Sync upstream march 9

.claude/rules/release.md

@@ -0,0 +1,123 @@
+# Release Process
+
+## Stable Release (to `main` branch)
+
+1. **Create a staging branch** from the `main` branch:
+   ```bash
+   git checkout main
+   git pull origin main
+   git checkout -b v1.x.x-staging  # e.g., v1.4.14-staging
+   ```
+
+2. **Cherry-pick commits** from `canary` branch:
+   ```bash
+   git cherry-pick <commit-hash>
+   # Repeat for each commit you want to include
+   ```
+
+3. **Open a Pull Request** targeting the `main` branch
+
+4. **Wait for CI** to pass (all checks must be green)
+
+5. **Rebase and merge** the PR to `main` branch
+
+6. **Bump version and create tag**:
+   ```bash
+   git checkout main
+   git pull origin main
+   pnpm bump  # Interactive prompt to select version, creates commit & tag, automatically pushes
+   ```
+
+7. The release workflow (`.github/workflows/release.yml`) will automatically:
+   * Generate changelog using `changelogithub`
+   * Build all packages
+   * Publish to npm with the `latest` tag
+
+## Beta Release (on `canary` branch)
+
+Beta versions are released from the `canary` branch:
+
+```bash
+git checkout canary
+pnpm bump  # Select a beta version (e.g., v1.4.15-beta.0)
+git push origin canary --follow-tags
+```
+
+The release workflow will publish to npm with the `beta` tag.
+
+## Version Branch Releases
+
+For maintaining older versions (e.g., v1.3.x while v1.4.x is latest):
+
+1. Create a version branch named `v1.3.x-latest`
+2. Tags pushed from this branch will also receive the `latest` npm tag
+
+## Cherry-picking Guidelines
+
+When cherry-picking from `canary` to a stable release branch:
+
+### API Compatibility
+
+* **Check for new APIs**: Commits may use APIs that do not exist in the
+  target branch
+* **Fix imports**: Some imports may need adjustment
+
+### Handling Conflicts
+
+* When resolving merge conflicts, keep **both** versions if they add
+  different tests/features (e.g., two separate `describe` blocks)
+* For type conflicts, check if new type properties need to be added
+  to existing interfaces
+
+### Skip Incompatible Commits
+
+Skip commits that depend on features not in the target branch
+
+### Squashing Fixes
+
+**Never create separate compatibility fix commits.**
+Always squash fixes into the original cherry-picked commit:
+
+```bash
+# Create fixup commit
+git add <files>
+git commit --fixup <original-commit-hash> --no-verify
+
+# Squash with autosquash (repeat for all fixup commits first)
+GIT_SEQUENCE_EDITOR=: git rebase -i --autosquash <earliest-commit>^ --no-verify
+```
+
+### Revert Chains
+
+When cherry-picking a sequence like: fix → revert → revert-of-revert,
+just cherry-pick the original fix and skip both reverts (net effect
+is the same).
+
+### Test Verification
+
+After cherry-picking, always run:
+
+```bash
+pnpm typecheck
+pnpm lint
+pnpm vitest <affected-test-files> --run
+```
+
+Remove tests that test features are not available in the target branch.
+
+## Notes
+
+* **Do not merge breaking changes to `main` branch** unless upgrading
+  minor versions (e.g., 1.4 to 1.5)
+* **Merge conflicts**: Resolve them carefully.
+  Review each conflict to ensure no code is accidentally removed or
+  duplicated
+* **Keep the release branch clean**: Do not create extra commits on
+  the releasing branch.
+  If you need to fix CI issues, squash the fix into the appropriate
+  existing commit
+* All releases are triggered by pushing tags matching `v*`
+* The CI determines the npm tag based on:
+  * Pre-release suffix in tag name (canary, beta, rc, next)
+  * Whether the commit is on `main` or a version branch (`v*.*.x-latest`)
+* Always ensure CI is green before creating release tags

.cspell.jsonc

@@ -82,6 +82,9 @@
 		// match any string starting with price_ (stripe related)
 		"price_[a-zA-Z0-9-_]+",
 
+		// match Stripe subscription IDs (sub_)
+		"sub_[a-zA-Z0-9-_]+",
+
 		// match any url-encoded string
 		"%[0-9A-Fa-f]{2}(?:%[0-9A-Fa-f]{2})*",
 

.cspell/alt-languages.txt

@@ -1,2 +1,11 @@
 usuario
-registrado
+registrado
+Benutzer
+gefunden
+invalide
+nicht
+trouvé
+Ungültige
+Ungültiges
+Utilisateur
+encontrado

.cspell/auth-terms.txt

@@ -21,4 +21,13 @@ vnet
 ctry
 acrs
 edov
-fedcm
+fedcm
+bunx
+npx
+pnpx
+agentic
+Agentic
+Timestampz
+Vercel
+rgba
+idtoken

.cspell/company-names.txt

@@ -21,4 +21,9 @@ faceit
 xata
 chonkie
 dsari
-paypalv
+paypalv
+sequenzy
+Razorpay
+razorpay
+payu
+PayU

.cspell/custom-words.txt

@@ -12,4 +12,6 @@ merch
 prefs
 uncompromised
 myapp
-Neue
+Neue
+CCPA
+CPRA

.cspell/names.txt

@@ -2,4 +2,30 @@ Bereket
 Oskar
 Gmerek
 Lluis
-Agusti
+Agusti
+Vijit
+TPEOficial
+GeKorm
+Daanish2003
+marcellosso
+tobimori
+zpg6
+kevcube
+erickweil
+TheUntraceable
+yultyyev
+Fyrlex
+alexasomba
+Vijit
+neiii
+Theo
+developedbyed
+Dagmawi
+Esayas
+bekacru
+beka
+guilhermejansen
+iamjasonkendrick
+ejirocodes
+0-Sandy
+olliethedev

.cspell/tech-terms.txt

@@ -20,6 +20,8 @@ devrel
 rdbms
 unstub
 xlink
+xenc
+myprefix
 oklch
 onprem
 encryptor
@@ -35,4 +37,16 @@ mlterm
 rxvt
 gitea
 MMDD
-ABCDEFGHJKLMNPQRSTUVWXYZ23456789
+ABCDEFGHJKLMNPQRSTUVWXYZ23456789
+setex
+dyld
+nsis
+ftyp
+heix
+sessionMiddleware
+SIEM
+sess
+reactivations
+whsec
+btst
+orms

.cspell/third-party.txt

@@ -33,4 +33,10 @@ giget
 segoe
 conar
 nuxtzzle
-Deel
+Deel
+WorkOS
+authjs
+vite
+electronjs
+wagmi
+tldts

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -46,7 +46,7 @@ body:
   - type: textarea
     attributes:
       label: System info
-      description: Output of `npx @better-auth/cli info --json`
+      description: Output of `npx auth info --json`
       render: bash
       placeholder: System and Better Auth info
     validations:

.github/actions/setup-playwright/action.yml

@@ -0,0 +1,68 @@
+name: Setup Playwright
+description: Cache and install Playwright chromium browser with system dependencies.
+
+inputs:
+  working-directory:
+    description: 'Directory containing the project with the Playwright dependency'
+    required: false
+    default: 'e2e/integration'
+  browsers:
+    description: 'Browsers to install (e.g., "chromium", "chromium firefox", or leave empty for all)'
+    required: false
+    default: 'chromium'
+
+outputs:
+  cache-hit:
+    description: 'Whether the Playwright browser cache was hit'
+    value: ${{ steps.cache.outputs.cache-hit }}
+  playwright-version:
+    description: 'Detected Playwright version'
+    value: ${{ steps.detect-version.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - name: Determine OS Cache Path
+      id: cache-path
+      shell: bash
+      run: |
+        if [ "$RUNNER_OS" = "Windows" ]; then
+          echo "path=~/AppData/Local/ms-playwright" >> "$GITHUB_OUTPUT"
+        elif [ "$RUNNER_OS" = "macOS" ]; then
+          echo "path=~/Library/Caches/ms-playwright" >> "$GITHUB_OUTPUT"
+        else
+          echo "path=~/.cache/ms-playwright" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Detect Playwright Version
+      id: detect-version
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        PLAYWRIGHT_VERSION=$(pnpm ls @playwright/test --json | jq --raw-output '.[0].devDependencies["@playwright/test"].version')
+        if [ -z "$PLAYWRIGHT_VERSION" ] || [ "$PLAYWRIGHT_VERSION" = "null" ]; then
+          echo "::error::Could not detect @playwright/test version in ${{ inputs.working-directory }}. Ensure dependencies are installed before running this action."
+          exit 1
+        fi
+        echo "version=$PLAYWRIGHT_VERSION" >> "$GITHUB_OUTPUT"
+
+    - name: Cache Playwright Browsers
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      id: cache
+      with:
+        path: ${{ steps.cache-path.outputs.path }}
+        # Dynamically inject the requested browsers into the cache key ('all' is used as a fallback string if empty)
+        key: ${{ runner.os }}-playwright-${{ inputs.browsers || 'all' }}-${{ steps.detect-version.outputs.version }}
+
+    - name: Install Playwright Browsers & OS Deps (Cache Miss)
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      # If inputs.browsers is empty, this safely resolves to 'pnpm exec playwright install --with-deps'
+      run: pnpm exec playwright install ${{ inputs.browsers }} --with-deps
+
+    - name: Install Playwright OS Dependencies (Cache Hit)
+      if: steps.cache.outputs.cache-hit == 'true'
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: pnpm exec playwright install-deps ${{ inputs.browsers }}