better-auth 1.7.1 → 1.7.3

package/dist/auth/trusted-origins.mjs

@@ -1,6 +1,9 @@
 import { wildcardMatch } from "../utils/wildcard.mjs";
 import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
 //#region src/auth/trusted-origins.ts
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
+const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
+const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a
 * path-pinned pattern cannot be bypassed with traversal: e.g.
@@ -31,6 +34,7 @@ const normalizePath = (path) => {
 * a path-pinned pattern.
 */
 const parseCustomSchemeOrigin = (value) => {
+	if (CONTROL_CHARACTER_PATTERN.test(value)) return null;
 	const schemeEnd = value.indexOf(":");
 	if (schemeEnd <= 0) return null;
 	const scheme = value.slice(0, schemeEnd).toLowerCase();
@@ -47,7 +51,8 @@ const parseCustomSchemeOrigin = (value) => {
 			rest = rest.slice(authorityEnd);
 		}
 	}
-	const path = normalizePath(rest.replace(/[?#].*$/, ""));
+	const pathEnd = rest.search(/[?#]/);
+	const path = normalizePath(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
 	return {
 		scheme,
 		authority: authority.toLowerCase(),
@@ -55,6 +60,23 @@ const parseCustomSchemeOrigin = (value) => {
 	};
 };
 /**
+* Validates root-relative redirects against ambiguous browser and router parsing.
+*
+* @see https://www.rfc-editor.org/rfc/rfc3986.html#section-4.2
+* @see https://url.spec.whatwg.org/#concept-basic-url-parser
+*/
+const isSafeRelativeURL = (value) => {
+	if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\") || CONTROL_CHARACTER_PATTERN.test(value)) return false;
+	const pathEnd = value.search(/[?#]/);
+	const path = pathEnd === -1 ? value : value.slice(0, pathEnd);
+	if (ENCODED_PATH_SEPARATOR_PATTERN.test(path)) return false;
+	try {
+		return new URL(value, RELATIVE_URL_PARSER_ORIGIN).origin === RELATIVE_URL_PARSER_ORIGIN;
+	} catch {
+		return false;
+	}
+};
+/**
 * Matches the given url against an origin or origin pattern
 * See "options.trustedOrigins" for details of supported patterns
 *
@@ -64,10 +86,7 @@ const parseCustomSchemeOrigin = (value) => {
 * @returns {boolean} true if the URL matches the origin pattern, false otherwise.
 */
 const matchesOriginPattern = (url, pattern, settings) => {
-	if (url.startsWith("/")) {
-		if (settings?.allowRelativePaths) return url.startsWith("/") && /^\/(?!\/|\\|%2f|%5c)[\w\-.\+/@]*(?:\?[\w\-.\+/=&%@]*)?$/.test(url);
-		return false;
-	}
+	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
 	if (pattern.includes("*") || pattern.includes("?")) {
 		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
 		const host = getHost(url);

package/dist/client/config.d.mts

@@ -1,5 +1,6 @@
 import { SessionData } from "./session-atom.mjs";
 import { BetterAuthClientOptions, ClientAtomListener } from "@better-auth/core";
+import * as _$nanostores from "nanostores";
 import { WritableAtom } from "nanostores";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
@@ -11,6 +12,7 @@ declare const getClientConfig: (options?: BetterAuthClientOptions | undefined, l
   pluginPathMethods: Record<string, "GET" | "POST">;
   atomListeners: ClientAtomListener[];
   hydrateSession: (sessionData: SessionData | null) => void;
+  $sessionSignal: _$nanostores.PreinitializedWritableAtom<boolean> & object;
   $fetch: _$_better_fetch_fetch0.BetterFetch<{
     plugins: (_$_better_fetch_fetch0.BetterFetchPlugin<Record<string, any>> | {
       id: string;

package/dist/client/config.mjs

@@ -104,6 +104,7 @@ const getClientConfig = (options, loadEnv) => {
 		pluginPathMethods,
 		atomListeners,
 		hydrateSession,
+		$sessionSignal,
 		$fetch,
 		$store
 	};

package/dist/client/lynx/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Lynx client returned by `createAuthClient`.
  */
 type LynxAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => {
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/react/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * React client returned by `createAuthClient`.
  */
 type ReactAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => {
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/solid/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Solid client returned by `createAuthClient`.
  */
 type SolidAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => Accessor<{
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/svelte/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Svelte client returned by `createAuthClient`.
  */
 type SvelteAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => Atom<{
     data: ClientSession<Option>;
     error: BetterFetchError | null;

package/dist/client/vanilla.d.mts

@@ -20,7 +20,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Client returned by `createAuthClient`.
  */
 type AuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: Atom<{
     data: ClientSession<Option>;
     error: BetterFetchError | null;

package/dist/client/vue/index.d.mts

@@ -4,7 +4,7 @@ import { getClientConfig } from "../config.mjs";
 import { BetterAuthClientOptions } from "@better-auth/core";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
 import { BetterFetchError, BetterFetchResponse } from "@better-fetch/fetch";
-import { DeepReadonly, Ref } from "vue";
+import { DeepReadonly, Ref, WatchSource } from "vue";
 export * from "nanostores";
 export * from "@better-fetch/fetch";
 
@@ -18,32 +18,43 @@ type ClientConfig = ReturnType<typeof getClientConfig>;
 type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Option> extends {
   getSession: () => Promise<infer Res>;
 } ? Res extends BetterFetchResponse<infer S> ? S : Res : never;
-type VueUseSession<Option extends BetterAuthClientOptions> = {
-  (): DeepReadonly<Ref<{
-    data: ClientSession<Option>;
-    isPending: boolean;
-    isRefetching: boolean;
-    error: BetterFetchError | null;
-    refetch: (queryParams?: {
-      query?: SessionQueryParams;
-    } | undefined) => Promise<void>;
-  }>>;
-  <F extends (...args: any) => any>(useFetch: F): Promise<{
-    data: Ref<ClientSession<Option>>;
-    isPending: false;
-    error: Ref<{
-      message?: string | undefined;
-      status: number;
-      statusText: string;
-    }>;
+/**
+ * Minimal Nuxt-compatible fetch contract for `useSession(useFetch)`.
+ * Compatibility with Nuxt's `useFetch` and `UseFetchOptions` is checked by the Nuxt fixture type test.
+ */
+type SessionFetch = (url: string, options: {
+  headers?: HeadersInit;
+  key: string;
+  watch: WatchSource<unknown>[];
+}) => Promise<{
+  data: Ref<unknown>;
+  error: Ref<unknown>;
+}>;
+type VueSessionState<Option extends BetterAuthClientOptions> = DeepReadonly<Ref<{
+  data: ClientSession<Option>;
+  isPending: boolean;
+  isRefetching: boolean;
+  error: BetterFetchError | null;
+  refetch: (queryParams?: {
+    query?: SessionQueryParams;
+  } | undefined) => Promise<void>;
+}>>;
+type SessionFetchResult<Option extends BetterAuthClientOptions> = {
+  data: Ref<ClientSession<Option>>;
+  isPending: false;
+  error: Ref<{
+    message?: string | undefined;
+    status: number;
+    statusText: string;
   }>;
 };
 /**
  * Vue client returned by `createAuthClient`.
  */
 type VueAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
-  useSession: VueUseSession<Option>;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
+  useSession(): VueSessionState<Option>;
+  useSession(useFetch: SessionFetch): Promise<SessionFetchResult<Option>>;
   $Infer: {
     Session: NonNullable<ClientSession<Option>>;
   };

package/dist/client/vue/index.mjs

@@ -6,18 +6,36 @@ import { capitalizeFirstLetter } from "@better-auth/core/utils/string";
 function getAtomKey(str) {
 	return `use${capitalizeFirstLetter(str)}`;
 }
+/** Preserves standard `HeadersInit` values and removes undefined record entries. */
+function toHeadersInit(headers) {
+	if (!headers) return void 0;
+	if (headers instanceof Headers || Array.isArray(headers)) return headers;
+	const normalizedHeaders = {};
+	for (const [name, value] of Object.entries(headers)) if (value !== void 0) normalizedHeaders[name] = value;
+	return normalizedHeaders;
+}
 function createAuthClient(options) {
-	const { baseURL, pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $fetch, $store, atomListeners } = getClientConfig(options, false);
+	const { baseURL, pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $sessionSignal, $fetch, $store, atomListeners } = getClientConfig(options, false);
+	const sessionCacheKey = [
+		"better-auth",
+		"session",
+		options?.baseURL || "inferred",
+		options?.basePath ?? "/api/auth"
+	].join(":");
 	const resolvedHooks = {};
 	for (const [key, value] of Object.entries(pluginsAtoms)) resolvedHooks[getAtomKey(key)] = () => useStore(value);
 	function useSession(useFetch) {
 		if (useFetch) {
-			const ref = useStore(pluginsAtoms.$sessionSignal);
-			return useFetch(`${baseURL}/get-session`, { ref }).then((res) => {
+			const sessionSignal = useStore($sessionSignal);
+			return useFetch(`${baseURL}/get-session`, {
+				headers: toHeadersInit(options?.fetchOptions?.headers),
+				key: sessionCacheKey,
+				watch: [sessionSignal]
+			}).then((result) => {
 				return {
-					data: res.data,
+					data: result.data,
 					isPending: false,
-					error: res.error
+					error: result.error
 				};
 			});
 		}

package/dist/context/create-context.mjs

@@ -15,6 +15,7 @@ import { getAuthTables } from "@better-auth/core/db";
 import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
+import { schemaCheckFor } from "@better-auth/core/db/internal";
 import { socialProviders } from "@better-auth/core/social-providers";
 import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
 import { createTelemetry } from "@better-auth/telemetry";
@@ -227,6 +228,7 @@ Most of the features of Better Auth will not work correctly.`);
 	};
 	const initOrPromise = runPluginInit(ctx);
 	if (isPromise(initOrPromise)) await initOrPromise;
+	ctx.checkSchema = schemaCheckFor(ctx.adapter);
 	return ctx;
 }
 //#endregion

package/dist/cookies/cache.mjs

@@ -1,4 +1,5 @@
 import { sessionSchema, userSchema } from "@better-auth/core/db";
+import { logger } from "@better-auth/core/env";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import * as z from "zod";
 //#region src/cookies/cache.ts
@@ -14,8 +15,15 @@ const compactCookieCacheSchema = z.object({
 	signature: z.string()
 });
 function parseCookieCachePayload(value) {
-	const result = cookieCachePayloadSchema.safeParse(safeJSONParse(value));
-	return result.success ? result.data : null;
+	const parsed = safeJSONParse(value);
+	if (parsed === null) return null;
+	const result = cookieCachePayloadSchema.safeParse(parsed);
+	if (result.success) return result.data;
+	logger.warn("Cookie cache payload failed schema validation", { issues: result.error.issues.map(({ code, path }) => ({
+		code,
+		path
+	})) });
+	return null;
 }
 function parseCompactCookieCache(value) {
 	const result = compactCookieCacheSchema.safeParse(value);

package/dist/cookies/session-store.d.mts

@@ -18,7 +18,6 @@ declare function getAccountCookie(c: GenericEndpointContext): Promise<{
   createdAt: Date;
   updatedAt: Date;
   providerId: string;
-  issuer: string;
   accountId: string;
   userId: string;
   accessToken?: string | null | undefined;

package/dist/cookies/session-store.mjs

@@ -26,13 +26,24 @@ const MAX_COOKIE_CHUNKS = 100;
 function getMaxCookieValueSize(name, options) {
 	return MAX_COOKIE_SIZE - serializeCookie(name, "", { ...options }).length;
 }
+function parseCookieChunkIndex(cookieName, name) {
+	const prefix = `${cookieName}.`;
+	if (!name.startsWith(prefix)) return null;
+	const suffix = name.slice(prefix.length);
+	const index = Number(suffix);
+	if (!Number.isSafeInteger(index) || index < 0 || String(index) !== suffix) return null;
+	return index;
+}
 /**
 * Read all existing chunks from cookies
 */
 function readExistingChunks(cookieName, ctx) {
 	const chunks = {};
 	const cookies = parseCookies(ctx.headers?.get("cookie") || "");
-	for (const [name, value] of cookies) if (name.startsWith(cookieName)) chunks[name] = value;
+	for (const [name, value] of cookies) {
+		if (name !== cookieName && parseCookieChunkIndex(cookieName, name) === null) continue;
+		chunks[name] = value;
+	}
 	return chunks;
 }
 /**
@@ -128,10 +139,10 @@ function getChunkedCookie(ctx, cookieName) {
 	const chunks = [];
 	const cookieHeader = ctx.headers?.get("cookie");
 	if (!cookieHeader) return null;
-	for (const [name, val] of parseCookies(cookieHeader)) if (name.startsWith(cookieName + ".")) {
-		const indexStr = name.split(".").at(-1);
-		const index = parseInt(indexStr || "0", 10);
-		if (!isNaN(index)) chunks.push({
+	for (const [name, val] of parseCookies(cookieHeader)) {
+		const index = parseCookieChunkIndex(cookieName, name);
+		if (index === null) continue;
+		chunks.push({
 			index,
 			value: val
 		});

package/dist/db/adapter-kysely.mjs

@@ -3,10 +3,9 @@ import { BetterAuthError } from "@better-auth/core/error";
 //#region src/db/adapter-kysely.ts
 async function getAdapter(options) {
 	return getBaseAdapter(options, async (opts) => {
-		const { createKyselyAdapter } = await import("../adapters/kysely-adapter/index.mjs");
+		const { createKyselyAdapter, kyselyAdapter } = await import("../adapters/kysely-adapter/index.mjs");
 		const { kysely, databaseType, transaction } = await createKyselyAdapter(opts);
 		if (!kysely) throw new BetterAuthError("Failed to initialize database adapter");
-		const { kyselyAdapter } = await import("../adapters/kysely-adapter/index.mjs");
 		return kyselyAdapter(kysely, {
 			type: databaseType || "sqlite",
 			debugLogs: opts.database && "debugLogs" in opts.database ? opts.database.debugLogs : false,

package/dist/db/get-migration.d.mts

@@ -48,6 +48,7 @@ declare function getMigrations(config: BetterAuthOptions, {
     name: string;
   }[];
   unsafeChanges: string[];
+  schemaProblems: string[];
   runMigrations: () => Promise<void>;
   compileMigrations: () => Promise<string>;
 }>;

package/dist/db/get-migration.mjs

@@ -2,9 +2,9 @@ import { getSchema } from "./get-schema.mjs";
 import { getAuthTables } from "@better-auth/core/db";
 import { createLogger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
-import { createKyselyAdapter } from "@better-auth/kysely-adapter";
+import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
 import { initGetFieldName, initGetModelName } from "@better-auth/core/db/adapter";
-import { getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey } from "@better-auth/core/db/internal";
+import { diffSchema, formatSchemaFinding, getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, invalidateSchemaChecks } from "@better-auth/core/db/internal";
 import { sql } from "kysely";
 //#region src/db/get-migration.ts
 const map = {
@@ -103,7 +103,20 @@ function databaseValueIsTrue(value) {
 	if (typeof value === "number") return value !== 0;
 	return value === "1" || value?.toLowerCase() === "true" || value === "t";
 }
-async function getDatabaseIndexes(db, dbType, schemaName) {
+function toDatabaseIndexMap(indexes) {
+	return new Map(indexes.map((index) => {
+		const columns = [...index.columns].sort((left, right) => left.position - right.position);
+		return [createDatabaseIndexKey(index.table, index.name), {
+			columns: columns.flatMap((column) => column.name === null ? [] : [column.name]),
+			name: index.name,
+			table: index.table,
+			unique: index.unique,
+			validFullColumns: index.valid && !index.partial && columns.length > 0 && columns.every((column) => column.name !== null && column.fullLength)
+		}];
+	}));
+}
+async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspectIndexes) {
+	if (introspectIndexes) return toDatabaseIndexMap(await introspectIndexes(tableNames));
 	let rows;
 	if (dbType === "sqlite") rows = (await sql`
 				SELECT
@@ -151,7 +164,8 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 					column_name AS columnName,
 					non_unique AS nonUnique,
 					seq_in_index AS columnPosition,
-					sub_part AS prefixLength
+					sub_part AS prefixLength,
+					COALESCE(LOWER(comment) = 'disabled', FALSE) AS isDisabled
 				FROM information_schema.statistics
 				WHERE table_schema = DATABASE()
 			`.execute(db)).rows;
@@ -180,7 +194,7 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 					AND indexes.name IS NOT NULL
 					AND index_columns.key_ordinal > 0
 			`.execute(db)).rows;
-	const indexRows = /* @__PURE__ */ new Map();
+	const indexMetadata = /* @__PURE__ */ new Map();
 	for (const row of rows) {
 		const table = row.tableName ?? row.table_name ?? row.TABLE_NAME ?? row.tablename ?? row.tbl_name;
 		const name = row.indexName ?? row.index_name ?? row.INDEX_NAME ?? row.name;
@@ -190,28 +204,29 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 		const nonUnique = row.nonUnique ?? row.non_unique ?? row.NON_UNIQUE;
 		const unique = nonUnique === void 0 ? databaseValueIsTrue(row.isUnique ?? row.is_unique) : !databaseValueIsTrue(nonUnique);
 		const position = Number(row.columnPosition ?? row.column_position ?? row.keyOrdinal ?? row.key_ordinal ?? row.ordinality ?? row.seqInIndex ?? row.seq_in_index ?? row.SEQ_IN_INDEX ?? row.seqno ?? 0);
-		const index = indexRows.get(key) ?? {
-			columns: [],
+		const indexColumn = {
+			fullLength: column !== void 0 && column !== null && (row.prefixLength === void 0 || row.prefixLength === null),
+			name: column ?? null,
+			position
+		};
+		const partial = databaseValueIsTrue(row.isPartial);
+		const valid = !databaseValueIsTrue(row.isDisabled) && !databaseValueIsTrue(row.isHypothetical) && (row.isValid === void 0 || databaseValueIsTrue(row.isValid));
+		const existing = indexMetadata.get(key);
+		indexMetadata.set(key, existing ? {
+			...existing,
+			columns: [...existing.columns, indexColumn],
+			partial: existing.partial || partial,
+			valid: existing.valid && valid
+		} : {
+			columns: [indexColumn],
 			name,
+			partial,
 			table,
 			unique,
-			validFullColumns: true
-		};
-		if (column) index.columns.push({
-			name: column,
-			position
+			valid
 		});
-		else index.validFullColumns = false;
-		if (databaseValueIsTrue(row.isPartial) || databaseValueIsTrue(row.isDisabled) || databaseValueIsTrue(row.isHypothetical) || row.isValid !== void 0 && !databaseValueIsTrue(row.isValid) || row.prefixLength !== void 0 && row.prefixLength !== null) index.validFullColumns = false;
-		indexRows.set(key, index);
 	}
-	return new Map([...indexRows].map(([key, index]) => [key, {
-		columns: index.columns.sort((left, right) => left.position - right.position).map((column) => column.name),
-		name: index.name,
-		table: index.table,
-		unique: index.unique,
-		validFullColumns: index.validFullColumns
-	}]));
+	return toDatabaseIndexMap([...indexMetadata.values()]);
 }
 async function getDatabaseColumnBounds(db, dbType, schemaName) {
 	if (dbType !== "mysql" && dbType !== "mssql") return /* @__PURE__ */ new Map();
@@ -278,7 +293,6 @@ function assertExistingTableIndexFits({ columnBounds, dbType, existingColumns, f
 	}
 	if (requiredBytes > byteBudget) throw new BetterAuthError(`Cannot create database index "${index.name}" on existing table "${table}" because its columns can exceed ${dbType === "mysql" ? "MySQL" : "SQL Server"}'s ${byteBudget}-byte index-key limit. Bound the indexed string columns to the generated schema lengths, resolve oversized values, then run the migration again.`);
 }
-const columnBackfillGuideUrl = "https://better-auth.com/docs/guides/1-7-upgrade-guide#account-identity-is-scoped-by-issuer";
 /**
 * Thrown when {@link getMigrations} refuses to add a required column with no
 * default value to a populated table. Distinct from the plain
@@ -305,27 +319,6 @@ function matchType(columnDataType, fieldType, dbType) {
 	return (Array.isArray(fieldType) ? types["string"].map((t) => t.toLowerCase()) : types[fieldType].map((t) => t.toLowerCase())).includes(normalize(columnDataType));
 }
 /**
-* Get the current PostgreSQL schema (search_path) for the database connection
-* Returns the first schema in the search_path, defaulting to 'public' if not found
-*/
-async function getPostgresSchema(db) {
-	try {
-		const result = await sql`SHOW search_path`.execute(db);
-		const searchPath = result.rows[0]?.search_path ?? result.rows[0]?.searchPath;
-		if (searchPath) return searchPath.split(",").map((s) => s.trim()).map((s) => s.replace(/^["']|["']$/g, "")).filter((s) => !s.startsWith("$") && !s.startsWith("\\$"))[0] || "public";
-	} catch {}
-	return "public";
-}
-async function getMssqlSchema(db) {
-	try {
-		return (await sql`
-			SELECT SCHEMA_NAME() AS "schemaName"
-		`.execute(db)).rows[0]?.schemaName || "dbo";
-	} catch {
-		return "dbo";
-	}
-}
-/**
 * Build the migration plan that `auth migrate` executes and `auth generate`
 * prints for the Kysely adapter.
 *
@@ -342,18 +335,13 @@ async function getMssqlSchema(db) {
 async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 	const betterAuthSchema = getSchema(config);
 	const authTables = getAuthTables(config);
-	const accountIssuer = authTables.account && {
-		table: authTables.account.modelName,
-		column: authTables.account.fields.issuer?.fieldName || "issuer"
-	};
-	const isAccountIssuerColumn = (table, column) => table === accountIssuer?.table && column === accountIssuer.column;
 	const logger = createLogger(config.logger);
 	const unsafeChanges = [];
 	const reportUnsafeChange = (message) => {
 		if (throwOnUnsafe) throw new UnsafeMigrationError(message);
 		unsafeChanges.push(message);
 	};
-	let { kysely: db, databaseType: dbType } = await createKyselyAdapter(config);
+	let { kysely: db, databaseType: dbType, introspectIndexes } = await createKyselyAdapter(config);
 	if (!dbType) {
 		logger.warn("Could not determine database type, defaulting to sqlite. Please provide a type in the database options to avoid this.");
 		dbType = "sqlite";
@@ -378,7 +366,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		}
 	} else if (dbType === "mssql") logger.debug(`SQL Server migration: Using schema '${currentSchema}' (from the current user's default schema)`);
 	const allTableMetadata = await db.introspection.getTables();
-	const databaseIndexes = await getDatabaseIndexes(db, dbType, currentSchema);
+	const databaseIndexMap = await getDatabaseIndexMap(db, dbType, currentSchema, allTableMetadata.map((table) => table.name), introspectIndexes);
 	const databaseColumnBounds = await getDatabaseColumnBounds(db, dbType, currentSchema);
 	let tableMetadata = allTableMetadata;
 	if (dbType === "postgres") try {
@@ -395,6 +383,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		logger.warn(`Could not filter tables by schema. Using all discovered tables. Error: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	else if (dbType === "mssql") tableMetadata = allTableMetadata.filter((table) => table.schema === currentSchema);
+	const schemaProblems = diffSchema(toPhysicalSchema(db, betterAuthSchema), toIntrospectedTables(tableMetadata)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "database"));
 	const toBeCreated = [];
 	const toBeAdded = [];
 	const toBeAddedIndexes = [];
@@ -405,13 +394,13 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		for (const index of value.indexes ?? []) {
 			const name = index.name;
 			const indexKey = createDatabaseIndexKey(key, name);
-			const existingIndex = databaseIndexes.get(indexKey);
+			const existingIndex = databaseIndexMap.get(indexKey);
 			if (existingIndex) {
 				if (!databaseIndexMatches(existingIndex, index)) throw new BetterAuthError(`Database index "${name}" on table "${key}" does not match the configured fields and uniqueness. Rename or replace the existing index, then run the migration again.`);
 				continue;
 			}
 			if (dbType === "sqlite" || dbType === "postgres") {
-				const indexOnAnotherTable = [...databaseIndexes.values()].find((databaseIndex) => getPortableDatabaseIdentifierKey(databaseIndex.name) === getPortableDatabaseIdentifierKey(name) && getPortableDatabaseIdentifierKey(databaseIndex.table) !== getPortableDatabaseIdentifierKey(key));
+				const indexOnAnotherTable = [...databaseIndexMap.values()].find((databaseIndex) => getPortableDatabaseIdentifierKey(databaseIndex.name) === getPortableDatabaseIdentifierKey(name) && getPortableDatabaseIdentifierKey(databaseIndex.table) !== getPortableDatabaseIdentifierKey(key));
 				if (indexOnAnotherTable) throw new BetterAuthError(`Database index name "${name}" is already used by table "${indexOnAnotherTable.table}". Index names must be unique across the schema.`);
 			}
 			const plannedIndex = plannedIndexes.get(indexKey);
@@ -587,8 +576,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 				}
 				if (populated) {
 					const textDetail = field.type === "string" ? " For a text column, every existing row ends up with the same empty string." : "";
-					const guideLink = isAccountIssuerColumn(table.table, fieldName) ? ` See ${columnBackfillGuideUrl}` : "";
-					reportUnsafeChange(`Cannot add required column "${fieldName}" to populated table "${table.table}": the schema declares no default value, so existing rows have no value to backfill. MySQL accepts this statement instead of rejecting it and fills every existing row with an implicit default for the column type, reporting a successful migration over corrupted data.${textDetail} Add the column as nullable, backfill a correct value for every row, then make it NOT NULL.${guideLink}`);
+					reportUnsafeChange(`Cannot add required column "${fieldName}" to populated table "${table.table}": the schema declares no default value, so existing rows have no value to backfill. MySQL accepts this statement instead of rejecting it and fills every existing row with an implicit default for the column type, reporting a successful migration over corrupted data.${textDetail} Add the column as nullable, backfill a correct value for every row, then make it NOT NULL.`);
 				}
 			}
 			const type = getType(field, fieldName, getTableIndexStringLength(table.table, fieldName));
@@ -653,7 +641,11 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 	}
 	for (const index of deferredIndexes) migrations.push(index);
 	async function runMigrations() {
-		for (const migration of migrations) await migration.execute();
+		try {
+			for (const migration of migrations) await migration.execute();
+		} finally {
+			if (migrations.length && config.database) invalidateSchemaChecks(config.database);
+		}
 	}
 	async function compileMigrations() {
 		return migrations.map((m) => m.compile().sql).join(";\n\n") + ";";
@@ -663,6 +655,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		toBeAdded,
 		toBeAddedIndexes,
 		unsafeChanges,
+		schemaProblems,
 		runMigrations,
 		compileMigrations
 	};