deps(auth): move the better-auth family off the 1.7.0-rc.2 prerelease onto stable ^1.7.1

[os-warren]

Fixes#3002

The restart condition this card was held on has fired. Re-verified by command, not memory:

$ npm view <pkg> dist-tags
better-auth latest: 1.7.1 (rc: 1.7.0-rc.6, beta: 1.7.0-beta.10)
@better-auth/core latest: 1.7.1
@better-auth/oauth-provider latest: 1.7.1
@better-auth/scim latest: 1.7.1
@better-auth/sso latest: 1.7.1
@better-auth/drizzle-adapter latest: 1.7.1
@better-auth/kysely-adapter latest: 1.7.1
@better-auth/memory-adapter latest: 1.7.1
@better-auth/mongo-adapter latest: 1.7.1
@better-auth/prisma-adapter latest: 1.7.1
@better-auth/telemetry latest: 1.7.1

Every pinned family member has a stable release above the >=1.7.0-beta.4 floor that
GHSA-p2fr-6hmx-4528 and GHSA-j8v8-g9cx-5qf4 are patched in, so the prerelease pin can
finally come off without putting either advisory back on the auth surface.

---

⚠️ Two things a reviewer should read before the diff

1. This PR contains NO data migration

Stated up front because a dependency bump is the wrong place to hide one, and because
packages/plugins/plugin-auth/src/backfill-account-issuer.ts appears in the changed-files
list and will look like exactly that.

It is a two-line comment change. The whole diff to that file:

- * 1.7 restructured account identity: what used to be `account.accountId` is now- * `account.providerAccountId`, and every account carries a REQUIRED `issuer`+ * 1.7 restructured account identity: every account carries a REQUIRED `issuer`
* naming the authority that vouched for that id. Sign-in resolves accounts with
- * `findAccountByKey({ issuer, providerAccountId })`, so a row whose `issuer` is+ * `findAccountByKey({ issuer, accountId })`, so a row whose `issuer` is

backfillAccountIssuer()already exists on main — it landed with the rc.2 upgrade
(#2986), not here. Its behaviour, its trigger, and the rows it touches are byte-for-byte
unchanged by this PR; only its doc comment is corrected, because it described the field under
the rc.2 name that stable renamed back. It stays in the tree because the issuer field is
still required on stable 1.7.1 — verified on the installed package, getAuthTables({}) still
lists issuer first on the account model — so the pre-1.7 gap it closes is still real and
removing it here would break sign-in for legacy rows.

No other line added anywhere in this diff writes to storage. Verified mechanically:

$ git diff origin/main...HEAD -- '*.ts' '*.mjs' | grep '^+' \
| grep -E '\.update\(|\.insert\(|\.delete\(|createAccount|updateMany|backfill|migrat'

returns only prose and identifier hits inside comments and a gate's self-test strings — no
call site. The two createAccount call sites this PR touches
(admin-user-endpoints.ts, the showcase seeder) are existing per-request / per-seed row
creation, not sweeps: each already ran on main, each is guarded by an existence check, and
the only change to either is the camelCase key the vendor renamed. The showcase seeder writes
example fixture data in examples/app-showcase, not platform rows.

The two new sys_oauth_application columns are additive optional declarations — new DDL
on upgrade, no rewrite of existing rows, no default backfilled over anything.

2. File surface — every file outside the claimed surface, and why

Claimed surface was pnpm-workspace.yaml, pnpm-lock.yaml, packages/plugins/plugin-auth/**.
The diff exceeds it. Each extension below is a producer-side consequence of one upstream
fact (the rc.2 → stable field rename, plus two new vendor columns), and each was forced by a
red gate or a red test — none is discretionary widening. Nothing here is a change I wanted to
make; it is where the fix has to land for the bump to work.

out-of-surface file	why the producer-side fix lands here
packages/platform-objects/src/identity/sys-oauth-application.object.ts	oauth-provider 1.7.1 writes clientDiscoveryId and clientCredentialsScopes through the adapter. Without the column declarations POST /oauth2/register 500s at the driver. The remedy location is named by the failing gate's own message: "add the field(s) to packages/platform-objects/src/identity/".
packages/platform-objects/src/apps/translations/*.objects.generated.ts (×4)	Generated, not hand-edited — node scripts/check-i18n-bundles.mjs --write, forced by the two new columns above. check:i18n was red without it.
packages/platform-objects/src/identity/sys-account.object.ts	Two stale prose references to the renamed field. Comments only.
packages/client/src/index.ts	The declared /list-accounts response type said providerAccountId; on stable 1.7 the route answers accountId. Leaving it ships a published type that is factually wrong about the vendor this PR upgrades.
examples/app-showcase/src/security/seed-approval-demo.ts	A second internalAdapter.createAccount call site carrying the rc.2 spelling. Not cosmetic: it wrote persona accounts with no account id, and both demo personas silently stopped being able to sign in (401 INVALID_EMAIL_OR_PASSWORD). Caught by the dogfood suite, not by any unit test.
examples/app-showcase/src/security/demo-personas.ts	One stale prose line describing the same key. Comments only.
packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts	One stale comment line. Comments only.
scripts/check-prerelease-pin-watch.mjs	The gate that watches the exact pin this PR removes. Its follow-up ledger named #3002 — the card this PR closes — so it would have kept pointing the nightly at a closed issue. Now names #3653 alone; self-test updated in lockstep and passes.
scripts/check-type-check-coverage.mjs	One ledger number, written by the gate itself via pnpm check:type-check-debt --lower (plugin-auth TEST_DEBT 111 → 110), which the gate's own output prescribes when a change lowers the count.
content/docs/permissions/authentication.mdx	Documented the mapping as providerAccountId: 'account_id'. On stable 1.7 that is backwards — a reader following it writes exactly the mapping that 500s every sign-up.
.changeset/better-auth-family-stable-1-7.md	Required: this changes the declared dependency ranges of a published package, adds columns to a published platform object, and renames a field in a published client type. All three are consumer-visible.

content/docs/releases/ is deliberately untouched per AGENTS.md; its v15/v17 entries are
accurate records of what those releases did.

---

The pins

pnpm-workspace.yaml overrides and plugin-auth's direct declarations both move to
^1.7.1, in lockstep (check:override-consistency holds them to it — the overrides do not
ship with published packages, so a downstream npx create-objectstack resolves plugin-auth's
own ranges). The selector bounds are reshaped from pkg@<1.7.0-rc.2 to the major
boundarypkg@<2.0.0, which is the shape the file's own header mandates: an exclusive
bound sitting at the target's own version line stops covering the very versions it pinned the
day that version is itself flagged. That retires the better-auth carve-out in the drift note.

The pins are kept rather than dropped, because two of them (oauth-provider, scim) are OSV
floors — same reasoning the file already records for form-data and undici: a transitive
reintroduction must land on the patched line, and dropping a security pin is its own
decision, not a rider on a version bump.

@better-auth/scim stays on 1.7.0-rc.1 — deliberately, and that is not a shortcut.
Measured against the published stable tarball rather than assumed:

$ npm pack @better-auth/scim@1.7.1 && tar xzf …
$ grep -c 'generate-token' package/dist/index.mjs → 0
$ grep -oE '"(scimProvider|scimUser|scimGroup|scimGroupMember|scimSubject|scimConnectionBinding|scimIdentityTombstone)"' package/dist/index.mjs | sort -u
scimConnectionBinding scimGroup scimGroupMember scimIdentityTombstone scimSubject scimUser

Stable ships the rc.2 rewrite: no scimProvider model, no generate-token endpoint, and
all six replacement models present. So moving this pin is the ADR-0071 feature migration
tracked by #3653 — not the version bump this card is. Holding stays security-clean: rc.1 is
above the advisory fix floor, pnpm audit --audit-level=high is green, and rc.1's peer
ranges (better-auth / @better-auth/core at ^1.7.0-rc.1) are satisfied by the stable
1.7.1 the family now resolves to.

Known skew while the hold lasts, stated rather than hidden: scim rc.1 peers
better-call@1.3.7 while better-auth 1.7.1 depends on better-call@1.4.0, so pnpm install
prints one unmet-peer warning and the tree carries a single better-call@1.4.0. Measured
green across the whole plugin-auth suite including the SCIM credential-at-rest arms; it
retires with #3653.

Vendor drift the bump surfaced

Four things changed between rc.2 and stable. Every one was found by a gate or a test
failing — none by reading release notes — and each fix is mechanical parity.

1. The account id field flip-flopped, and it broke every sign-up.1.7.0-rc.2 renamed
account.accountId → providerAccountId; stable 1.7.0/1.7.1 renamed it back to
accountId, keeping the new required issuer. Measured on the installed 1.7.1:

account => issuer, accountId, providerId, userId, accessToken, refreshToken, idToken, …

No providerAccountId anywhere. Carrying the rc.2 spelling left accountId unmapped, so the
adapter asked for a column of that name:

ERROR [Better Auth]: Error: Unknown field 'accountId' on object 'sys_account'
# SERVER_ERROR: … → POST /sign-up/email answers 500

The account_id column is unchanged and no data moves. Fixed in the schema mapping, in the
createAccount call in admin-user-endpoints.ts, in the two mapping pin tests, and in the
client's /list-accounts response type.

2. A second createAccount call site, caught only by the dogfood suite. The showcase
demo-persona seeder carried the same rc.2 spelling, so both demo personas were written with
no account id and silently stopped being able to sign in:

phone.demo@example.com holds a credential account: expected undefined to be truthy
verify signIn failed: 401 {"code":"INVALID_EMAIL_OR_PASSWORD"}

That is precisely the failure #9308 fixture 1 exists to prevent, and precisely the shape its
own comment warns about (a misleading "User not found" pointing at the sys_user row rather
than the account). The admin persona was unaffected, which is why only the persona test
caught it — no unit test would have.

3. oauthClient grew three fields.applicationType is the OIDC spelling of what rc.2
called type, so it maps onto the existingtype column — no data moves.
clientDiscoveryId and clientCredentialsScopes are genuinely new and are now declared on
sys_oauth_application. Without them POST /oauth2/register 500s at the driver.

4. Two new public endpoints.POST /oauth2/end-session and
POST /oauth2/end-session/confirm — the POST form of OIDC RP-initiated logout, whose GET
counterpart was already ledgered. Added to BETTER_AUTH_MOUNTED_SURFACE with that rationale.

The #5024 probe

scripts/check-prerelease-pin-watch.mjs derives its watch list from the prerelease pins, so
after this change it watches exactly one: @better-auth/scim. Its follow-up ledger is
re-pointed at #3653 alone, since #3002 is the card this PR closes. --self-test passes.

Verification record

Every command below was run in this branch's worktree; the summaries are real output. The
dogfood row was re-run at the final head (b679943), not at an earlier commit.

what	result
npm view <pkg> dist-tags × 11	stable 1.7.1 is latest for every family member
pnpm install	lockfile regenerated by pnpm; family resolves to 1.7.1, scim to 1.7.0-rc.1
pnpm audit --audit-level=high	No known vulnerabilities found — both GHSAs stay resolved
plugin-auth suite	55 files, 1263 tests, all passing (5 files / 11 tests were failing before the drift fixes)
plugin-authtsc --noEmit	clean, exit 0
dogfood auth gate family @ b679943	9 files, 64 tests, all passing — showcase-demo-personas-loginable, oidc-authorization-code-flow, oidc-authorize-env-gate, admin-credential-lifecycle, auth-session-audit-trail, bearer-lane-password-change, account-oauth-tokens-not-serialized, session-token-not-serialized, admin-route-nonadmin-refusal. The earlier persona sign-in 401 is fixed and green at the final head.
platform-objects suite	25 files, 419 tests passing
app-showcase suite + tsc	21 files, 337 tests passing; typecheck clean
pnpm check:override-consistency	✓ 8 published-manifest declarations all resolve to their override targets
pnpm check:test-source-alias	✓ 72 packages scanned
pnpm check:type-source-resolution	✓ 76 packages scanned
pnpm check:type-check-coverage / --re-measure	✓ 33 ledger entries re-measured, none above its number
pnpm check:i18n	✓ 9 packages in sync (bundles regenerated with --write)
pnpm check:route-envelope	✓ 16 dispatcher domains, 11 plugin route modules
pnpm check:engine-double-contract	✓ 321 pinned, 2 exempt
pnpm check:where-matcher	✓ 258 matchers, 0 silently-wrong, none new
pnpm check:query-options-erasure	✓ ratchet holds, none new
pnpm check:cross-package-test-inputs	✓ 12 packages, all declared
spec liveness set (empty-state, liveness, strictness-ledger, variant-docs)	✓ all four
changeset set (changeset-fixed, no-major, empty-changeset, adr-0087-registration, objectui-changeset, changeset-gate-self-tests)	✓ all six
docs set (doc-authoring, doc-anchors, docs-audit-scope, affected-docs)	✓ all four
node scripts/check-osv-exemptions.mjs	✓ zero OSV exemptions (the intended steady state)
node scripts/check-prerelease-pin-watch.mjs --self-test	✓ all checks passed

osv-scanner is not installed in this environment; pnpm audit --audit-level=high is the
gate CI runs for these advisories (it is the one named in pnpm-workspace.yaml's own
comments), and it is green.

Action item 5 confirmed against the stable release with no drift: CustomAdapter's
consumeOne / incrementOne are still present and still typecheck against 1.7.1's core, and
sys_jwks.alg / .crv are unchanged — the JWKS and EdDSA-fallback tests pass.

🤖 Generated with Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/client, @objectstack/platform-objects, @objectstack/plugin-auth, touching 15 documentable anchor(s).

18 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 05864fb201b5cfc16335bb80fb23828e4d4d657a.

⛔ 1 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/plugins/plugin-auth/package.json, packages/plugins/plugin-auth/src/backfill-account-issuer.ts) — pages documenting those are invisible to this run
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 45 of 221 client-bound route-ledger rows — the other 176 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run: node scripts/docs-audit/affected-docs.mjs --bridge-coverage

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 05864fb201b5cfc16335bb80fb23828e4d4d657a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 4bdef20df1bda7f148f07912a0c5415e0288feec — the merge of head 59e80dff3dee32ba0db5409657900049730710db into base 05864fb201b5cfc16335bb80fb23828e4d4d657a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4bdef20df1bda7f148f07912a0c5415e0288feec && git checkout 4bdef20df1bda7f148f07912a0c5415e0288feec
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 05864fb201b5cfc16335bb80fb23828e4d4d657a 59e80dff3dee32ba0db5409657900049730710db && git checkout -B drift-repro 05864fb201b5cfc16335bb80fb23828e4d4d657a && git merge --no-ff 59e80dff3dee32ba0db5409657900049730710db
node scripts/docs-audit/affected-docs.mjs --json 05864fb201b5cfc16335bb80fb23828e4d4d657a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 05864fb201b5cfc16335bb80fb23828e4d4d657a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-warren]

Merged origin/main — conflict cleared, re-runs green at the merged head.

The base moved while this branch was in flight and left the PR un-mergeable. Merged with a
merge commit via scripts/pm/os-regen-merge.sh — no rebase, no force-push. origin/main
advanced twice during the operation (55d2993 → 23502e3 → 86431f7); the script re-fetches,
so the merge is against 86431f7.

Merged head: 59e80df. This supersedes the b679943 named in the verification record
above.

One conflict, pnpm-lock.yaml — main carried a dev-dependency bump while this branch
carried the better-auth family move. Resolved by regeneration, never by hand: took
origin/main's lockfile as the base, then re-derived it with pnpm install from the merged
manifests. Both manifests (pnpm-workspace.yaml overrides and
packages/plugins/plugin-auth/package.json) merged with no conflict and kept this
branch's intent, so the regenerated lockfile carries both sides. Verified both are present,
not assumed:

• this branch — better-auth@1.7.1 resolved, plugin-auth specifiers ^1.7.1 ×4 with
  @better-auth/scim still held at 1.7.0-rc.1;
• main — @types/node 26.1.2→26.2.0, eslint 10.8.0→10.8.1,
  @typescript-eslint/parser 8.65.0→8.67.0, svelte 5.56.8→5.56.9, turbo 2.10.7→2.10.10.

On the generated-artifact half: this branch touches nomerge=os-regen path — the
i18n *.objects.generated.ts bundles it does touch are generated but are not routed through
that driver, so the silent-drop trap the script exists to prevent could not apply here. Step 2
was a no-op, node scripts/check-regen-pending.mjs reports no deferral owed, and main touched
no i18n inputs (check:i18n is green with no re-write needed).

Re-runs at 59e80df, after rebuilding the workspace closure (70 tasks, 0 cached — the
dev-dep bumps moved the toolchain):

check	result
pnpm check:override-consistency	✓ 8 published-manifest declarations all resolve to their override targets
pnpm check:i18n	✓ 9 packages, all bundles in sync
pnpm audit --audit-level=high	✓ No known vulnerabilities found — both GHSAs stay resolved
plugin-auth suite	✓ 55 files, 1263 tests
plugin-authtsc --noEmit	✓ clean, exit 0
dogfood auth family	✓ 9 files, 64 tests — includes showcase-demo-personas-loginable 4/4 and admin-route-nonadmin-refusal 7/7

The diff is still 25 files / +437 −218, so the merge brought main in without widening this
PR's own surface: the per-file file-surface table above still describes the diff exactly.

---

Generated by Claude Code