Expose buffered response encoding and declared header schemas - #10537

## pnpm-workspace.yaml (default)

## Dependency Updates

| Package | From | To | Type |
| --- | --- | --- | --- |
| `@better-auth/cimd` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/mcp` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/oauth-provider` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/passkey` | 1.7.19 | 1.7.20 | patch |
| `@better-auth/sso` | 1.7.19 | 1.7.20 | patch |
| `@effect/platform-node` | 4.1.3 | 4.1.4 | patch |
| `@effect/sql-d1` | 4.1.3 | 4.1.4 | patch |
| `@effect/vitest` | 4.1.3 | 4.1.4 | patch |
| `@inlang/paraglide-js` | 3.2.1 | 3.2.2 | patch |
| `@react-email/ui` | 6.11.10 | 6.11.11 | patch |
| `ai` | 7.0.166 | 7.0.169 | patch |
| `better-auth` | 1.7.19 | 1.7.20 | patch |
| `effect` | 4.1.3 | 4.1.4 | patch |
| `react-email` | 6.11.10 | 6.11.11 | patch |
| `seroval` | 1.8.0 | 1.8.1 | patch |

## Release Notes

<details>
<summary><b>@<!---->better-auth/cimd</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/mcp</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/oauth-provider</b> (1.7.19 →
1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/passkey</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->better-auth/sso</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>@<!---->effect/platform-node</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- Updated dependencies
[[`f527f90`](Effect-TS/effect@f527f90),
[`ee5550a`](Effect-TS/effect@ee5550a),
[`7fce132`](Effect-TS/effect@7fce132),
[`9116189`](Effect-TS/effect@9116189),
[`edb2eaa`](Effect-TS/effect@edb2eaa),
[`8176cdb`](Effect-TS/effect@8176cdb),
[`3a65e9e`](Effect-TS/effect@3a65e9e),
[`fdd319e`](Effect-TS/effect@fdd319e),
[`72c3fb4`](Effect-TS/effect@72c3fb4),
[`9c41784`](Effect-TS/effect@9c41784)]:
  - [email protected]
  - @<!---->effect/[email protected]

</details>

<details>
<summary><b>@<!---->effect/sql-d1</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- Updated dependencies
[[`f527f90`](Effect-TS/effect@f527f90),
[`ee5550a`](Effect-TS/effect@ee5550a),
[`7fce132`](Effect-TS/effect@7fce132),
[`9116189`](Effect-TS/effect@9116189),
[`edb2eaa`](Effect-TS/effect@edb2eaa),
[`8176cdb`](Effect-TS/effect@8176cdb),
[`3a65e9e`](Effect-TS/effect@3a65e9e),
[`fdd319e`](Effect-TS/effect@fdd319e),
[`72c3fb4`](Effect-TS/effect@72c3fb4),
[`9c41784`](Effect-TS/effect@9c41784)]:
  - [email protected]

</details>

<details>
<summary><b>@<!---->effect/vitest</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- Updated dependencies
[[`f527f90`](Effect-TS/effect@f527f90),
[`ee5550a`](Effect-TS/effect@ee5550a),
[`7fce132`](Effect-TS/effect@7fce132),
[`9116189`](Effect-TS/effect@9116189),
[`edb2eaa`](Effect-TS/effect@edb2eaa),
[`8176cdb`](Effect-TS/effect@8176cdb),
[`3a65e9e`](Effect-TS/effect@3a65e9e),
[`fdd319e`](Effect-TS/effect@fdd319e),
[`72c3fb4`](Effect-TS/effect@72c3fb4),
[`9c41784`](Effect-TS/effect@9c41784)]:
  - [email protected]

</details>

<details>
<summary><b>better-auth</b> (1.7.19 → 1.7.20)</summary>

> [!IMPORTANT]
> **Action required**
>
> - If your issuer (`baseURL`, or `jwt.issuer` when set) uses `http` on
a non-loopback host behind a TLS-terminating proxy, set `baseURL` to the
public `https` URL, since discovery and the `iss` parameter no longer
rewrite it to `https`.
([#11904](better-auth/better-auth#11904))

## `@better-auth/oauth-provider`

### Bug Fixes

- Fixed `POST /oauth2/public-client-prelogin` with
`allowPublicClientPrelogin` to return a client only when its `client_id`
matches the signed `oauth_query`, otherwise responding with `401`
`invalid_client`
([#12237](better-auth/better-auth#12237))
- Fixed `oauthProviderResourceClient(auth)` defaults to accept issued
access tokens when `baseURL` is only an origin, by including the auth
path in the default issuer, JWKS, and introspection URLs
([#12234](better-auth/better-auth#12234))
- Added an `allowInsecureRedirectUri` option so OAuth provider
deployments served over HTTP on private networks can accept `http`
redirect URIs
([#11904](better-auth/better-auth#11904))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/oauth-provider/CHANGELOG.md)

## `@better-auth/prisma-adapter`

### Bug Fixes

- Fixed Prisma adapter `incrementOne` and `update` calls using `mode:
"insensitive"` filters to match case-insensitively on PostgreSQL and
MongoDB
([#11809](better-auth/better-auth#11809))
- Fixed Prisma adapter queries with `eq null` on MongoDB to also match
records where the optional field was never set
([#11806](better-auth/better-auth#11806))

For detailed changes, see
[`CHANGELOG`](https://github.com/better-auth/better-auth/blob/9e748d69938f10f303ac941095d427af73c0ffea/packages/prisma-adapter/CHANGELOG.md)

## `@better-auth/core`

### Bug Fixes

- Added an `allowInsecureRedirectUri` 

…[full
notes](https://github.com/better-auth/better-auth/releases/tag/v1.7.20)

</details>

<details>
<summary><b>effect</b> (4.1.3 → 4.1.4)</summary>

### Patch Changes

- [#10512](Effect-TS/effect#10512)
[`f527f90`](Effect-TS/effect@f527f90)
Thanks @<!---->effect-bot! - Add `WorkloadIdentity` helpers for
Anthropic and OpenAI authentication, and report OpenAI WebSocket
client-transform failures as `AiError` instead of defects.

- [#10529](Effect-TS/effect#10529)
[`ee5550a`](Effect-TS/effect@ee5550a)
Thanks @<!---->only21mil! - Fix CLI `--wizard` generating a command that
fails to parse when flags or arguments were already typed for the
selected command.

- [#9995](Effect-TS/effect#9995)
[`7fce132`](Effect-TS/effect@7fce132)
Thanks @<!---->tim-smart! - Add the `HttpApi.RedactedNames` annotation
for declaring query parameter and header names of an API, group or
endpoint to redact in the URL and header attributes of `HttpApiClient`
and `HttpApiBuilder` spans, for values that are only sometimes secret.
`addHttpApi` treats it like any other annotation, and
`user_agent.original` is recorded as is.

- [#10537](Effect-TS/effect#10537)
[`9116189`](Effect-TS/effect@9116189)
Thanks @<!---->effect-bot! - Expose
`HttpApiSchema.getResponseEncodingSchema` and
`getEncodeToWithHeadersParts` for inspecting buffered response encodings
and declared body/header schemas.

- [#10521](Effect-TS/effect#10521)
[`edb2eaa`](Effect-TS/effect@edb2eaa)
Thanks @<!---->gcanti! - Add experimental `closeObjects`, fix JSON
Schema composition and examples, and regenerate a smaller OpenRouter
client with a boolean workspace-deletion confirmation flag.
  
  ### Breaking changes
  
The generated OpenRouter schemas follow the current upstream
specification. Some intermediate sche

…[full
notes](https://github.com/Effect-TS/effect/releases/tag/effect%404.1.4)

</details>

<details>
<summary><b>react-email</b> (6.11.10 → 6.11.11)</summary>

### Patch Changes

* 9f75920: Remove the `debounce` dependency.
* Updated dependencies \[a126e56]
* Updated dependencies \[f147c14]
  * @<!---->react-email/[email protected]

</details>

<details>
<summary><b>seroval</b> (1.8.0 → 1.8.1)</summary>

### Patch Changes

- 0d5c590: `fromJSON` and `fromCrossJSON` now decode a well-known symbol
that appears more than once in a value. The second use used to become
`undefined`, or failed as a malformed node when it was an object key. A
value with two iterables or async iterables, such as `[gen1, gen2]`, hit
this.

</details>

---
*This PR was auto-generated by
[catalog-update-action](https://github.com/brandhaug/catalog-update-action).*

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>