chore(deps)!: better-auth 1.7.0-rc.2 + the production-dependency batch (#3517)

[os-zhuang]

Replaces dependabot #3517 (its base is ~40 commits stale, and its three red checks are all fixed here) and additionally carries the better-auth family from 1.7.0-rc.1 to 1.7.0-rc.2.

Why #3517 was red

Check	Cause	Status here
Validate Package Dependencies	OSV found 10 advisories (react-router, sharp, @sveltejs/kit, brace-expansion, @hono/node-server)	Fixed on main by #3614; OSV-Scanner is clean on the regenerated lockfile
Check Changeset	Dependabot adds none	Changeset added
Scaffold with repo dist	docker.io i/o timeout pulling node:22-slim	Infra flake, not a code failure

The dependency batch

@oclif/core 4.13.0, @hono/node-server 2.0.12, hono 4.12.32, tar 7.5.22, jose 6.2.4, pinyin-pro 3.28.2, plus the private docs app's fumadocs 16.12.1 / next 16.2.12 / react 19.2.8 / lucide-react 1.27.0. js-yaml was already at 5.2.2 on main.

BREAKING — better-auth 1.7.0-rc.2 account identity

rc.2 renames account.accountId to account.providerAccountId, adds a required account.issuer, and resolves every account by (issuer, providerAccountId). An unmapped or unstamped issuer is not a type error — it is a silent "no such account" on every sign-in.

• AUTH_ACCOUNT_CONFIG maps providerAccountId onto the existing account_id column (same value, renamed upstream — no data moves) and adds issuer.
• sys_account gains the issuer column, plus the unique (issuer, account_id) index better-auth declares on its own table. The column is deliberately nullable: a NOT NULL column cannot be added to a table that already holds rows, and schema sync runs before the backfill.
• internalAdapter.createAccount() now passes issuer + providerAccountId; credential accounts carry better-auth's own local:credential.
• /unlink-account narrowed to { accountId }, where accountId is the account row id — the sys_account row action and client.auth.accounts.unlink() follow, and accounts.list() now returns issuer + providerAccountId.

Upgrading an existing deployment

Rows written before 1.7 have no issuer and are invisible to sign-in, so the auth plugin runs an idempotent boot-time backfill (backfillAccountIssuer, also exported for hosts that migrate on their own schedule). It stamps what it can derive:

Account	Issuer
password	local:credential
configured social provider	local:oauth:<providerId>
registered SSO provider	the IdP's real iss from sys_sso_provider

Accounts from a federated IdP that is no longer registered cannot be derived. They are logged with provider id and row count rather than guessed — a wrong issuer is indistinguishable from a missing one at sign-in, and it also occupies the unique slot the correct row needs. Those users sign in again through that provider once the row is stamped with the IdP's issuer or removed so a fresh login re-links it.

Also required by 1.7

SecondaryStorage gained two mandatory methods, both now implemented over the kernel cache service: getAndDelete (single-use verification values) and increment (fixed-window rate-limit counter — rateLimit.storage: 'secondary-storage' throws at boot without it). Neither cache primitive is atomic; each carries a comment stating the exact race it leaves open and that an adapter with GETDEL/INCR closes both.

@better-auth/scim stays at 1.7.0-rc.1

rc.2 replaces the SCIM plugin wholesale: code-defined connections + static credentials instead of runtime-generated tokens, the scimProvider model and generate-token endpoint gone, six new models (scimUser, scimGroup, scimGroupMember, scimSubject, scimConnectionBinding, scimIdentityTombstone). Adopting it means new platform objects, retiring sys_scim_provider, and a new way for a tenant to register a connection — an ADR-0071 feature migration, not a version bump. rc.1's peer range accepts rc.2 core and it still carries the GHSA-j8v8-g9cx-5qf4 fix. Flagged in pnpm-workspace.yaml so nobody "aligns" it by reflex.

Verification

• pnpm test — 132/132 turbo tasks green; pnpm build green; eslint clean; tsc --noEmit clean.
• OSV-Scanner v2.3.8 on the regenerated lockfile: no issues found. check-override-consistency and check-changeset-fixed pass.
• Real boot (showcase stack, in-memory SQLite): sign-up writes issuer on sys_account, sign-in resolves the account, and the backfill stamps a legacy issuer-less row through the real ObjectQL engine. The existing OIDC authorization-code dogfood flow (authorize → code → token) passes against rc.2.
• New unit coverage for the backfill (derivation, non-guessing, idempotence, failure reporting) and for both new SecondaryStorage methods (fixed window not extended, restart after expiry, corrupt-envelope recovery).

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 27, 2026 11:14am

[github-actions]

📓 Docs Drift Check

This PR changes 8 package(s): packages/adapters, @objectstack/cli, @objectstack/client, create-objectstack, @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/plugin-hono-server, @objectstack/plugin-pinyin-search.

29 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/ai/skills-reference.mdx (via packages/cli, packages/client, create-objectstack)
• content/docs/ai/skills.mdx (via create-objectstack)
• content/docs/api/client-sdk.mdx (via @objectstack/cli, @objectstack/client)
• content/docs/api/data-flow.mdx (via @objectstack/cli, @objectstack/client)
• content/docs/api/environment-routing.mdx (via @objectstack/cli, @objectstack/client)
• content/docs/api/error-catalog.mdx (via @objectstack/cli, @objectstack/client)
• content/docs/automation/hook-bodies.mdx (via packages/cli)
• content/docs/data-modeling/queries.mdx (via @objectstack/plugin-pinyin-search)
• content/docs/deployment/backup-restore.mdx (via @objectstack/cli)
• content/docs/deployment/cli.mdx (via @objectstack/cli, @objectstack/plugin-auth)
• content/docs/deployment/environment-variables.mdx (via @objectstack/plugin-pinyin-search)
• content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
• content/docs/deployment/self-hosting.mdx (via @objectstack/cli, create-objectstack)
• content/docs/getting-started/index.mdx (via create-objectstack)
• content/docs/getting-started/your-first-project.mdx (via @objectstack/cli, @objectstack/client, create-objectstack, @objectstack/plugin-hono-server)
• content/docs/kernel/runtime-services/data-service.mdx (via packages/cli, packages/client)
• content/docs/kernel/runtime-services/index.mdx (via packages/cli, packages/client)
• content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/authentication.mdx (via @objectstack/cli, @objectstack/client, @objectstack/plugin-auth, @objectstack/plugin-hono-server)
• content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/index.mdx (via @objectstack/plugin-auth, @objectstack/plugin-hono-server)
• content/docs/plugins/packages.mdx (via packages/adapters, @objectstack/cli, @objectstack/client, create-objectstack, @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/plugin-hono-server)
• content/docs/protocol/kernel/plugin-spec.mdx (via @objectstack/cli)
• content/docs/protocol/kernel/realtime-protocol.mdx (via @objectstack/cli, @objectstack/client)
• content/docs/releases/implementation-status.mdx (via @objectstack/cli, @objectstack/client, @objectstack/plugin-auth, @objectstack/plugin-hono-server)
• content/docs/releases/v15.mdx (via create-objectstack, @objectstack/plugin-pinyin-search)
• content/docs/releases/v16.mdx (via @objectstack/cli, @objectstack/client, @objectstack/plugin-hono-server)
• content/docs/releases/v9.mdx (via create-objectstack, @objectstack/plugin-auth)
• content/docs/ui/setup-app.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.