better-auth 1.7.19 → 1.7.21

package/dist/api/index.d.mts

@@ -1,6 +1,7 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
 import "../types/index.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
 import "../index.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
@@ -4049,4 +4050,4 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
   } extends (infer T_2) ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K]; } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -5,6 +5,7 @@ import { onRequestRateLimit } from "./rate-limiter/index.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -223,4 +224,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/routes/sign-up.mjs

@@ -5,7 +5,7 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
-import { runWithTransaction } from "@better-auth/core/context";
+import { queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
 import { isDevelopment } from "@better-auth/core/env";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
@@ -198,7 +198,13 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 				* between existing and non-existing emails.
 				*/
 				await ctx.context.password.hash(password);
-				if (ctx.context.options.emailAndPassword?.onExistingUserSignUp) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailAndPassword.onExistingUserSignUp({ user: dbUser.user }, safeCloneRequest(ctx.request)));
+				const onExistingUserSignUp = ctx.context.options.emailAndPassword?.onExistingUserSignUp;
+				if (onExistingUserSignUp) {
+					const request = safeCloneRequest(ctx.request);
+					await queueAfterTransactionHook(async () => {
+						await ctx.context.runInBackgroundOrAwait(onExistingUserSignUp({ user: dbUser.user }, request));
+					}, { onError: (error) => ctx.context.logger.error("Failed to run onExistingUserSignUp after sign-up", error) });
+				}
 				return buildGenericDuplicateResponse();
 			}
 			throw APIError.from("UNPROCESSABLE_ENTITY", BASE_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);
@@ -238,15 +244,20 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			accountId: createdUser.id,
 			password: hash
 		});
-		if (ctx.context.options.emailVerification?.sendOnSignUp ?? ctx.context.options.emailAndPassword.requireEmailVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, createdUser.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: createdUser.id });
+		const shouldSendVerificationEmail = ctx.context.options.emailVerification?.sendOnSignUp ?? ctx.context.options.emailAndPassword.requireEmailVerification;
+		const sendVerificationEmail = ctx.context.options.emailVerification?.sendVerificationEmail;
+		if (shouldSendVerificationEmail && sendVerificationEmail) {
 			const callbackURL = body.callbackURL ? encodeURIComponent(body.callbackURL) : encodeURIComponent("/");
-			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
-			if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
-				user: createdUser,
-				url,
-				token
-			}, safeCloneRequest(ctx.request)));
+			const request = safeCloneRequest(ctx.request);
+			await queueAfterTransactionHook(async () => {
+				const token = await createEmailVerificationToken(ctx.context.secret, createdUser.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: createdUser.id });
+				const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
+				await ctx.context.runInBackgroundOrAwait(sendVerificationEmail({
+					user: createdUser,
+					url,
+					token
+				}, request));
+			}, { onError: (error) => ctx.context.logger.error("Failed to send the sign-up verification email", error) });
 		}
 		if (shouldSkipAutoSignIn) return ctx.json({
 			token: null,

package/dist/db/get-migration.mjs

@@ -1,7 +1,7 @@
 import { buildSchema } from "./get-schema.mjs";
 import { createLogger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
-import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
+import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, introspectPostgresTables, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
 import { initGetFieldName, initGetModelName } from "@better-auth/core/db/adapter";
 import { diffSchema, formatSchemaFinding, getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, invalidateSchemaChecks } from "@better-auth/core/db/internal";
 import { sql } from "kysely";
@@ -354,9 +354,8 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		logger.error("Only kysely adapter is supported for migrations. You can use `generate` command to generate the schema, if you're using a different adapter.");
 		process.exit(1);
 	}
-	const allTableMetadata = await db.introspection.getTables();
 	let target;
-	let tableMetadata = allTableMetadata;
+	let tableMetadata;
 	switch (dbType) {
 		case "postgres": {
 			const schema = schemaName ?? await getPostgresSchema(db);
@@ -373,11 +372,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 			} catch (error) {
 				logger.debug(`Could not verify schema existence: ${error instanceof Error ? error.message : String(error)}`);
 			}
-			/**
-			* Kysely 0.28 does not expose `isForeign`, while 0.29 adds foreign table metadata.
-			* @see https://github.com/kysely-org/kysely/pull/1494
-			*/
-			tableMetadata = allTableMetadata.filter((table) => table.schema === schema && !table.isView && !("isForeign" in table && table.isForeign));
+			tableMetadata = (await introspectPostgresTables(db, [schema])).filter((table) => !table.isView && !table.isForeign);
 			logger.debug(`Found ${tableMetadata.length} table(s) in schema '${schema}': ${tableMetadata.map((table) => table.name).join(", ") || "(none)"}`);
 			break;
 		}
@@ -388,15 +383,18 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 				schema
 			};
 			logger.debug(`SQL Server migration: Using schema '${schema}' (from the current user's default schema)`);
-			tableMetadata = allTableMetadata.filter((table) => table.schema === schema);
+			tableMetadata = (await db.introspection.getTables()).filter((table) => table.schema === schema);
 			break;
 		}
 		case "mysql":
 			target = { type: "mysql" };
+			tableMetadata = await db.introspection.getTables();
 			break;
-		case "sqlite": target = { type: "sqlite" };
+		case "sqlite":
+			target = { type: "sqlite" };
+			tableMetadata = await db.introspection.getTables();
 	}
-	const databaseIndexMap = await getDatabaseIndexMap(db, target, allTableMetadata.map((table) => table.name), introspectIndexes);
+	const databaseIndexMap = await getDatabaseIndexMap(db, target, tableMetadata.map((table) => table.name), introspectIndexes);
 	const databaseColumnBounds = await getDatabaseColumnBounds(db, target);
 	const schemaProblems = diffSchema(toPhysicalSchema(db, betterAuthSchema), toIntrospectedTables(tableMetadata)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "database"));
 	const toBeCreated = [];

package/dist/db/internal-adapter.mjs

@@ -930,7 +930,10 @@ const createInternalAdapter = (adapter, ctx) => {
 		* is best-effort there (it is intended for development and tests).
 		*/
 		reserveVerificationValue: async (data) => {
-			const reservationId = encodeDeterministicId(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), options);
+			const reservationId = encodeDeterministicId(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), options, {
+				adapter,
+				model: "verification"
+			});
 			const storageOption = getStorageOption(data.identifier, options.verification?.storeIdentifier);
 			const storedIdentifier = await processIdentifier(data.identifier, storageOption);
 			if (secondaryStorage && !options.verification?.storeInDatabase) throw new BetterAuthError("reserveVerificationValue requires database-backed verification storage. Set verification.storeInDatabase to true for flows that reserve verification values.");

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.19";
+var version = "1.7.21";
 //#endregion
 export { version };

package/dist/plugins/device-authorization/routes.mjs

@@ -550,6 +550,21 @@ const deviceVerify = (grant) => createAuthEndpoint("/device", {
 			increment: {},
 			set: { userId: session.user.id }
 		})) deviceCodeRecord.userId = session.user.id;
+		else {
+			const current = await ctx.context.adapter.findOne({
+				model: "deviceCode",
+				where: [{
+					field: "id",
+					value: deviceCodeRecord.id
+				}]
+			});
+			if (!current) throw new APIError("BAD_REQUEST", {
+				error: "invalid_request",
+				error_description: DEVICE_AUTHORIZATION_ERROR_CODES.INVALID_USER_CODE.message
+			});
+			deviceCodeRecord.userId = current.userId;
+			deviceCodeRecord.status = current.status;
+		}
 	}
 	const canReviewRequest = session?.user.id !== void 0 && deviceCodeRecord.userId === session.user.id;
 	const grantContext = canReviewRequest ? grant?.getVerificationContext(deviceCodeRecord) : void 0;

package/dist/plugins/generic-oauth/index.d.mts

@@ -25,10 +25,7 @@ declare module "@better-auth/core" {
  * Extracts common fields from GenericOAuthConfig for provider helpers.
  */
 export type BaseOAuthProviderOptions = Pick<GenericOAuthConfig, "clientId" | "clientSecret" | "tokenEndpointAuth" | "scopes" | "redirectURI" | "endSessionEndpoint" | "postLogoutRedirectURI" | "disableProviderLogout" | "pkce" | "disableImplicitSignUp" | "disableSignUp" | "overrideUserInfo">;
-type PendingDiscovery = Map<string, {
-  config: GenericOAuthConfig;
-  attempt?: Promise<void> | undefined;
-}>;
+type PendingDiscovery = Map<string, GenericOAuthConfig>;
 /**
  * A generic OAuth plugin that registers any OAuth/OIDC provider
  * as a first-class social provider.

package/dist/plugins/generic-oauth/index.mjs

@@ -25,6 +25,7 @@ function isClientSecretTokenEndpointAuth(tokenEndpointAuth) {
 }
 /** A request waits on a discovery retry, so bound it (the SSO plugin uses 10s too). */
 const DISCOVERY_RETRY_TIMEOUT_MS = 1e4;
+const MAX_DISCOVERY_REDIRECTS = 5;
 /**
 * Providers skipped because startup discovery failed. Init stores them on each auth
 * instance's context, so one plugin object can serve several instances. It is a context
@@ -44,18 +45,35 @@ const readIdTokenClaims = (idToken) => {
 	}
 };
 async function fetchDiscovery(url, headers, timeout) {
-	const result = await betterFetch(url, {
-		method: "GET",
-		headers,
-		signal: timeout ? AbortSignal.timeout(timeout) : void 0
-	});
-	if (result.error || !result.data) return null;
-	if (result.data.issuer) try {
-		new URL(result.data.issuer);
-	} catch {
-		return null;
+	const signal = timeout ? AbortSignal.timeout(timeout) : void 0;
+	let target = url;
+	for (let hop = 0;; hop++) {
+		const redirect = {};
+		const result = await betterFetch(target, {
+			method: "GET",
+			headers,
+			redirect: headers ? "manual" : void 0,
+			signal,
+			onError: ({ response }) => {
+				if (response.status >= 300 && response.status < 400) redirect.location = response.headers.get("location");
+			}
+		});
+		if (headers && redirect.location) {
+			const next = new URL(redirect.location, target);
+			if (next.origin !== new URL(url).origin) throw new Error(`discovery redirected to ${next.origin}; with discoveryHeaders set, only same-origin redirects are followed. Set discoveryUrl to the final URL.`);
+			if (hop >= MAX_DISCOVERY_REDIRECTS) throw new Error(`discovery redirected more than ${MAX_DISCOVERY_REDIRECTS} times. Set discoveryUrl to the final URL.`);
+			target = next.href;
+			continue;
+		}
+		if (headers && result.error?.status === 0) throw new Error("discovery redirected; with discoveryHeaders set, set discoveryUrl to the final URL.");
+		if (result.error || !result.data) return null;
+		if (result.data.issuer) try {
+			new URL(result.data.issuer);
+		} catch {
+			return null;
+		}
+		return result.data;
 	}
-	return result.data;
 }
 async function fetchUserInfo(tokens, userInfoUrl, idTokenClaims) {
 	if (tokens.idToken) {
@@ -128,8 +146,9 @@ const genericOAuth = (options) => {
 							ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
 							continue;
 						}
+						const jwksHeaders = jwksUrl.origin === new URL(c.discoveryUrl).origin ? c.discoveryHeaders : void 0;
 						idTokenConfig = {
-							jwks: createRemoteJWKSet(jwksUrl),
+							jwks: createRemoteJWKSet(jwksUrl, jwksHeaders && { headers: jwksHeaders }),
 							issuer: discovered.issuer,
 							audience: c.clientId,
 							algorithms: isOidc ? signingAlgs : void 0
@@ -287,7 +306,8 @@ const genericOAuth = (options) => {
 						authentication: c.authentication,
 						tokenEndpointAuth,
 						tokenEndpoint: tokenUrl,
-						extraParams: resolvedRefreshParams
+						extraParams: resolvedRefreshParams,
+						headers: c.authorizationHeaders
 					});
 					return applyDefaultAccessTokenExpiry(tokens, c.accessTokenExpiresIn);
 				},
@@ -303,18 +323,13 @@ const genericOAuth = (options) => {
 		}
 		return genericProviders;
 	};
-	const retryDiscovery = (ctx, providerId) => {
+	const retryDiscovery = async (ctx, providerId) => {
 		const pendingDiscovery = getPendingDiscovery(ctx);
 		const pending = pendingDiscovery?.get(providerId);
 		if (!pending) return;
-		pending.attempt ??= buildProviders([pending.config], ctx, DISCOVERY_RETRY_TIMEOUT_MS).then(([provider]) => {
-			if (!provider) return;
-			pendingDiscovery?.delete(providerId);
-			ctx.socialProviders.unshift(provider);
-		}).finally(() => {
-			pending.attempt = void 0;
-		});
-		return pending.attempt;
+		const [provider] = await buildProviders([pending], ctx, DISCOVERY_RETRY_TIMEOUT_MS);
+		if (!provider || !pendingDiscovery?.delete(providerId)) return;
+		ctx.socialProviders.unshift(provider);
 	};
 	const requestedProviderId = (context) => {
 		const id = context.body?.provider ?? context.body?.providerId ?? context.query?.provider ?? context.params?.id;
@@ -326,7 +341,7 @@ const genericOAuth = (options) => {
 		init: async (ctx) => {
 			const genericProviders = await buildProviders(options.config, ctx);
 			const built = new Set(genericProviders.map((p) => p.id));
-			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, { config: c }]));
+			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, c]));
 			const existingIds = new Set(ctx.socialProviders.map((p) => p.id));
 			for (const gp of genericProviders) if (existingIds.has(gp.id)) ctx.logger.warn(`Generic OAuth provider "${gp.id}" shadows a built-in social provider with the same ID`);
 			return { context: {

package/dist/plugins/generic-oauth/types.d.mts

@@ -211,12 +211,15 @@ export interface GenericOAuthConfig<ID extends string = string> {
    */
   authentication?: ("basic" | "post") | undefined;
   /**
-   * Custom headers to include in the discovery request.
+   * Custom headers to include in the discovery request, and in the JWKS request when
+   * `jwks_uri` has the same origin as `discoveryUrl`. When set, discovery follows
+   * redirects only within that origin and fails on a redirect to another origin.
    * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
    */
   discoveryHeaders?: Record<string, string> | undefined;
   /**
-   * Custom headers to include in the authorization request.
+   * Custom headers to include in token endpoint requests: the authorization
+   * code exchange and token refresh.
    * Useful for providers like Qonto that require specific headers (e.g., X-Qonto-Staging-Token for local development).
    */
   authorizationHeaders?: Record<string, string> | undefined;

package/dist/plugins/siwe/index.mjs

@@ -274,9 +274,9 @@ const siwe = (options) => {
 					});
 				} catch (error) {
 					if (isAPIError(error)) throw error;
+					ctx.context.logger.error("Failed to verify SIWE message", error);
 					throw APIError.fromStatus("UNAUTHORIZED", {
 						message: "Something went wrong. Please try again later.",
-						error: error instanceof Error ? error.message : "Unknown error",
 						status: 401
 					});
 				}

package/dist/state.d.mts

@@ -1,6 +1,7 @@
 import { GenericEndpointContext } from "@better-auth/core";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
+import { getAuthStateVerificationIdentifier } from "@better-auth/core/utils/state";
 //#region src/state.d.ts
 declare const stateDataSchema: z.ZodObject<{
   callbackURL: z.ZodString;
@@ -19,10 +20,6 @@ declare const stateDataSchema: z.ZodObject<{
   serverContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$loose>;
 export type StateData = z.infer<typeof stateDataSchema>;
-/**
- * Verification key for database-backed OAuth and SAML relay state.
- */
-export declare const getAuthStateVerificationIdentifier: (state: string) => string;
 export declare function generateGenericState(c: GenericEndpointContext, stateData: StateData, settings?: {
   cookieName: string;
 }): Promise<{
@@ -50,4 +47,4 @@ export declare function parseGenericState(c: GenericEndpointContext, state: stri
   serverContext?: Record<string, unknown> | undefined;
 }>;
 //#endregion
-export {};
+export { getAuthStateVerificationIdentifier };

package/dist/state.mjs

@@ -4,6 +4,7 @@ import { expireCookie } from "./cookies/index.mjs";
 import { derivePurposeKey } from "./crypto/purpose.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
+import { getAuthStateVerificationIdentifier } from "@better-auth/core/utils/state";
 //#region src/state.ts
 const stateDataSchema = z.looseObject({
 	callbackURL: z.string(),
@@ -34,10 +35,6 @@ const stateDataSchema = z.looseObject({
 	*/
 	serverContext: z.record(z.string(), z.unknown()).optional()
 });
-/**
-* Verification key for database-backed OAuth and SAML relay state.
-*/
-const getAuthStateVerificationIdentifier = (state) => `auth-state:${state}`;
 const INTERNAL_STATE_KEYS = new Set(Object.keys(stateDataSchema.shape));
 var StateError = class extends BetterAuthError {
 	code;

package/dist/utils/hide-metadata.d.mts

@@ -1,5 +1,2 @@
-//#region src/utils/hide-metadata.d.ts
-export declare const HIDE_METADATA: {
-  readonly scope: "server";
-};
-//#endregion
+import { HIDE_METADATA } from "@better-auth/core/api";
+export { HIDE_METADATA };

package/dist/utils/hide-metadata.mjs

@@ -1,4 +1 @@
-//#region src/utils/hide-metadata.ts
-const HIDE_METADATA = { scope: "server" };
-//#endregion
-export { HIDE_METADATA };
+export { HIDE_METADATA } from "@better-auth/core/api";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.19",
+  "version": "1.7.21",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -503,13 +503,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.19",
-    "@better-auth/drizzle-adapter": "1.7.19",
-    "@better-auth/kysely-adapter": "1.7.19",
-    "@better-auth/memory-adapter": "1.7.19",
-    "@better-auth/mongo-adapter": "1.7.19",
-    "@better-auth/prisma-adapter": "1.7.19",
-    "@better-auth/telemetry": "1.7.19"
+    "@better-auth/core": "1.7.21",
+    "@better-auth/drizzle-adapter": "1.7.21",
+    "@better-auth/kysely-adapter": "1.7.21",
+    "@better-auth/memory-adapter": "1.7.21",
+    "@better-auth/mongo-adapter": "1.7.21",
+    "@better-auth/prisma-adapter": "1.7.21",
+    "@better-auth/telemetry": "1.7.21"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",