better-auth 1.7.7 → 1.7.8

package/dist/api/routes/password.mjs

@@ -1,7 +1,7 @@
 import { originCheck } from "../middlewares/origin-check.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { sensitiveSessionMiddleware } from "./session.mjs";
-import { assertPasswordNotTooLong, assertPasswordNotTooShort, validatePassword } from "../../utils/password.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword, validatePassword } from "../../utils/password.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -152,21 +152,15 @@ const resetPassword = createAuthEndpoint("/reset-password", {
 	assertPasswordNotTooShort(ctx, newPassword);
 	assertPasswordNotTooLong(ctx, newPassword);
 	const id = `reset-password:${token}`;
-	const verification = await ctx.context.internalAdapter.consumeVerificationValue(id);
-	if (!verification) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);
+	const verification = await ctx.context.internalAdapter.findVerificationValue(id);
+	if (!verification || verification.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);
 	const userId = verification.value;
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
-	const hashedPassword = await ctx.context.password.hash(newPassword);
-	if (!await ctx.context.internalAdapter.findCredentialAccount(userId)) await ctx.context.internalAdapter.createAccount({
-		userId,
-		providerId: "credential",
-		accountId: user.id,
-		password: hashedPassword
+	await resetCredentialPassword(ctx, userId, await ctx.context.password.hash(newPassword), async () => {
+		if (!await ctx.context.internalAdapter.consumeVerificationValue(id)) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);
 	});
-	else await ctx.context.internalAdapter.updatePassword(userId, hashedPassword);
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
-	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(userId);
 	return ctx.json({ status: true });
 });
 const verifyPassword = createAuthEndpoint("/verify-password", {

package/dist/api/routes/sign-in.mjs

@@ -10,7 +10,6 @@ import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { assertPasswordNotTooLong } from "../../utils/password.mjs";
-import "../../utils/index.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";

package/dist/api/routes/sign-up.mjs

@@ -252,7 +252,7 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			token: null,
 			user: parseUserOutput(ctx.context.options, createdUser)
 		});
-		const session = await ctx.context.internalAdapter.createSession(createdUser.id, rememberMe === false);
+		const session = await ctx.context.internalAdapter.createSession(createdUser.id, rememberMe === false, void 0, void 0, { deferSecondaryStorageWrites: true });
 		if (!session) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
 		await setSessionCookie(ctx, {
 			session,

package/dist/api/routes/update-user.mjs

@@ -5,6 +5,7 @@ import { deleteSessionCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
+import { runWithTransaction } from "@better-auth/core/context";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -169,12 +170,16 @@ const changePassword = createAuthEndpoint("/change-password", {
 		hash: account.password,
 		password: currentPassword
 	})) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
-	await ctx.context.internalAdapter.updateAccount(account.id, { password: passwordHash });
+	const newSession = await runWithTransaction(ctx.context.adapter, async () => {
+		if (revokeOtherSessions) await ctx.context.internalAdapter.deleteUserSessions(session.user.id);
+		await ctx.context.internalAdapter.updateAccount(account.id, { password: passwordHash });
+		if (!revokeOtherSessions) return null;
+		const created = await ctx.context.internalAdapter.createSession(session.user.id, void 0, void 0, void 0, { deferSecondaryStorageWrites: true });
+		if (!created) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_GET_SESSION);
+		return created;
+	});
 	let token = null;
-	if (revokeOtherSessions) {
-		await ctx.context.internalAdapter.deleteUserSessions(session.user.id);
-		const newSession = await ctx.context.internalAdapter.createSession(session.user.id);
-		if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_GET_SESSION);
+	if (newSession) {
 		await setSessionCookie(ctx, {
 			session: newSession,
 			user: session.user

package/dist/cookies/index.d.mts

@@ -10,7 +10,7 @@ import { JSONWebKeySet } from "jose";
 declare function createCookieGetter(options: BetterAuthOptions): (cookieName: string, overrideAttributes?: Partial<CookieOptions>) => {
   name: string;
   attributes: {
-    domain?: string;
+    domain?: string | undefined;
     expires?: Date;
     httpOnly: boolean;
     maxAge?: number;
@@ -25,7 +25,7 @@ declare function getCookies(options: BetterAuthOptions): {
   sessionToken: {
     name: string;
     attributes: {
-      domain?: string;
+      domain?: string | undefined;
       expires?: Date;
       httpOnly: boolean;
       maxAge?: number;
@@ -43,7 +43,7 @@ declare function getCookies(options: BetterAuthOptions): {
   sessionData: {
     name: string;
     attributes: {
-      domain?: string;
+      domain?: string | undefined;
       expires?: Date;
       httpOnly: boolean;
       maxAge?: number;
@@ -57,7 +57,7 @@ declare function getCookies(options: BetterAuthOptions): {
   dontRememberToken: {
     name: string;
     attributes: {
-      domain?: string;
+      domain?: string | undefined;
       expires?: Date;
       httpOnly: boolean;
       maxAge?: number;
@@ -71,7 +71,7 @@ declare function getCookies(options: BetterAuthOptions): {
   accountData: {
     name: string;
     attributes: {
-      domain?: string;
+      domain?: string | undefined;
       expires?: Date;
       httpOnly: boolean;
       maxAge?: number;

package/dist/db/get-migration.mjs

@@ -1,5 +1,4 @@
-import { getSchema } from "./get-schema.mjs";
-import { getAuthTables } from "@better-auth/core/db";
+import { buildSchema } from "./get-schema.mjs";
 import { createLogger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
@@ -342,8 +341,7 @@ function matchType(columnDataType, fieldType, dbType) {
 * existing or already-planned index.
 */
 async function getMigrations(config, { throwOnUnsafe = true } = {}) {
-	const betterAuthSchema = getSchema(config);
-	const authTables = getAuthTables(config);
+	const { schema: betterAuthSchema, tables: authTables, referenceKeys } = buildSchema(config);
 	const logger = createLogger(config.logger);
 	const unsafeChanges = [];
 	const reportUnsafeChange = (message) => {
@@ -562,14 +560,18 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		schema: authTables,
 		usePlural: false
 	});
-	function getReferencePath(model, field) {
+	function getReferencePath(field) {
+		const reference = field.references;
+		if (!reference) throw new BetterAuthError("Cannot resolve a field without references.");
+		const keys = referenceKeys.get(field);
+		if (!keys) throw new BetterAuthError(`Missing migration reference metadata for "${reference.model}.${reference.field}".`);
 		try {
-			return `${getModelName(model)}.${getFieldName({
-				model,
-				field
+			return `${getModelName(keys.modelKey)}.${getFieldName({
+				model: keys.modelKey,
+				field: keys.fieldKey
 			})}`;
 		} catch {
-			return `${model}.${field}`;
+			return `${reference.model}.${reference.field}`;
 		}
 	}
 	const deferredIndexes = [];
@@ -614,7 +616,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 			}
 			const built = builder.addColumn(fieldName, type, (col) => {
 				col = field.required !== false ? col.notNull() : col;
-				if (field.references) col = col.references(getReferencePath(field.references.model, field.references.field)).onDelete(field.references.onDelete || "cascade");
+				if (field.references) col = col.references(getReferencePath(field)).onDelete(field.references.onDelete || "cascade");
 				if (timestampDefault) if (dbType === "mysql") col = col.defaultTo(sql`CURRENT_TIMESTAMP(3)`);
 				else col = col.defaultTo(sql`CURRENT_TIMESTAMP`);
 				else if (staticDefault) col = col.defaultTo(typeof field.defaultValue === "boolean" && (dbType === "sqlite" || dbType === "mssql") ? field.defaultValue ? 1 : 0 : field.defaultValue);
@@ -642,7 +644,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 			const type = getType(field, fieldName, getTableIndexStringLength(table.table, fieldName));
 			dbT = dbT.addColumn(fieldName, type, (col) => {
 				col = field.required !== false ? col.notNull() : col;
-				if (field.references) col = col.references(getReferencePath(field.references.model, field.references.field)).onDelete(field.references.onDelete || "cascade");
+				if (field.references) col = col.references(getReferencePath(field)).onDelete(field.references.onDelete || "cascade");
 				if (field.unique) col = col.unique();
 				if (field.type === "date" && typeof field.defaultValue === "function" && (dbType === "postgres" || dbType === "mysql" || dbType === "mssql")) if (dbType === "mysql") col = col.defaultTo(sql`CURRENT_TIMESTAMP(3)`);
 				else col = col.defaultTo(sql`CURRENT_TIMESTAMP`);

package/dist/db/get-schema.mjs

@@ -1,22 +1,34 @@
 import { getAuthTablesWithResolvedIndexes } from "@better-auth/core/db/internal";
 //#region src/db/get-schema.ts
 function getSchema(config) {
+	return buildSchema(config).schema;
+}
+/**
+* @internal
+*/
+function buildSchema(config) {
 	const { indexesByTable, tables } = getAuthTablesWithResolvedIndexes(config);
+	const referenceKeys = /* @__PURE__ */ new Map();
 	const schema = {};
 	for (const key in tables) {
 		const table = tables[key];
 		const fields = table.fields;
 		const actualFields = {};
 		Object.entries(fields).forEach(([key, field]) => {
-			actualFields[field.fieldName || key] = field;
-			if (field.references) {
-				const refTable = tables[field.references.model];
-				if (refTable) actualFields[field.fieldName || key].references = {
-					...field.references,
-					model: refTable.modelName,
-					field: field.references.field
-				};
-			}
+			const reference = field.references;
+			const refTable = reference ? tables[reference.model] : void 0;
+			const actualField = reference && refTable ? {
+				...field,
+				references: {
+					...reference,
+					model: refTable.modelName
+				}
+			} : field;
+			actualFields[field.fieldName || key] = actualField;
+			if (reference) referenceKeys.set(actualField, {
+				modelKey: reference.model,
+				fieldKey: reference.field
+			});
 		});
 		if (schema[table.modelName]) {
 			schema[table.modelName].fields = {
@@ -33,7 +45,11 @@ function getSchema(config) {
 		};
 	}
 	for (const [tableName, indexes] of indexesByTable) if (schema[tableName]) schema[tableName].indexes = indexes;
-	return schema;
+	return {
+		schema,
+		tables,
+		referenceKeys
+	};
 }
 //#endregion
-export { getSchema };
+export { buildSchema, getSchema };

package/dist/db/internal-adapter.mjs

@@ -7,8 +7,8 @@ import { getCurrentAdapter, getCurrentAuthEndpointContext, queueAfterTransaction
 import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { encodeDeterministicId } from "@better-auth/core/db/internal";
 import { getIP } from "@better-auth/core/utils/ip";
-import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 //#region src/db/internal-adapter.ts
 function getTTLSeconds(expiresAt, now = Date.now()) {
@@ -21,6 +21,7 @@ const createInternalAdapter = (adapter, ctx) => {
 	const secondaryStorage = options.secondaryStorage;
 	const verificationConsumeLocks = /* @__PURE__ */ new Map();
 	const sessionExpiration = options.session?.expiresIn || 3600 * 24 * 7;
+	const databaseSessionFallbackEnabled = !!secondaryStorage && options.session?.storeSessionInDatabase === true && options.session?.preserveSessionInDatabase !== true;
 	const { createWithHooks, updateWithHooks, updateManyWithHooks, deleteWithHooks, deleteManyWithHooks, consumeOneWithHooks } = getWithHooks(adapter, ctx);
 	/**
 	* Ends the live session rows matched by `where` without physically deleting
@@ -175,6 +176,17 @@ const createInternalAdapter = (adapter, ctx) => {
 			}, "account", void 0);
 		},
 		listSessions: async (userId, options) => {
+			if (databaseSessionFallbackEnabled) return (await (await getCurrentAdapter(adapter)).findMany({
+				model: "session",
+				where: [{
+					field: "userId",
+					value: userId
+				}, {
+					field: "expiresAt",
+					value: /* @__PURE__ */ new Date(),
+					operator: "gt"
+				}]
+			})).map((session) => parseSessionOutput(ctx.options, session));
 			if (secondaryStorage) {
 				const currentList = await secondaryStorage.get(`active-sessions-${userId}`);
 				if (!currentList) return [];
@@ -250,7 +262,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				return ctx?.headers || ctx?.request?.headers;
 			})();
 			const storeInDb = options.session?.storeSessionInDatabase;
-			const databaseSessionFallbackEnabled = storeInDb === true && options.session?.preserveSessionInDatabase !== true;
+			const deferMirror = storageOptions?.deferSecondaryStorageWrites === true && databaseSessionFallbackEnabled;
 			const { id: _, ...rest } = override || {};
 			let sessionId;
 			if (secondaryStorage && !storeInDb) {
@@ -305,18 +317,18 @@ const createInternalAdapter = (adapter, ctx) => {
 				}), sessionTTL);
 				return sessionData;
 			};
-			const res = await createWithHooks(data, "session", secondaryStorage ? {
+			return await createWithHooks(data, "session", secondaryStorage ? {
 				fn: async (sessionData) => {
-					return storageOptions?.deferSecondaryStorageWrites ? sessionData : mirrorSessionToSecondaryStorage(sessionData);
+					if (!deferMirror) return mirrorSessionToSecondaryStorage(sessionData);
+					await queueAfterTransactionHook(async () => {
+						await mirrorSessionToSecondaryStorage(sessionData);
+					}, { onError(error) {
+						logger.error("Failed to mirror committed session to secondary storage", error);
+					} });
+					return sessionData;
 				},
 				executeMainFn: storeInDb
 			} : void 0);
-			if (secondaryStorage && storageOptions?.deferSecondaryStorageWrites && res) await queueAfterTransactionHook(async () => {
-				await mirrorSessionToSecondaryStorage(res);
-			}, databaseSessionFallbackEnabled ? { onError(error) {
-				logger.error("Failed to mirror committed session to secondary storage", error);
-			} } : void 0);
-			return res;
 		},
 		findSession: async (token) => {
 			if (secondaryStorage) {
@@ -357,54 +369,57 @@ const createInternalAdapter = (adapter, ctx) => {
 			};
 		},
 		findSessions: async (sessionTokens, options) => {
-			if (secondaryStorage) {
-				const sessions = [];
-				for (const sessionToken of sessionTokens) {
-					const sessionStringified = await secondaryStorage.get(sessionToken);
-					if (sessionStringified) try {
-						const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
-						if (!s) continue;
-						const expiresAt = new Date(s.session.expiresAt);
-						if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
-						const session = {
-							session: {
-								...s.session,
-								expiresAt: new Date(s.session.expiresAt)
-							},
-							user: {
-								...s.user,
-								createdAt: new Date(s.user.createdAt),
-								updatedAt: new Date(s.user.updatedAt)
-							}
-						};
-						sessions.push(session);
-					} catch {
-						continue;
-					}
+			const uniqueTokens = [...new Set(sessionTokens)];
+			const sessionsByToken = /* @__PURE__ */ new Map();
+			const missingTokens = [];
+			if (secondaryStorage) for (const sessionToken of uniqueTokens) {
+				const sessionStringified = await secondaryStorage.get(sessionToken);
+				if (sessionStringified) try {
+					const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
+					if (!s) continue;
+					const expiresAt = new Date(s.session.expiresAt);
+					if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
+					const session = {
+						session: {
+							...s.session,
+							expiresAt: new Date(s.session.expiresAt)
+						},
+						user: {
+							...s.user,
+							createdAt: new Date(s.user.createdAt),
+							updatedAt: new Date(s.user.updatedAt)
+						}
+					};
+					sessionsByToken.set(sessionToken, session);
+				} catch {
+					continue;
 				}
-				return sessions;
+				else missingTokens.push(sessionToken);
 			}
-			const sessions = await (await getCurrentAdapter(adapter)).findMany({
-				model: "session",
-				where: [{
-					field: "token",
-					value: sessionTokens,
-					operator: "in"
-				}, ...options?.onlyActiveSessions ? [{
-					field: "expiresAt",
-					value: /* @__PURE__ */ new Date(),
-					operator: "gt"
-				}] : []],
-				join: { user: true }
-			});
-			if (!sessions.length) return [];
-			if (sessions.some((session) => !session.user)) return [];
-			return sessions.map((_session) => {
-				const { user, ...session } = _session;
-				return {
+			const databaseTokens = secondaryStorage ? missingTokens : uniqueTokens;
+			if (databaseTokens.length > 0 && (!secondaryStorage || databaseSessionFallbackEnabled)) {
+				const databaseSessions = await (await getCurrentAdapter(adapter)).findMany({
+					model: "session",
+					limit: databaseTokens.length,
+					where: [{
+						field: "token",
+						value: databaseTokens,
+						operator: "in"
+					}, ...options?.onlyActiveSessions ? [{
+						field: "expiresAt",
+						value: /* @__PURE__ */ new Date(),
+						operator: "gt"
+					}] : []],
+					join: { user: true }
+				});
+				for (const { user, ...session } of databaseSessions) if (user) sessionsByToken.set(session.token, {
 					session,
 					user
-				};
+				});
+			}
+			return uniqueTokens.flatMap((token) => {
+				const session = sessionsByToken.get(token);
+				return session ? [session] : [];
 			});
 		},
 		updateSession: async (sessionToken, session) => {
@@ -868,7 +883,9 @@ const createInternalAdapter = (adapter, ctx) => {
 		* already taken.
 		*
 		* The `verification.identifier` column is non-unique, so uniqueness comes
-		* from a deterministic primary key (`SHA-256` of `reserve:<identifier>`).
+		* from a deterministic primary key (`SHA-256` of `reserve:<identifier>`,
+		* encoded by `encodeDeterministicId` so the configured id strategy keeps
+		* it; see its note on `generateId: "serial"`).
 		* The database path is atomic: the primary key turns the INSERT into the
 		* first-writer-wins gate, and a duplicate is detected portably by
 		* re-reading the row rather than matching adapter-specific errors.
@@ -882,7 +899,7 @@ const createInternalAdapter = (adapter, ctx) => {
 		* is best-effort there (it is intended for development and tests).
 		*/
 		reserveVerificationValue: async (data) => {
-			const reservationId = base64Url.encode(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), { padding: false });
+			const reservationId = encodeDeterministicId(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), options);
 			const storageOption = getStorageOption(data.identifier, options.verification?.storeIdentifier);
 			const storedIdentifier = await processIdentifier(data.identifier, storageOption);
 			if (secondaryStorage && !options.verification?.storeInDatabase) throw new BetterAuthError("reserveVerificationValue requires database-backed verification storage. Set verification.storeInDatabase to true for flows that reserve verification values.");

package/dist/db/to-zod.d.mts

@@ -11,10 +11,10 @@ declare function toZodSchema<Fields extends Record<string, DBFieldAttribute | ne
    * If true, then any fields that have `input: false` will be removed from the schema to prevent user input.
    */
   isClientSide: IsClientSide;
-}): z.ZodObject<RemoveNeverProps<{ [key in keyof Fields]: FieldAttributeToSchema<Fields[key], IsClientSide> }>, z.core.$strip>;
-type FieldAttributeToSchema<Field extends DBFieldAttribute | Record<string, never>, isClientSide extends boolean = false> = Field extends {
-  type: any;
-} ? GetInput<isClientSide, Field, GetRequired<Field, GetType<Field>>> : Record<string, never>;
+}): ZodSchemaForSide<Fields, IsClientSide>;
+type ZodSchemaForSide<Fields extends Record<string, DBFieldAttribute | never>, IsClientSide extends boolean> = IsClientSide extends true ? z.ZodObject<SchemaShape<Fields, true>, z.core.$strip> : z.ZodObject<SchemaShape<Fields, false>, z.core.$strip>;
+type SchemaShape<Fields extends Record<string, DBFieldAttribute | never>, IsClientSide extends boolean> = RemoveNeverProps<{ [key in keyof Fields]: FieldAttributeToSchema<Fields[key], IsClientSide> }>;
+type FieldAttributeToSchema<Field extends DBFieldAttribute | Record<string, never>, isClientSide extends boolean = false> = Field extends DBFieldAttribute ? GetSchemaForSide<isClientSide, Field, GetRequired<Field, GetType<Field>>> : Record<string, never>;
 type GetType<F extends DBFieldAttribute> = F extends {
   type: "string";
 } ? z.ZodString : F extends {
@@ -27,9 +27,11 @@ type GetType<F extends DBFieldAttribute> = F extends {
 type GetRequired<F extends DBFieldAttribute, Schema extends z.core.SomeType> = F extends {
   required: false;
 } ? z.ZodOptional<z.ZodNullable<Schema>> : Schema;
-type GetInput<isClientSide extends boolean, Field extends DBFieldAttribute, Schema extends z.core.SomeType> = Field extends {
+type GetSchemaForSide<isClientSide extends boolean, Field extends DBFieldAttribute, Schema extends z.core.SomeType> = isClientSide extends true ? Field extends {
   input: false;
-} ? isClientSide extends true ? never : Schema : Schema;
+} ? never : Schema : Field extends {
+  returned: false;
+} ? never : Schema;
 type RemoveNeverProps<T> = { [K in keyof T as [T[K]] extends [never] ? never : K]: T[K] };
 //#endregion
 export { FieldAttributeToSchema, toZodSchema };

package/dist/db/to-zod.mjs

@@ -1,15 +1,25 @@
 import * as z from "zod";
 //#region src/db/to-zod.ts
+/**
+* Static lookup keeps `zod` tree-shakeable. `z[field.type]()` forces bundlers
+* to retain every `zod` export, including all locales.
+*/
+const scalarSchemas = {
+	string: z.string,
+	number: z.number,
+	boolean: z.boolean,
+	date: z.date
+};
 function toZodSchema({ fields, isClientSide }) {
 	const zodFields = Object.keys(fields).reduce((acc, key) => {
 		const field = fields[key];
 		if (!field) return acc;
 		if (isClientSide && field.input === false) return acc;
 		let schema;
-		if (field.type === "json") schema = z.json ? z.json() : z.any();
+		if (field.type === "json") schema = z.json();
 		else if (field.type === "string[]" || field.type === "number[]") schema = z.array(field.type === "string[]" ? z.string() : z.number());
 		else if (Array.isArray(field.type)) schema = z.any();
-		else schema = z[field.type]();
+		else schema = scalarSchemas[field.type]();
 		if (field?.required === false) schema = schema.nullish();
 		if (!isClientSide && field?.returned === false) return acc;
 		return {

package/dist/index.mjs

@@ -2,7 +2,6 @@ import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProt
 import { generateGenericState, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
-import "./utils/index.mjs";
 import { APIError } from "./api/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
 import { getCurrentAdapter } from "@better-auth/core/context";

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.7";
+var version = "1.7.8";
 //#endregion
 export { version };

package/dist/plugins/custom-session/index.mjs

@@ -37,25 +37,18 @@ const customSession = (fn, options, pluginOptions) => {
 			},
 			requireHeaders: true
 		}, async (ctx) => {
-			const session = await getSession()({
+			const { headers, response } = await getSession()({
 				...ctx,
 				method: "GET",
 				asResponse: false,
 				headers: ctx.headers,
 				returnHeaders: true
-			}).catch((e) => {
-				return null;
 			});
-			if (!session?.response) return ctx.json(null);
-			const fnResult = await fn(session.response, ctx);
-			for (const cookieStr of session.headers.getSetCookie()) parseSetCookieHeader(cookieStr).forEach((attrs, name) => {
-				ctx.setCookie(name, attrs.value, toCookieOptions(attrs));
-			});
-			session.headers.delete("set-cookie");
-			session.headers.forEach((value, key) => {
-				ctx.setHeader(key, value);
-			});
-			return ctx.json(fnResult);
+			const sessionPayload = response ? await fn(response, ctx) : null;
+			for (const cookie of headers.getSetCookie()) for (const [name, attributes] of parseSetCookieHeader(cookie)) ctx.setCookie(name, attributes.value, toCookieOptions(attributes));
+			headers.delete("set-cookie");
+			headers.forEach((value, name) => ctx.setHeader(name, value));
+			return ctx.json(sessionPayload);
 		}) },
 		$Infer: { Session: {} },
 		options: pluginOptions

package/dist/plugins/email-otp/routes.mjs

@@ -6,7 +6,7 @@ import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
 import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
-import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, resetCredentialPassword } from "../../utils/password.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
@@ -584,20 +584,18 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	const email = ctx.body.email.toLowerCase();
 	assertPasswordNotTooShort(ctx, ctx.body.password);
 	assertPasswordNotTooLong(ctx, ctx.body.password);
-	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
+	const identifier = toOTPIdentifier("forget-password", email);
+	let otpConsumed = false;
+	if (!await matchesUsableStoredOTP(ctx, opts, identifier, ctx.body.otp)) {
+		await atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp);
+		otpConsumed = true;
+	}
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const passwordHash = await ctx.context.password.hash(ctx.body.password);
-	if (!await ctx.context.internalAdapter.findCredentialAccount(user.user.id)) await ctx.context.internalAdapter.createAccount({
-		userId: user.user.id,
-		providerId: "credential",
-		accountId: user.user.id,
-		password: passwordHash
-	});
-	else await ctx.context.internalAdapter.updatePassword(user.user.id, passwordHash);
+	await resetCredentialPassword(ctx, user.user.id, passwordHash, otpConsumed ? void 0 : () => atomicVerifyOTP(ctx, opts, identifier, ctx.body.otp));
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user: user.user }, ctx.request);
 	if (!user.user.emailVerified) await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
-	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(user.user.id);
 	return ctx.json({ success: true });
 });
 const requestEmailChangeEmailOTPBodySchema = z.object({
@@ -748,6 +746,17 @@ const changeEmailEmailOTP = (opts) => createAuthEndpoint("/email-otp/change-emai
 });
 const defaultOTPGenerator = (options) => generateRandomString(options.otpLength ?? 6, "0-9");
 /**
+* Reports whether the provided OTP matches a stored, unexpired record with
+* attempts left, without consuming it or counting an attempt.
+*/
+async function matchesUsableStoredOTP(ctx, opts, identifier, providedOTP) {
+	const existing = await ctx.context.internalAdapter.findVerificationValue(identifier);
+	if (!existing || existing.expiresAt < /* @__PURE__ */ new Date()) return false;
+	const [otpValue, attempts] = splitAtLastColon(existing.value);
+	if (parseInt(attempts || "0") >= (opts?.allowedAttempts || 3)) return false;
+	return verifyStoredOTP(ctx, opts, otpValue, providedOTP);
+}
+/**
 * Verifies a single-use OTP with race-condition protection.
 *
 * The atomic consume is the single gate: only the first concurrent caller

package/dist/plugins/generic-oauth/index.d.mts

@@ -9,10 +9,12 @@ import { OktaOptions, okta } from "./providers/okta.mjs";
 import { PatreonOptions, patreon } from "./providers/patreon.mjs";
 import { SlackOptions, slack } from "./providers/slack.mjs";
 import { YandexOptions, yandex } from "./providers/yandex.mjs";
+import * as _$_better_auth_core0 from "@better-auth/core";
 import { AuthContext } from "@better-auth/core";
 import * as _$_better_auth_core_oauth20 from "@better-auth/core/oauth2";
 import { OAuthProvider } from "@better-auth/core/oauth2";
 import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
+import * as _$better_call0 from "better-call";
 
 //#region src/plugins/generic-oauth/index.d.ts
 declare module "@better-auth/core" {
@@ -27,6 +29,10 @@ declare module "@better-auth/core" {
  * Extracts common fields from GenericOAuthConfig for provider helpers.
  */
 type BaseOAuthProviderOptions = Pick<GenericOAuthConfig, "clientId" | "clientSecret" | "tokenEndpointAuth" | "scopes" | "redirectURI" | "endSessionEndpoint" | "postLogoutRedirectURI" | "disableProviderLogout" | "pkce" | "disableImplicitSignUp" | "disableSignUp" | "overrideUserInfo">;
+type PendingDiscovery = Map<string, {
+  config: GenericOAuthConfig;
+  attempt?: Promise<void> | undefined;
+}>;
 /**
  * A generic OAuth plugin that registers any OAuth/OIDC provider
  * as a first-class social provider.
@@ -40,8 +46,15 @@ declare const genericOAuth: <const ID extends string>(options: GenericOAuthOptio
   init: (ctx: AuthContext) => Promise<{
     context: {
       socialProviders: OAuthProvider<object, Partial<_$_better_auth_core_oauth20.ProviderOptions<object>>>[];
+      genericOAuthPendingDiscovery: PendingDiscovery;
     };
   }>;
+  hooks: {
+    before: {
+      matcher: (context: _$_better_auth_core0.HookEndpointContext) => boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+    }[];
+  };
   options: GenericOAuthOptions<ID>;
   $ERROR_CODES: {
     INVALID_OAUTH_CONFIGURATION: _$_better_auth_core_utils_error_codes0.RawError<"INVALID_OAUTH_CONFIGURATION">;