: config?.testWith,
+			transaction: config?.transaction
 		});
 		server.setRequestHandler(config?.handler ? config.handler(instance.auth) : toNodeHandler(instance.auth.handler));
 		return {

package/dist/test-utils/test-instance.d.mts

@@ -15,6 +15,7 @@ declare function getTestInstance<O extends Partial<BetterAuthOptions>, C extends
   disableTestUser?: boolean;
   testUser?: Partial<User>;
   testWith?: "sqlite" | "postgres" | "mongodb" | "mysql";
+  transaction?: boolean;
 } | undefined): Promise<{
   auth: Auth<O>;
   client: AuthClient<(C extends undefined ? {} : C) & {

package/dist/test-utils/test-instance.mjs

@@ -67,10 +67,12 @@ async function getTestInstance(options, config) {
 		secret: "better-auth-secret-that-is-long-enough-for-validation-test",
 		database: testWith === "postgres" ? {
 			db: await getPostgres(),
-			type: "postgres"
+			type: "postgres",
+			transaction: config?.transaction
 		} : testWith === "mongodb" ? await Promise.all([mongodbClient(), await import("../adapters/mongodb-adapter/index.mjs")]).then(([db, { mongodbAdapter }]) => mongodbAdapter(db)) : testWith === "mysql" ? {
 			db: await getMysql(),
-			type: "mysql"
+			type: "mysql",
+			transaction: config?.transaction
 		} : await getSqlite(),
 		emailAndPassword: { enabled: true },
 		rateLimit: { enabled: false },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.0-rc.2",
+  "version": "1.7.0-rc.3",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -465,13 +465,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.7.0-rc.2",
-    "@better-auth/drizzle-adapter": "1.7.0-rc.2",
-    "@better-auth/kysely-adapter": "1.7.0-rc.2",
-    "@better-auth/memory-adapter": "1.7.0-rc.2",
-    "@better-auth/mongo-adapter": "1.7.0-rc.2",
-    "@better-auth/prisma-adapter": "1.7.0-rc.2",
-    "@better-auth/telemetry": "1.7.0-rc.2"
+    "@better-auth/core": "1.7.0-rc.3",
+    "@better-auth/drizzle-adapter": "1.7.0-rc.3",
+    "@better-auth/kysely-adapter": "1.7.0-rc.3",
+    "@better-auth/memory-adapter": "1.7.0-rc.3",
+    "@better-auth/mongo-adapter": "1.7.0-rc.3",
+    "@better-auth/prisma-adapter": "1.7.0-rc.3",
+    "@better-auth/telemetry": "1.7.0-rc.3"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",