better-auth 1.7.1 → 1.7.3

package/dist/db/internal-adapter.mjs

@@ -3,8 +3,7 @@ import { getDate } from "../utils/date.mjs";
 import { assertValidUserInfo, assertValidUserInfoSource } from "../utils/validate-user-info.mjs";
 import { getStorageOption, processIdentifier } from "./verification-token-storage.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
-import { getCurrentAdapter, getCurrentAuthContext, queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
+import { getCurrentAdapter, getCurrentAuthEndpointContext, queueAfterTransactionHook, runWithTransaction, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { safeJSONParse } from "@better-auth/core/utils/json";
@@ -153,7 +152,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				assertValidUserInfoSource(validationSource);
 				let endpointContext;
 				try {
-					endpointContext = await getCurrentAuthContext();
+					endpointContext = getCurrentAuthEndpointContext();
 				} catch (error) {
 					logger.error("Unable to run validateUserInfo: missing endpoint context", error);
 					throw new APIError("FORBIDDEN", {
@@ -247,7 +246,7 @@ const createInternalAdapter = (adapter, ctx) => {
 		},
 		createSession: async (userId, dontRememberMe, override, overrideAll, storageOptions) => {
 			const headers = await (async () => {
-				const ctx = await getCurrentAuthContext().catch(() => null);
+				const ctx = tryGetCurrentAuthEndpointContext();
 				return ctx?.headers || ctx?.request?.headers;
 			})();
 			const storeInDb = options.session?.storeSessionInDatabase;
@@ -540,18 +539,21 @@ const createInternalAdapter = (adapter, ctx) => {
 				operator: "in"
 			}], "session", void 0);
 		},
-		findAccountOwnerByKey: async ({ issuer, accountId }) => {
-			const accountWithUser = await (await getCurrentAdapter(adapter)).findOne({
+		findAccountOwnerByKey: async ({ providerId, accountId }) => {
+			const accountsWithUsers = await (await getCurrentAdapter(adapter)).findMany({
 				model: "account",
 				where: [{
-					field: "issuer",
-					value: issuer
+					field: "providerId",
+					value: providerId
 				}, {
 					field: "accountId",
 					value: accountId
 				}],
+				limit: 2,
 				join: { user: true }
 			});
+			if (accountsWithUsers.length > 1) throw new BetterAuthError(`Multiple accounts match the same accountId for provider ${JSON.stringify(providerId)}. Resolve duplicate account identities before continuing.`);
+			const accountWithUser = accountsWithUsers[0];
 			if (!accountWithUser) return null;
 			const { user, ...account } = accountWithUser;
 			return user ? {
@@ -632,10 +634,6 @@ const createInternalAdapter = (adapter, ctx) => {
 					field: "providerId",
 					value: "credential"
 				},
-				{
-					field: "issuer",
-					value: createLocalAccountIssuer("credential")
-				},
 				{
 					field: "accountId",
 					value: userId
@@ -663,10 +661,6 @@ const createInternalAdapter = (adapter, ctx) => {
 						field: "providerId",
 						value: "credential"
 					},
-					{
-						field: "issuer",
-						value: createLocalAccountIssuer("credential")
-					},
 					{
 						field: "accountId",
 						value: userId
@@ -674,17 +668,20 @@ const createInternalAdapter = (adapter, ctx) => {
 				]
 			});
 		},
-		findAccountByKey: async ({ issuer, accountId }) => {
-			return await (await getCurrentAdapter(adapter)).findOne({
+		findAccountByKey: async ({ providerId, accountId }) => {
+			const accounts = await (await getCurrentAdapter(adapter)).findMany({
 				model: "account",
+				limit: 2,
 				where: [{
-					field: "issuer",
-					value: issuer
+					field: "providerId",
+					value: providerId
 				}, {
 					field: "accountId",
 					value: accountId
 				}]
 			});
+			if (accounts.length > 1) throw new BetterAuthError(`Multiple accounts match the same accountId for provider ${JSON.stringify(providerId)}. Resolve duplicate account identities before continuing.`);
+			return accounts[0] ?? null;
 		},
 		findAccountByUserId: async (userId) => {
 			return await (await getCurrentAdapter(adapter)).findMany({

package/dist/db/schema.d.mts

@@ -31,7 +31,6 @@ declare function parseAccountInput(options: BetterAuthOptions, account: Partial<
   createdAt: Date;
   updatedAt: Date;
   providerId: string;
-  issuer: string;
   accountId: string;
   userId: string;
   accessToken?: string | null | undefined;

package/dist/db/with-hooks.mjs

@@ -1,10 +1,10 @@
-import { getCurrentAdapter, getCurrentAuthContext, queueAfterTransactionHook } from "@better-auth/core/context";
+import { getCurrentAdapter, queueAfterTransactionHook, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_HOOK_TYPE, withSpan } from "@better-auth/core/instrumentation";
 //#region src/db/with-hooks.ts
 function getWithHooks(adapter, ctx) {
 	const hooksEntries = ctx.hooks;
 	async function createWithHooks(data, model, customCreateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.create?.before;
@@ -41,7 +41,7 @@ function getWithHooks(adapter, ctx) {
 		return created;
 	}
 	async function updateWithHooks(data, where, model, customUpdateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.update?.before;
@@ -77,7 +77,7 @@ function getWithHooks(adapter, ctx) {
 		return updated;
 	}
 	async function updateManyWithHooks(data, where, model, customUpdateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.update?.before;
@@ -113,7 +113,7 @@ function getWithHooks(adapter, ctx) {
 		return updated;
 	}
 	async function deleteWithHooks(where, model, customDeleteFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let entityToDelete = null;
 		try {
 			entityToDelete = (await (await getCurrentAdapter(adapter)).findMany({
@@ -150,7 +150,7 @@ function getWithHooks(adapter, ctx) {
 		return deleted;
 	}
 	async function deleteManyWithHooks(where, model, customDeleteFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let entitiesToDelete = [];
 		try {
 			entitiesToDelete = await (await getCurrentAdapter(adapter)).findMany({
@@ -202,7 +202,7 @@ function getWithHooks(adapter, ctx) {
 	* the helper resolves to `null` (no `consumeFn` call, no after hooks).
 	*/
 	async function consumeOneWithHooks(model, hookWhere, consumeFn, preSnapshot) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		const beforeHooks = hooksEntries.flatMap(({ source, hooks }) => {
 			const fn = hooks[model]?.delete?.before;
 			return fn ? [{

package/dist/oauth2/account-key.mjs

@@ -1,4 +1,3 @@
-import { createOAuthAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES, BetterAuthError } from "@better-auth/core/error";
 //#region src/oauth2/account-key.ts
 /**
@@ -21,11 +20,8 @@ async function resolveOAuthAccountKey(provider, tokens, profile) {
 	const resolvedSubject = await accountSubject(accountKeyContext);
 	const accountId = String(resolvedSubject);
 	if (typeof resolvedSubject === "number" && !Number.isFinite(resolvedSubject) || accountId.trim().length === 0 || accountId === "undefined" || accountId === "null") throw new BetterAuthError("OAUTH_ACCOUNT_SUBJECT_INVALID");
-	const accountIssuer = provider.accountIssuer;
-	const issuer = accountIssuer === void 0 ? createOAuthAccountIssuer(provider.id) : typeof accountIssuer === "function" ? await accountIssuer(accountKeyContext) : accountIssuer;
-	if (typeof issuer !== "string" || issuer.trim().length === 0 || issuer === "undefined" || issuer === "null") throw new BetterAuthError("OAUTH_ACCOUNT_ISSUER_INVALID");
 	return {
-		issuer,
+		providerId: provider.id,
 		accountId
 	};
 }

package/dist/oauth2/errors.mjs

@@ -1,3 +1,4 @@
+import { appendQueryParams } from "@better-auth/core/utils/url";
 //#region src/oauth2/errors.ts
 /**
 * Error codes used in OAuth callback redirects (`?error=<code>`). These are
@@ -33,8 +34,8 @@ const HANDLING_DOCS_URL = "https://www.better-auth.com/docs/concepts/oauth#handl
 function redirectOnError(ctx, errorURL, error, description) {
 	const params = new URLSearchParams({ error });
 	if (description) params.set("error_description", description);
-	const sep = errorURL.includes("?") ? "&" : "?";
-	throw ctx.redirect(`${errorURL}${sep}${params.toString()}`);
+	const redirectURL = appendQueryParams(errorURL, params);
+	throw ctx.redirect(redirectURL);
 }
 /**
 * Build the logger message shown when an OAuth provider does not return an
@@ -42,7 +43,7 @@ function redirectOnError(ctx, errorURL, error, description) {
 * the same workaround docs.
 */
 function missingEmailLogMessage(providerId, options) {
-	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or synthesize one via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
+	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or create a placeholder via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
 }
 //#endregion
 export { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage, redirectOnError };

package/dist/oauth2/link-account.d.mts

@@ -56,7 +56,6 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
     createdAt: Date;
     updatedAt: Date;
     providerId: string;
-    issuer: string;
     accountId: string;
     userId: string;
     accessToken?: string | null | undefined;

package/dist/oauth2/link-account.mjs

@@ -18,7 +18,7 @@ async function handleOAuthUserInfo(c, opts) {
 	const requireExactAccountBinding = !!opts.selectedUser || opts.requireExactAccountBinding === true;
 	let pendingAccountCookie = null;
 	const accountOwner = await c.context.internalAdapter.findAccountOwnerByKey({
-		issuer: account.issuer,
+		providerId: account.providerId,
 		accountId: account.accountId
 	}).catch((e) => {
 		c.context.logger.error("Better auth was unable to query your database.\nError: ", e);
@@ -38,10 +38,6 @@ async function handleOAuthUserInfo(c, opts) {
 				code: "account_ownership_conflict",
 				message: "Account is already linked to another user"
 			});
-			if (requireExactAccountBinding && accountOwner.account.providerId !== account.providerId) throw new APIError("CONFLICT", {
-				code: "account_provider_conflict",
-				message: "Account is already linked through another provider"
-			});
 			return {
 				user: accountOwner.user,
 				linkedAccount: accountOwner.account,
@@ -75,7 +71,7 @@ async function handleOAuthUserInfo(c, opts) {
 	let user = dbUser?.user;
 	const isRegister = !user;
 	if (dbUser) {
-		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.issuer === account.issuer && acc.accountId === account.accountId);
+		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.providerId === account.providerId && acc.accountId === account.accountId);
 		if (!linkedAccount) {
 			const accountLinking = c.context.options.account?.accountLinking;
 			const isTrustedProvider = opts.isTrustedProvider || opts.trustProviderByName !== false && c.context.trustedProviders.includes(account.providerId);
@@ -102,7 +98,6 @@ async function handleOAuthUserInfo(c, opts) {
 				});
 				const createdAccount = await c.context.internalAdapter.linkAccount({
 					providerId: account.providerId,
-					issuer: account.issuer,
 					accountId: account.accountId,
 					userId: dbUser.user.id,
 					accessToken: await setTokenUtil(account.accessToken, c.context),
@@ -116,7 +111,7 @@ async function handleOAuthUserInfo(c, opts) {
 					error: "unable to link account",
 					data: null
 				};
-				if (requireExactAccountBinding && (createdAccount.issuer !== account.issuer || createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
+				if (requireExactAccountBinding && (createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
 					code: "account_hook_binding_conflict",
 					message: "Account hook changed the selected authentication binding"
 				});
@@ -172,7 +167,7 @@ async function handleOAuthUserInfo(c, opts) {
 					error: "unable to update account",
 					data: null
 				};
-				if (requireExactAccountBinding && (updatedAccount.issuer !== account.issuer || updatedAccount.accountId !== account.accountId || updatedAccount.providerId !== account.providerId || updatedAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
+				if (requireExactAccountBinding && (updatedAccount.accountId !== account.accountId || updatedAccount.providerId !== account.providerId || updatedAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
 					code: "account_hook_binding_conflict",
 					message: "Account hook changed the selected authentication binding"
 				});
@@ -214,7 +209,6 @@ async function handleOAuthUserInfo(c, opts) {
 				refreshTokenExpiresAt: account.refreshTokenExpiresAt,
 				scope: account.scope,
 				providerId: account.providerId,
-				issuer: account.issuer,
 				accountId: account.accountId
 			};
 			const { createdUser, createdAccount } = await runWithTransaction(c.context.adapter, async () => {
@@ -233,7 +227,7 @@ async function handleOAuthUserInfo(c, opts) {
 					})
 				};
 			});
-			if (requireExactAccountBinding && (createdAccount.issuer !== account.issuer || createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== createdUser.id)) throw new APIError("CONFLICT", {
+			if (requireExactAccountBinding && (createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== createdUser.id)) throw new APIError("CONFLICT", {
 				code: "account_hook_binding_conflict",
 				message: "Account hook changed the selected authentication binding"
 			});

package/dist/oauth2/state.mjs

@@ -55,7 +55,7 @@ async function parseState(c) {
 		let redirectErrorURL = errorURL;
 		if (error instanceof StateError) {
 			code = error.code === "state_security_mismatch" ? "state_mismatch" : error.code;
-			redirectErrorURL = error.errorURL ?? errorURL;
+			redirectErrorURL = error.errorURL || errorURL;
 		}
 		redirectOnError(c, redirectErrorURL, code);
 	}

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.1";
+var version = "1.7.3";
 //#endregion
 export { version };

package/dist/plugins/admin/routes.mjs

@@ -4,7 +4,6 @@ import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cooki
 import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { whereOperators } from "@better-auth/core/db/adapter";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
@@ -203,7 +202,6 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 		const hashedPassword = await ctx.context.password.hash(ctx.body.password);
 		await ctx.context.internalAdapter.linkAccount({
 			providerId: "credential",
-			issuer: createLocalAccountIssuer("credential"),
 			accountId: user.id,
 			password: hashedPassword,
 			userId: user.id
@@ -534,7 +532,7 @@ const banUser = (opts) => createAuthEndpoint("/admin/ban-user", {
 	const user = await ctx.context.internalAdapter.updateUser(ctx.body.userId, {
 		banned: true,
 		banReason: ctx.body.banReason || opts?.defaultBanReason || "No reason",
-		banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : opts?.defaultBanExpiresIn ? getDate(opts.defaultBanExpiresIn, "sec") : void 0,
+		banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : opts?.defaultBanExpiresIn ? getDate(opts.defaultBanExpiresIn, "sec") : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
 	await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);
@@ -842,7 +840,6 @@ const setUserPassword = (opts) => createAuthEndpoint("/admin/set-user-password",
 	else await ctx.context.internalAdapter.createAccount({
 		userId,
 		providerId: "credential",
-		issuer: createLocalAccountIssuer("credential"),
 		accountId: user.id,
 		password: hashedPassword
 	});

package/dist/plugins/anonymous/index.mjs

@@ -10,6 +10,7 @@ import { schema } from "./schema.mjs";
 import { generateId } from "@better-auth/core/utils/id";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/anonymous/index.ts
 /**
 * Resolves the anonymous session being upgraded during an account-link callback.
@@ -51,7 +52,10 @@ async function getAnonUserEmail(options) {
 	}
 	const id = generateId();
 	if (options?.emailDomainName) return `temp-${id}@${options.emailDomainName}`;
-	return `temp@${id}.com`;
+	return createPlaceholderEmail({
+		identifier: id,
+		namespace: "anonymous"
+	});
 }
 const anonymous = (options) => {
 	return {

package/dist/plugins/anonymous/types.d.mts

@@ -18,9 +18,8 @@ interface UserWithAnonymous extends User {
 }
 interface AnonymousOptions {
   /**
-   * Configure the domain name of the temporary email
-   * address for anonymous users in the database.
-   * @default "baseURL"
+   * Configure a custom domain for anonymous user email addresses.
+   * @default "anonymous.placeholder.invalid"
    */
   emailDomainName?: string | undefined;
   /**

package/dist/plugins/device-authorization/index.d.mts

@@ -162,37 +162,37 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
         client_id: z.ZodString;
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
-      } & (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) : ({
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_1 ? { -readonly [P in keyof T_1]: T_1[P] } : never) : ({
         client_id: z.ZodString;
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
-      } extends infer T_1 extends z.core.util.SomeObject ? { [K in keyof T_1 as K extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } extends infer T_2 extends z.core.util.SomeObject ? { [K in keyof T_2 as K extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K]: T_1[K] } : never) & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K]: T_2[K] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_2 extends z.core.util.SomeObject ? { [K_1 in keyof T_2]: T_2[K_1] } : never)) extends infer T ? { [k in keyof T]: T[k] } : never, z.core.$strip> | z.ZodObject<(("scope" | "user_id" | "client_id") & keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_4 ? { -readonly [P in keyof T_4]: T_4[P] } : never) extends infer T_3 extends z.core.util.SomeObject ? { [K_1 in keyof T_3]: T_3[K_1] } : never)) extends infer T ? { [k in keyof T]: T[k] } : never, z.core.$strip> | z.ZodObject<(("scope" | "user_id" | "client_id") & keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
       }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends never ? {
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
         client_id: z.ZodOptional<z.ZodString>;
-      } & (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) : ({
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_6 ? { -readonly [P in keyof T_6]: T_6[P] } : never) : ({
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
         client_id: z.ZodOptional<z.ZodString>;
-      } extends infer T_4 extends z.core.util.SomeObject ? { [K_2 in keyof T_4 as K_2 extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } extends infer T_7 extends z.core.util.SomeObject ? { [K_2 in keyof T_7 as K_2 extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K_2]: T_4[K_2] } : never) & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K_2]: T_7[K_2] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_5 extends z.core.util.SomeObject ? { [K_1 in keyof T_5]: T_5[K_1] } : never)) extends infer T_3 ? { [k_1 in keyof T_3]: T_3[k_1] } : never, z.core.$strip>;
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_9 ? { -readonly [P in keyof T_9]: T_9[P] } : never) extends infer T_8 extends z.core.util.SomeObject ? { [K_1 in keyof T_8]: T_8[K_1] } : never)) extends infer T_5 ? { [k_1 in keyof T_5]: T_5[k_1] } : never, z.core.$strip>;
       error: z.ZodObject<{
         error: z.ZodEnum<{ [k_3 in (readonly ["invalid_request", "invalid_client", "unauthorized_client", "invalid_scope", ...Grant extends {
           requestErrorCodes: infer ErrorCodes extends readonly string[];
-        } ? ErrorCodes : readonly [], "server_error"])[number]]: k_3 } extends infer T_6 ? { [k_2 in keyof T_6]: T_6[k_2] } : never>;
+        } ? ErrorCodes : readonly [], "server_error"])[number]]: k_3 } extends infer T_10 ? { [k_2 in keyof T_10]: T_10[k_2] } : never>;
         error_description: z.ZodString;
       }, z.core.$strip>;
       onValidationError: ({

package/dist/plugins/email-otp/routes.mjs

@@ -10,7 +10,6 @@ import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
 import { storeOTP, tryReuseOTP, verifyStoredOTP } from "./otp-token.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import { deprecate } from "@better-auth/core/utils/deprecate";
@@ -593,7 +592,6 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	if (!await ctx.context.internalAdapter.findCredentialAccount(user.user.id)) await ctx.context.internalAdapter.createAccount({
 		userId: user.user.id,
 		providerId: "credential",
-		issuer: createLocalAccountIssuer("credential"),
 		accountId: user.user.id,
 		password: passwordHash
 	});

package/dist/plugins/generic-oauth/index.mjs

@@ -93,7 +93,6 @@ const genericOAuth = (options) => {
 						return null;
 					});
 					if (discovered) {
-						if (!discovered.issuer && !c.accountIssuer) throw new Error(`Provider "${c.providerId}": discovery did not return an issuer. Configure accountIssuer explicitly to establish a stable account namespace.`);
 						authorizationUrl ??= discovered.authorization_endpoint;
 						tokenUrl ??= discovered.token_endpoint;
 						userInfoUrl ??= discovered.userinfo_endpoint;
@@ -106,7 +105,8 @@ const genericOAuth = (options) => {
 							try {
 								jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
 							} catch {
-								throw new Error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document.`);
+								ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
+								continue;
 							}
 							idTokenConfig = {
 								jwks: createRemoteJWKSet(jwksUrl),
@@ -115,16 +115,24 @@ const genericOAuth = (options) => {
 								algorithms: isOidc ? signingAlgs : void 0
 							};
 						}
-					} else if (!c.accountIssuer) throw new Error(`Provider "${c.providerId}": discovery returned no valid data. Provider initialization stopped to keep its account issuer stable.`);
-					else if (!authorizationUrl || !tokenUrl) ctx.logger.error(`Provider "${c.providerId}": discovery returned no data and no explicit endpoints configured. OAuth sign-in will fail for this provider.`);
+					}
+					if (!authorizationUrl || !tokenUrl && !c.getToken) {
+						ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
+						continue;
+					}
+				}
+				if (c.requireIdTokenVerification && !idTokenConfig) {
+					if (c.discoveryUrl) {
+						ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
+						continue;
+					}
+					throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
 				}
-				if (c.requireIdTokenVerification && !idTokenConfig) throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
 				const tokenEndpointAuth = c.tokenEndpointAuth;
 				if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
 				if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
 				if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
 				const accountSubject = c.accountSubject;
-				const accountIssuer = c.accountIssuer;
 				const provider = {
 					id: c.providerId,
 					name: c.name ?? c.providerId,
@@ -137,10 +145,6 @@ const genericOAuth = (options) => {
 						});
 						return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
 					},
-					accountIssuer: typeof accountIssuer === "function" ? ({ tokens, profile }) => accountIssuer({
-						tokens,
-						profile
-					}) : accountIssuer ?? issuer,
 					idToken: idTokenConfig,
 					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
 					allowIdpInitiated: c.allowIdpInitiated,

package/dist/plugins/generic-oauth/providers/auth0.mjs

@@ -27,12 +27,10 @@ function auth0(options) {
 		"profile",
 		"email"
 	];
-	const domain = options.domain.replace(/^https?:\/\//, "").replace(/\/+$/, "");
-	const discoveryUrl = `https://${domain}/.well-known/openid-configuration`;
+	const domainUrl = options.domain.startsWith("http://") || options.domain.startsWith("https://") ? options.domain : `https://${options.domain}`;
 	return {
 		providerId: "auth0",
-		accountIssuer: `https://${domain}/`,
-		discoveryUrl,
+		discoveryUrl: `https://${new URL(domainUrl).host}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,

package/dist/plugins/generic-oauth/providers/keycloak.mjs

@@ -22,20 +22,17 @@
 * ```
 */
 function keycloak(options) {
-	const defaultScopes = [
-		"openid",
-		"profile",
-		"email"
-	];
-	const issuer = options.issuer.replace(/\/$/, "");
 	return {
 		providerId: "keycloak",
-		accountIssuer: issuer,
-		discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+		discoveryUrl: `${options.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,
-		scopes: options.scopes ?? defaultScopes,
+		scopes: options.scopes ?? [
+			"openid",
+			"profile",
+			"email"
+		],
 		redirectURI: options.redirectURI,
 		endSessionEndpoint: options.endSessionEndpoint,
 		postLogoutRedirectURI: options.postLogoutRedirectURI,

package/dist/plugins/generic-oauth/providers/line.mjs

@@ -71,7 +71,6 @@ function line(options) {
 	return {
 		providerId: options.providerId ?? "line",
 		accountSubject: ({ profile }) => profile.sub ?? "",
-		accountIssuer: "https://access.line.me",
 		authorizationUrl,
 		tokenUrl,
 		userInfoUrl,

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.mjs

@@ -1,5 +1,6 @@
 import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/generic-oauth/providers/microsoft-entra-id.ts
 function getMicrosoftProfileName(profile) {
 	return profile.name ?? (`${profile.given_name ?? profile.givenname ?? ""} ${profile.family_name ?? profile.familyname ?? ""}`.trim() || void 0);
@@ -46,25 +47,34 @@ function microsoftEntraId(options) {
 		} catch {
 			return null;
 		}
-		if (!(typeof tokenProfile.oid === "string" && tokenProfile.oid.trim().length > 0 ? tokenProfile.oid : void 0)) return null;
+		const oid = typeof tokenProfile.oid === "string" && tokenProfile.oid.trim().length > 0 ? tokenProfile.oid : void 0;
+		if (!oid) return null;
+		const tokenEmail = tokenProfile.email;
 		const tokenUserInfo = {
 			...tokenProfile,
 			name: getMicrosoftProfileName(tokenProfile),
-			email: tokenProfile.email ?? tokenProfile.preferred_username ?? void 0,
+			email: tokenEmail ?? createPlaceholderEmail({
+				identifier: oid,
+				namespace: "microsoft-entra-id"
+			}),
 			image: tokenProfile.picture,
-			emailVerified: tokenProfile.email_verified ?? false
+			emailVerified: tokenEmail ? tokenProfile.email_verified ?? false : false
 		};
 		if (!tokens.accessToken) return tokenUserInfo;
 		const { data: profile, error } = await betterFetch(userInfoUrl, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
 		if (error || !profile) return tokenUserInfo;
 		if (typeof tokenProfile.sub !== "string" || profile.sub !== tokenProfile.sub) return tokenUserInfo;
+		const emailClaim = tokenProfile.email ?? profile.email;
 		return {
 			...profile,
 			...tokenProfile,
 			name: getMicrosoftProfileName(tokenProfile) ?? getMicrosoftProfileName(profile),
-			email: tokenProfile.email ?? profile.email ?? tokenProfile.preferred_username ?? profile.preferred_username ?? void 0,
+			email: emailClaim ?? createPlaceholderEmail({
+				identifier: oid,
+				namespace: "microsoft-entra-id"
+			}),
 			image: tokenProfile.picture ?? profile.picture,
-			emailVerified: tokenProfile.email_verified ?? profile.email_verified ?? false
+			emailVerified: emailClaim != null ? tokenProfile.email_verified ?? profile.email_verified ?? false : false
 		};
 	};
 	return {

package/dist/plugins/generic-oauth/providers/okta.mjs

@@ -22,20 +22,17 @@
 * ```
 */
 function okta(options) {
-	const defaultScopes = [
-		"openid",
-		"profile",
-		"email"
-	];
-	const issuer = options.issuer.replace(/\/$/, "");
 	return {
 		providerId: "okta",
-		accountIssuer: issuer,
-		discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+		discoveryUrl: `${options.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,
-		scopes: options.scopes ?? defaultScopes,
+		scopes: options.scopes ?? [
+			"openid",
+			"profile",
+			"email"
+		],
 		redirectURI: options.redirectURI,
 		endSessionEndpoint: options.endSessionEndpoint,
 		postLogoutRedirectURI: options.postLogoutRedirectURI,

package/dist/plugins/generic-oauth/providers/slack.mjs

@@ -41,7 +41,6 @@ function slack(options) {
 	return {
 		providerId: "slack",
 		accountSubject: ({ profile }) => profile.sub ?? "",
-		accountIssuer: "https://slack.com",
 		authorizationUrl: "https://slack.com/openid/connect/authorize",
 		tokenUrl: "https://slack.com/api/openid.connect.token",
 		userInfoUrl: "https://slack.com/api/openid.connect.userInfo",