better-auth 1.7.2 → 1.7.3

package/dist/client/vue/index.mjs

@@ -6,18 +6,36 @@ import { capitalizeFirstLetter } from "@better-auth/core/utils/string";
 function getAtomKey(str) {
 	return `use${capitalizeFirstLetter(str)}`;
 }
+/** Preserves standard `HeadersInit` values and removes undefined record entries. */
+function toHeadersInit(headers) {
+	if (!headers) return void 0;
+	if (headers instanceof Headers || Array.isArray(headers)) return headers;
+	const normalizedHeaders = {};
+	for (const [name, value] of Object.entries(headers)) if (value !== void 0) normalizedHeaders[name] = value;
+	return normalizedHeaders;
+}
 function createAuthClient(options) {
-	const { baseURL, pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $fetch, $store, atomListeners } = getClientConfig(options, false);
+	const { baseURL, pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $sessionSignal, $fetch, $store, atomListeners } = getClientConfig(options, false);
+	const sessionCacheKey = [
+		"better-auth",
+		"session",
+		options?.baseURL || "inferred",
+		options?.basePath ?? "/api/auth"
+	].join(":");
 	const resolvedHooks = {};
 	for (const [key, value] of Object.entries(pluginsAtoms)) resolvedHooks[getAtomKey(key)] = () => useStore(value);
 	function useSession(useFetch) {
 		if (useFetch) {
-			const ref = useStore(pluginsAtoms.$sessionSignal);
-			return useFetch(`${baseURL}/get-session`, { ref }).then((res) => {
+			const sessionSignal = useStore($sessionSignal);
+			return useFetch(`${baseURL}/get-session`, {
+				headers: toHeadersInit(options?.fetchOptions?.headers),
+				key: sessionCacheKey,
+				watch: [sessionSignal]
+			}).then((result) => {
 				return {
-					data: res.data,
+					data: result.data,
 					isPending: false,
-					error: res.error
+					error: result.error
 				};
 			});
 		}

package/dist/context/create-context.mjs

@@ -15,6 +15,7 @@ import { getAuthTables } from "@better-auth/core/db";
 import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
+import { schemaCheckFor } from "@better-auth/core/db/internal";
 import { socialProviders } from "@better-auth/core/social-providers";
 import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
 import { createTelemetry } from "@better-auth/telemetry";
@@ -227,6 +228,7 @@ Most of the features of Better Auth will not work correctly.`);
 	};
 	const initOrPromise = runPluginInit(ctx);
 	if (isPromise(initOrPromise)) await initOrPromise;
+	ctx.checkSchema = schemaCheckFor(ctx.adapter);
 	return ctx;
 }
 //#endregion

package/dist/cookies/session-store.d.mts

@@ -18,7 +18,6 @@ declare function getAccountCookie(c: GenericEndpointContext): Promise<{
   createdAt: Date;
   updatedAt: Date;
   providerId: string;
-  issuer: string;
   accountId: string;
   userId: string;
   accessToken?: string | null | undefined;

package/dist/cookies/session-store.mjs

@@ -26,13 +26,24 @@ const MAX_COOKIE_CHUNKS = 100;
 function getMaxCookieValueSize(name, options) {
 	return MAX_COOKIE_SIZE - serializeCookie(name, "", { ...options }).length;
 }
+function parseCookieChunkIndex(cookieName, name) {
+	const prefix = `${cookieName}.`;
+	if (!name.startsWith(prefix)) return null;
+	const suffix = name.slice(prefix.length);
+	const index = Number(suffix);
+	if (!Number.isSafeInteger(index) || index < 0 || String(index) !== suffix) return null;
+	return index;
+}
 /**
 * Read all existing chunks from cookies
 */
 function readExistingChunks(cookieName, ctx) {
 	const chunks = {};
 	const cookies = parseCookies(ctx.headers?.get("cookie") || "");
-	for (const [name, value] of cookies) if (name.startsWith(cookieName)) chunks[name] = value;
+	for (const [name, value] of cookies) {
+		if (name !== cookieName && parseCookieChunkIndex(cookieName, name) === null) continue;
+		chunks[name] = value;
+	}
 	return chunks;
 }
 /**
@@ -128,10 +139,10 @@ function getChunkedCookie(ctx, cookieName) {
 	const chunks = [];
 	const cookieHeader = ctx.headers?.get("cookie");
 	if (!cookieHeader) return null;
-	for (const [name, val] of parseCookies(cookieHeader)) if (name.startsWith(cookieName + ".")) {
-		const indexStr = name.split(".").at(-1);
-		const index = parseInt(indexStr || "0", 10);
-		if (!isNaN(index)) chunks.push({
+	for (const [name, val] of parseCookies(cookieHeader)) {
+		const index = parseCookieChunkIndex(cookieName, name);
+		if (index === null) continue;
+		chunks.push({
 			index,
 			value: val
 		});

package/dist/db/adapter-kysely.mjs

@@ -3,10 +3,9 @@ import { BetterAuthError } from "@better-auth/core/error";
 //#region src/db/adapter-kysely.ts
 async function getAdapter(options) {
 	return getBaseAdapter(options, async (opts) => {
-		const { createKyselyAdapter } = await import("../adapters/kysely-adapter/index.mjs");
+		const { createKyselyAdapter, kyselyAdapter } = await import("../adapters/kysely-adapter/index.mjs");
 		const { kysely, databaseType, transaction } = await createKyselyAdapter(opts);
 		if (!kysely) throw new BetterAuthError("Failed to initialize database adapter");
-		const { kyselyAdapter } = await import("../adapters/kysely-adapter/index.mjs");
 		return kyselyAdapter(kysely, {
 			type: databaseType || "sqlite",
 			debugLogs: opts.database && "debugLogs" in opts.database ? opts.database.debugLogs : false,

package/dist/db/get-migration.d.mts

@@ -48,6 +48,7 @@ declare function getMigrations(config: BetterAuthOptions, {
     name: string;
   }[];
   unsafeChanges: string[];
+  schemaProblems: string[];
   runMigrations: () => Promise<void>;
   compileMigrations: () => Promise<string>;
 }>;

package/dist/db/get-migration.mjs

@@ -2,9 +2,9 @@ import { getSchema } from "./get-schema.mjs";
 import { getAuthTables } from "@better-auth/core/db";
 import { createLogger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
-import { createKyselyAdapter } from "@better-auth/kysely-adapter";
+import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
 import { initGetFieldName, initGetModelName } from "@better-auth/core/db/adapter";
-import { getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey } from "@better-auth/core/db/internal";
+import { diffSchema, formatSchemaFinding, getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, invalidateSchemaChecks } from "@better-auth/core/db/internal";
 import { sql } from "kysely";
 //#region src/db/get-migration.ts
 const map = {
@@ -293,7 +293,6 @@ function assertExistingTableIndexFits({ columnBounds, dbType, existingColumns, f
 	}
 	if (requiredBytes > byteBudget) throw new BetterAuthError(`Cannot create database index "${index.name}" on existing table "${table}" because its columns can exceed ${dbType === "mysql" ? "MySQL" : "SQL Server"}'s ${byteBudget}-byte index-key limit. Bound the indexed string columns to the generated schema lengths, resolve oversized values, then run the migration again.`);
 }
-const columnBackfillGuideUrl = "https://better-auth.com/docs/guides/1-7-upgrade-guide#account-identity-is-scoped-by-issuer";
 /**
 * Thrown when {@link getMigrations} refuses to add a required column with no
 * default value to a populated table. Distinct from the plain
@@ -320,27 +319,6 @@ function matchType(columnDataType, fieldType, dbType) {
 	return (Array.isArray(fieldType) ? types["string"].map((t) => t.toLowerCase()) : types[fieldType].map((t) => t.toLowerCase())).includes(normalize(columnDataType));
 }
 /**
-* Get the current PostgreSQL schema (search_path) for the database connection
-* Returns the first schema in the search_path, defaulting to 'public' if not found
-*/
-async function getPostgresSchema(db) {
-	try {
-		const result = await sql`SHOW search_path`.execute(db);
-		const searchPath = result.rows[0]?.search_path ?? result.rows[0]?.searchPath;
-		if (searchPath) return searchPath.split(",").map((s) => s.trim()).map((s) => s.replace(/^["']|["']$/g, "")).filter((s) => !s.startsWith("$") && !s.startsWith("\\$"))[0] || "public";
-	} catch {}
-	return "public";
-}
-async function getMssqlSchema(db) {
-	try {
-		return (await sql`
-			SELECT SCHEMA_NAME() AS "schemaName"
-		`.execute(db)).rows[0]?.schemaName || "dbo";
-	} catch {
-		return "dbo";
-	}
-}
-/**
 * Build the migration plan that `auth migrate` executes and `auth generate`
 * prints for the Kysely adapter.
 *
@@ -357,11 +335,6 @@ async function getMssqlSchema(db) {
 async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 	const betterAuthSchema = getSchema(config);
 	const authTables = getAuthTables(config);
-	const accountIssuer = authTables.account && {
-		table: authTables.account.modelName,
-		column: authTables.account.fields.issuer?.fieldName || "issuer"
-	};
-	const isAccountIssuerColumn = (table, column) => table === accountIssuer?.table && column === accountIssuer.column;
 	const logger = createLogger(config.logger);
 	const unsafeChanges = [];
 	const reportUnsafeChange = (message) => {
@@ -410,6 +383,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		logger.warn(`Could not filter tables by schema. Using all discovered tables. Error: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	else if (dbType === "mssql") tableMetadata = allTableMetadata.filter((table) => table.schema === currentSchema);
+	const schemaProblems = diffSchema(toPhysicalSchema(db, betterAuthSchema), toIntrospectedTables(tableMetadata)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "database"));
 	const toBeCreated = [];
 	const toBeAdded = [];
 	const toBeAddedIndexes = [];
@@ -602,8 +576,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 				}
 				if (populated) {
 					const textDetail = field.type === "string" ? " For a text column, every existing row ends up with the same empty string." : "";
-					const guideLink = isAccountIssuerColumn(table.table, fieldName) ? ` See ${columnBackfillGuideUrl}` : "";
-					reportUnsafeChange(`Cannot add required column "${fieldName}" to populated table "${table.table}": the schema declares no default value, so existing rows have no value to backfill. MySQL accepts this statement instead of rejecting it and fills every existing row with an implicit default for the column type, reporting a successful migration over corrupted data.${textDetail} Add the column as nullable, backfill a correct value for every row, then make it NOT NULL.${guideLink}`);
+					reportUnsafeChange(`Cannot add required column "${fieldName}" to populated table "${table.table}": the schema declares no default value, so existing rows have no value to backfill. MySQL accepts this statement instead of rejecting it and fills every existing row with an implicit default for the column type, reporting a successful migration over corrupted data.${textDetail} Add the column as nullable, backfill a correct value for every row, then make it NOT NULL.`);
 				}
 			}
 			const type = getType(field, fieldName, getTableIndexStringLength(table.table, fieldName));
@@ -668,7 +641,11 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 	}
 	for (const index of deferredIndexes) migrations.push(index);
 	async function runMigrations() {
-		for (const migration of migrations) await migration.execute();
+		try {
+			for (const migration of migrations) await migration.execute();
+		} finally {
+			if (migrations.length && config.database) invalidateSchemaChecks(config.database);
+		}
 	}
 	async function compileMigrations() {
 		return migrations.map((m) => m.compile().sql).join(";\n\n") + ";";
@@ -678,6 +655,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		toBeAdded,
 		toBeAddedIndexes,
 		unsafeChanges,
+		schemaProblems,
 		runMigrations,
 		compileMigrations
 	};

package/dist/db/internal-adapter.mjs

@@ -4,7 +4,6 @@ import { assertValidUserInfo, assertValidUserInfoSource } from "../utils/validat
 import { getStorageOption, processIdentifier } from "./verification-token-storage.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { getCurrentAdapter, getCurrentAuthEndpointContext, queueAfterTransactionHook, runWithTransaction, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { safeJSONParse } from "@better-auth/core/utils/json";
@@ -540,18 +539,21 @@ const createInternalAdapter = (adapter, ctx) => {
 				operator: "in"
 			}], "session", void 0);
 		},
-		findAccountOwnerByKey: async ({ issuer, accountId }) => {
-			const accountWithUser = await (await getCurrentAdapter(adapter)).findOne({
+		findAccountOwnerByKey: async ({ providerId, accountId }) => {
+			const accountsWithUsers = await (await getCurrentAdapter(adapter)).findMany({
 				model: "account",
 				where: [{
-					field: "issuer",
-					value: issuer
+					field: "providerId",
+					value: providerId
 				}, {
 					field: "accountId",
 					value: accountId
 				}],
+				limit: 2,
 				join: { user: true }
 			});
+			if (accountsWithUsers.length > 1) throw new BetterAuthError(`Multiple accounts match the same accountId for provider ${JSON.stringify(providerId)}. Resolve duplicate account identities before continuing.`);
+			const accountWithUser = accountsWithUsers[0];
 			if (!accountWithUser) return null;
 			const { user, ...account } = accountWithUser;
 			return user ? {
@@ -632,10 +634,6 @@ const createInternalAdapter = (adapter, ctx) => {
 					field: "providerId",
 					value: "credential"
 				},
-				{
-					field: "issuer",
-					value: createLocalAccountIssuer("credential")
-				},
 				{
 					field: "accountId",
 					value: userId
@@ -663,10 +661,6 @@ const createInternalAdapter = (adapter, ctx) => {
 						field: "providerId",
 						value: "credential"
 					},
-					{
-						field: "issuer",
-						value: createLocalAccountIssuer("credential")
-					},
 					{
 						field: "accountId",
 						value: userId
@@ -674,17 +668,20 @@ const createInternalAdapter = (adapter, ctx) => {
 				]
 			});
 		},
-		findAccountByKey: async ({ issuer, accountId }) => {
-			return await (await getCurrentAdapter(adapter)).findOne({
+		findAccountByKey: async ({ providerId, accountId }) => {
+			const accounts = await (await getCurrentAdapter(adapter)).findMany({
 				model: "account",
+				limit: 2,
 				where: [{
-					field: "issuer",
-					value: issuer
+					field: "providerId",
+					value: providerId
 				}, {
 					field: "accountId",
 					value: accountId
 				}]
 			});
+			if (accounts.length > 1) throw new BetterAuthError(`Multiple accounts match the same accountId for provider ${JSON.stringify(providerId)}. Resolve duplicate account identities before continuing.`);
+			return accounts[0] ?? null;
 		},
 		findAccountByUserId: async (userId) => {
 			return await (await getCurrentAdapter(adapter)).findMany({

package/dist/db/schema.d.mts

@@ -31,7 +31,6 @@ declare function parseAccountInput(options: BetterAuthOptions, account: Partial<
   createdAt: Date;
   updatedAt: Date;
   providerId: string;
-  issuer: string;
   accountId: string;
   userId: string;
   accessToken?: string | null | undefined;

package/dist/index.mjs

@@ -2,7 +2,6 @@ import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProt
 import { generateGenericState, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
-import "./utils/index.mjs";
 import { APIError } from "./api/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
 import { getCurrentAdapter } from "@better-auth/core/context";

package/dist/oauth2/account-key.mjs

@@ -1,4 +1,3 @@
-import { createOAuthAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES, BetterAuthError } from "@better-auth/core/error";
 //#region src/oauth2/account-key.ts
 /**
@@ -21,11 +20,8 @@ async function resolveOAuthAccountKey(provider, tokens, profile) {
 	const resolvedSubject = await accountSubject(accountKeyContext);
 	const accountId = String(resolvedSubject);
 	if (typeof resolvedSubject === "number" && !Number.isFinite(resolvedSubject) || accountId.trim().length === 0 || accountId === "undefined" || accountId === "null") throw new BetterAuthError("OAUTH_ACCOUNT_SUBJECT_INVALID");
-	const accountIssuer = provider.accountIssuer;
-	const issuer = accountIssuer === void 0 ? createOAuthAccountIssuer(provider.id) : typeof accountIssuer === "function" ? await accountIssuer(accountKeyContext) : accountIssuer;
-	if (typeof issuer !== "string" || issuer.trim().length === 0 || issuer === "undefined" || issuer === "null") throw new BetterAuthError("OAUTH_ACCOUNT_ISSUER_INVALID");
 	return {
-		issuer,
+		providerId: provider.id,
 		accountId
 	};
 }

package/dist/oauth2/link-account.d.mts

@@ -56,7 +56,6 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
     createdAt: Date;
     updatedAt: Date;
     providerId: string;
-    issuer: string;
     accountId: string;
     userId: string;
     accessToken?: string | null | undefined;

package/dist/oauth2/link-account.mjs

@@ -18,7 +18,7 @@ async function handleOAuthUserInfo(c, opts) {
 	const requireExactAccountBinding = !!opts.selectedUser || opts.requireExactAccountBinding === true;
 	let pendingAccountCookie = null;
 	const accountOwner = await c.context.internalAdapter.findAccountOwnerByKey({
-		issuer: account.issuer,
+		providerId: account.providerId,
 		accountId: account.accountId
 	}).catch((e) => {
 		c.context.logger.error("Better auth was unable to query your database.\nError: ", e);
@@ -38,10 +38,6 @@ async function handleOAuthUserInfo(c, opts) {
 				code: "account_ownership_conflict",
 				message: "Account is already linked to another user"
 			});
-			if (requireExactAccountBinding && accountOwner.account.providerId !== account.providerId) throw new APIError("CONFLICT", {
-				code: "account_provider_conflict",
-				message: "Account is already linked through another provider"
-			});
 			return {
 				user: accountOwner.user,
 				linkedAccount: accountOwner.account,
@@ -75,7 +71,7 @@ async function handleOAuthUserInfo(c, opts) {
 	let user = dbUser?.user;
 	const isRegister = !user;
 	if (dbUser) {
-		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.issuer === account.issuer && acc.accountId === account.accountId);
+		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.providerId === account.providerId && acc.accountId === account.accountId);
 		if (!linkedAccount) {
 			const accountLinking = c.context.options.account?.accountLinking;
 			const isTrustedProvider = opts.isTrustedProvider || opts.trustProviderByName !== false && c.context.trustedProviders.includes(account.providerId);
@@ -102,7 +98,6 @@ async function handleOAuthUserInfo(c, opts) {
 				});
 				const createdAccount = await c.context.internalAdapter.linkAccount({
 					providerId: account.providerId,
-					issuer: account.issuer,
 					accountId: account.accountId,
 					userId: dbUser.user.id,
 					accessToken: await setTokenUtil(account.accessToken, c.context),
@@ -116,7 +111,7 @@ async function handleOAuthUserInfo(c, opts) {
 					error: "unable to link account",
 					data: null
 				};
-				if (requireExactAccountBinding && (createdAccount.issuer !== account.issuer || createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
+				if (requireExactAccountBinding && (createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
 					code: "account_hook_binding_conflict",
 					message: "Account hook changed the selected authentication binding"
 				});
@@ -172,7 +167,7 @@ async function handleOAuthUserInfo(c, opts) {
 					error: "unable to update account",
 					data: null
 				};
-				if (requireExactAccountBinding && (updatedAccount.issuer !== account.issuer || updatedAccount.accountId !== account.accountId || updatedAccount.providerId !== account.providerId || updatedAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
+				if (requireExactAccountBinding && (updatedAccount.accountId !== account.accountId || updatedAccount.providerId !== account.providerId || updatedAccount.userId !== dbUser.user.id)) throw new APIError("CONFLICT", {
 					code: "account_hook_binding_conflict",
 					message: "Account hook changed the selected authentication binding"
 				});
@@ -214,7 +209,6 @@ async function handleOAuthUserInfo(c, opts) {
 				refreshTokenExpiresAt: account.refreshTokenExpiresAt,
 				scope: account.scope,
 				providerId: account.providerId,
-				issuer: account.issuer,
 				accountId: account.accountId
 			};
 			const { createdUser, createdAccount } = await runWithTransaction(c.context.adapter, async () => {
@@ -233,7 +227,7 @@ async function handleOAuthUserInfo(c, opts) {
 					})
 				};
 			});
-			if (requireExactAccountBinding && (createdAccount.issuer !== account.issuer || createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== createdUser.id)) throw new APIError("CONFLICT", {
+			if (requireExactAccountBinding && (createdAccount.accountId !== account.accountId || createdAccount.providerId !== account.providerId || createdAccount.userId !== createdUser.id)) throw new APIError("CONFLICT", {
 				code: "account_hook_binding_conflict",
 				message: "Account hook changed the selected authentication binding"
 			});

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.2";
+var version = "1.7.3";
 //#endregion
 export { version };

package/dist/plugins/admin/routes.mjs

@@ -4,7 +4,6 @@ import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cooki
 import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { whereOperators } from "@better-auth/core/db/adapter";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
@@ -203,7 +202,6 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 		const hashedPassword = await ctx.context.password.hash(ctx.body.password);
 		await ctx.context.internalAdapter.linkAccount({
 			providerId: "credential",
-			issuer: createLocalAccountIssuer("credential"),
 			accountId: user.id,
 			password: hashedPassword,
 			userId: user.id
@@ -842,7 +840,6 @@ const setUserPassword = (opts) => createAuthEndpoint("/admin/set-user-password",
 	else await ctx.context.internalAdapter.createAccount({
 		userId,
 		providerId: "credential",
-		issuer: createLocalAccountIssuer("credential"),
 		accountId: user.id,
 		password: hashedPassword
 	});

package/dist/plugins/device-authorization/index.d.mts

@@ -162,37 +162,37 @@ declare const deviceAuthorization: <Grant extends DeviceAuthorizationGrant | und
         client_id: z.ZodString;
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
-      } & (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) : ({
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_1 ? { -readonly [P in keyof T_1]: T_1[P] } : never) : ({
         client_id: z.ZodString;
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
-      } extends infer T_1 extends z.core.util.SomeObject ? { [K in keyof T_1 as K extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } extends infer T_2 extends z.core.util.SomeObject ? { [K in keyof T_2 as K extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K]: T_1[K] } : never) & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K]: T_2[K] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_2 extends z.core.util.SomeObject ? { [K_1 in keyof T_2]: T_2[K_1] } : never)) extends infer T ? { [k in keyof T]: T[k] } : never, z.core.$strip> | z.ZodObject<(("scope" | "user_id" | "client_id") & keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_4 ? { -readonly [P in keyof T_4]: T_4[P] } : never) extends infer T_3 extends z.core.util.SomeObject ? { [K_1 in keyof T_3]: T_3[K_1] } : never)) extends infer T ? { [k in keyof T]: T[k] } : never, z.core.$strip> | z.ZodObject<(("scope" | "user_id" | "client_id") & keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
       }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends never ? {
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
         client_id: z.ZodOptional<z.ZodString>;
-      } & (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) : ({
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_6 ? { -readonly [P in keyof T_6]: T_6[P] } : never) : ({
         user_id: z.ZodOptional<z.ZodString>;
         scope: z.ZodOptional<z.ZodString>;
         client_id: z.ZodOptional<z.ZodString>;
-      } extends infer T_4 extends z.core.util.SomeObject ? { [K_2 in keyof T_4 as K_2 extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      } extends infer T_7 extends z.core.util.SomeObject ? { [K_2 in keyof T_7 as K_2 extends keyof (Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K_2]: T_4[K_2] } : never) & ((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) ? never : K_2]: T_7[K_2] } : never) & (((Grant extends DeviceAuthorizationGrant<infer RequestFields extends Readonly<{
         [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_5 extends z.core.util.SomeObject ? { [K_1 in keyof T_5]: T_5[K_1] } : never)) extends infer T_3 ? { [k_1 in keyof T_3]: T_3[k_1] } : never, z.core.$strip>;
+      }>, Record<string, unknown>> ? RequestFields : Record<never, never>) extends infer T_9 ? { -readonly [P in keyof T_9]: T_9[P] } : never) extends infer T_8 extends z.core.util.SomeObject ? { [K_1 in keyof T_8]: T_8[K_1] } : never)) extends infer T_5 ? { [k_1 in keyof T_5]: T_5[k_1] } : never, z.core.$strip>;
       error: z.ZodObject<{
         error: z.ZodEnum<{ [k_3 in (readonly ["invalid_request", "invalid_client", "unauthorized_client", "invalid_scope", ...Grant extends {
           requestErrorCodes: infer ErrorCodes extends readonly string[];
-        } ? ErrorCodes : readonly [], "server_error"])[number]]: k_3 } extends infer T_6 ? { [k_2 in keyof T_6]: T_6[k_2] } : never>;
+        } ? ErrorCodes : readonly [], "server_error"])[number]]: k_3 } extends infer T_10 ? { [k_2 in keyof T_10]: T_10[k_2] } : never>;
         error_description: z.ZodString;
       }, z.core.$strip>;
       onValidationError: ({

package/dist/plugins/email-otp/routes.mjs

@@ -10,7 +10,6 @@ import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
 import { storeOTP, tryReuseOTP, verifyStoredOTP } from "./otp-token.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import { deprecate } from "@better-auth/core/utils/deprecate";
@@ -593,7 +592,6 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	if (!await ctx.context.internalAdapter.findCredentialAccount(user.user.id)) await ctx.context.internalAdapter.createAccount({
 		userId: user.user.id,
 		providerId: "credential",
-		issuer: createLocalAccountIssuer("credential"),
 		accountId: user.user.id,
 		password: passwordHash
 	});

package/dist/plugins/generic-oauth/index.mjs

@@ -93,7 +93,6 @@ const genericOAuth = (options) => {
 						return null;
 					});
 					if (discovered) {
-						if (!discovered.issuer && !c.accountIssuer) throw new Error(`Provider "${c.providerId}": discovery did not return an issuer. Configure accountIssuer explicitly to establish a stable account namespace.`);
 						authorizationUrl ??= discovered.authorization_endpoint;
 						tokenUrl ??= discovered.token_endpoint;
 						userInfoUrl ??= discovered.userinfo_endpoint;
@@ -106,7 +105,8 @@ const genericOAuth = (options) => {
 							try {
 								jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
 							} catch {
-								throw new Error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document.`);
+								ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
+								continue;
 							}
 							idTokenConfig = {
 								jwks: createRemoteJWKSet(jwksUrl),
@@ -115,16 +115,24 @@ const genericOAuth = (options) => {
 								algorithms: isOidc ? signingAlgs : void 0
 							};
 						}
-					} else if (!c.accountIssuer) throw new Error(`Provider "${c.providerId}": discovery returned no valid data. Provider initialization stopped to keep its account issuer stable.`);
-					else if (!authorizationUrl || !tokenUrl) ctx.logger.error(`Provider "${c.providerId}": discovery returned no data and no explicit endpoints configured. OAuth sign-in will fail for this provider.`);
+					}
+					if (!authorizationUrl || !tokenUrl && !c.getToken) {
+						ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
+						continue;
+					}
+				}
+				if (c.requireIdTokenVerification && !idTokenConfig) {
+					if (c.discoveryUrl) {
+						ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
+						continue;
+					}
+					throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
 				}
-				if (c.requireIdTokenVerification && !idTokenConfig) throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
 				const tokenEndpointAuth = c.tokenEndpointAuth;
 				if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
 				if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
 				if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
 				const accountSubject = c.accountSubject;
-				const accountIssuer = c.accountIssuer;
 				const provider = {
 					id: c.providerId,
 					name: c.name ?? c.providerId,
@@ -137,10 +145,6 @@ const genericOAuth = (options) => {
 						});
 						return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
 					},
-					accountIssuer: typeof accountIssuer === "function" ? ({ tokens, profile }) => accountIssuer({
-						tokens,
-						profile
-					}) : accountIssuer ?? issuer,
 					idToken: idTokenConfig,
 					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
 					allowIdpInitiated: c.allowIdpInitiated,

package/dist/plugins/generic-oauth/providers/auth0.mjs

@@ -27,12 +27,10 @@ function auth0(options) {
 		"profile",
 		"email"
 	];
-	const domain = options.domain.replace(/^https?:\/\//, "").replace(/\/+$/, "");
-	const discoveryUrl = `https://${domain}/.well-known/openid-configuration`;
+	const domainUrl = options.domain.startsWith("http://") || options.domain.startsWith("https://") ? options.domain : `https://${options.domain}`;
 	return {
 		providerId: "auth0",
-		accountIssuer: `https://${domain}/`,
-		discoveryUrl,
+		discoveryUrl: `https://${new URL(domainUrl).host}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,

package/dist/plugins/generic-oauth/providers/keycloak.mjs

@@ -22,20 +22,17 @@
 * ```
 */
 function keycloak(options) {
-	const defaultScopes = [
-		"openid",
-		"profile",
-		"email"
-	];
-	const issuer = options.issuer.replace(/\/$/, "");
 	return {
 		providerId: "keycloak",
-		accountIssuer: issuer,
-		discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+		discoveryUrl: `${options.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,
-		scopes: options.scopes ?? defaultScopes,
+		scopes: options.scopes ?? [
+			"openid",
+			"profile",
+			"email"
+		],
 		redirectURI: options.redirectURI,
 		endSessionEndpoint: options.endSessionEndpoint,
 		postLogoutRedirectURI: options.postLogoutRedirectURI,

package/dist/plugins/generic-oauth/providers/line.mjs

@@ -71,7 +71,6 @@ function line(options) {
 	return {
 		providerId: options.providerId ?? "line",
 		accountSubject: ({ profile }) => profile.sub ?? "",
-		accountIssuer: "https://access.line.me",
 		authorizationUrl,
 		tokenUrl,
 		userInfoUrl,