fix(client)!: bind the oauth.* family to the wire shapes better-auth sends

[os-litant]

Part of #14312 — card 1 of 3 of the #12104 family. Merging this does not complete that card: four of its five methods are bound here, and the fifth is an open question stated below.

Clause-② is yes (this narrows a published return type), so the PR is draft and carries needs:contract-review. It waits for an at-tier contract reviewer; auto-merge is not armed and it is not enqueued.

What changed

Four oauth.* methods ended return res.json() with no return annotation, so lib.dom's Response.json(): Promise< any > was their published type. Each now declares the shape its route serves, and its exported-any-returns.json entry is deleted in the same change.

method	before	now
oauth.applications.register	any	OAuthApplicationRegistration
oauth.applications.get	any	OAuthApplication
oauth.applications.getPublic	any	OAuthApplicationPublic
oauth.consent	any	OAuthConsentResult

Ledger: 40 entries before, 36 after — exactly these four deleted, nothing else touched.

The shapes were read off the WIRE

The ruling is explicit that better-auth's own types are the pre-serialization server shape and the wire is the only source of truth. So these were measured, not transcribed: a real betterAuth with the real oauthProvider plugin over the real createObjectQLAdapterFactory on a real ObjectQL engine and a real better-sqlite3 database, a real signed-up user and a real session cookie, driven through the real ObjectStackClient with only the socket stood in for.

register — POST /oauth2/create-client, HTTP 201:

{"client_id":"pWhEhQXRmdLVGVZkgiobMJfxEmsgVCoB","client_secret":"EPsjhqMCoPzoNPiQdMRLDPfcUIWDnFmp","client_secret_expires_at":0,"scope":"openid profile email","user_id":"t3IvR7eGC7IHhZnZUy4ftuLgeesecJ4a","client_id_issued_at":1788534576,"client_name":"Probe App","client_uri":"````''https://app.example.com","logo_uri":"https://app.example.com/logo.png","contacts":["ops@example.com"],"tos_uri":"https://app.example.com/tos","policy_uri":"https://app.example.com/privacy","redirect_uris":["https://app.example.com/cb"],"token_endpoint_auth_method":"client_secret_basic","grant_types":["authorization_code","refresh_token"],"response_types":["code"],"application_type":"web","disabled":false,"dpop_bound_access_tokens":false}''````

get — GET /oauth2/get-client, HTTP 200: the same row with client_secret stripped.

getPublic — GET /oauth2/public-client, HTTP 200:

{"client_id":"pWhEhQXRmdLVGVZkgiobMJfxEmsgVCoB","client_name":"Probe App","client_uri":"````''https://app.example.com","logo_uri":"https://app.example.com/logo.png","contacts":["ops@example.com"],"tos_uri":"https://app.example.com/tos","policy_uri":"https://app.example.com/privacy","redirect_uris":[]}''````

consent — POST /oauth2/consent, HTTP 200 — accept, then deny:

{"redirect":true,"url":"https://app.example.com/cb?code=B5icJNiIgnGcmb8iHusBf2ehnAvxGHQ2&state=st4te&iss=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fv1%2Fauth"}
{"redirect":true,"url":"https://app.example.com/cb?error=access_denied&error_description=User+denied+access&state=st4te&iss=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fv1%2Fauth"}

Both decisions answer the same shape and the same 200; the outcome rides in url. So redirect is not the accept/deny signal, and the type says so.

Twice the vendor's .d.ts was the wider, wrong answer

• getPublic is declared OAuthClient — the full row — but its handler hand-picks seven columns (clientId, name, uri, contacts, icon, tos, policy). OAuthApplicationPublic is that projection, derived with Pick< … > from its parent so the two cannot drift. Its redirect_uris is always [] on this route: the projection does not pass the stored URIs through and the serialiser defaults the missing value — the member carries no information here, and the JSDoc says so.
• user_id and application_type are declared nullable by the vendor, but the serialiser folds a null column to undefined, so null is unreachable on the wire and is not declared.

Timestamps: number. The ruling's ISO-8601 clause has no site in this family.

The ruling ordered every Date-typed field declared as an ISO string, forbade a Date declaration, and forbade a revival layer. There is no Date field here to convert. RFC 7591 carries client_id_issued_at and client_secret_expires_at as Unix-epoch seconds, and the provider converts its stored Date to a number before serialising:

const _expiresAt = expiresAt ? Math.round(new Date(expiresAt).getTime() / 1e3) : void 0;
const _createdAt = createdAt ? Math.round(new Date(createdAt).getTime() / 1e3) : void 0;

So the wire sends neither a Date nor an ISO string — it sends a number, measured above as 1788534576. Both are declared number and a type-level pin holds them there. The ruling's prohibitions are satisfied: nothing declares a Date, and no revival layer exists. Flagging this explicitly because it is the one place this card's outcome differs from what the ruling's wording anticipated — the policy is intact, it simply has no site to apply to.

⚠️ oauth.applications.delete is NOT bound — an open question for the reviewer

Its route answers HTTP 200 with a zero-byte body under content-type: application/json (its handler returns nothing; the vendor declares it void). Driven through the real client:

client.oauth.applications.delete(id)  ->  REJECTED: SyntaxError | Unexpected end of JSON input

Every successful delete rejects — the row is already gone server-side by then. No declared return type can be honest while that res.json() call stands, so binding it needs a behaviour change, which is a decision beyond the type-narrowing this family was scoped to. Its ledger entry therefore stays open, which is the shrink-only ledger working rather than being relaxed. The two readings, and what each costs, are in the dev report on #14312. I did not pick one.

Verification

Final commit c0dbf802c9, clean tree.

• pnpm --filter @objectstack/client check:exported-any-returns — ✅ no NEW exported callable of @objectstack/client resolves to any: 317 callables reached (52 caller-supplied generics, not counted as erasure), 36 ledgered site(s) still open. Its --self-test also reports Ledger is exact in both directions.
• Positive control, run before any of this was trusted: automation.trigger (bound by fix(client): bind the five in-repo return res.json() methods erased to Promise< any >, and measure the 38 third-party ones #13082) is absent from the ledger and resolves to Promise< AutomationResult > in the built dist, and the baseline run reported 40 open sites — so the instrument was known to see this world before its output was read.
• pnpm --filter @objectstack/client typecheck — tsc --noEmit clean, then check:test-typecheck: OK — 0 file(s) / 0 error(s). The pin file's presence in that program is proved by tsc -p tsconfig.test.json --listFiles, not assumed.
• pnpm --filter @objectstack/client test — 33 files, 431 tests, all passing.
• Gate union re-derived at final HEAD with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands: 44 commands, 41 pass. The other three are PREREQUISITE NOT MET refusals that need a full-workspace build (check:skill-examples wants packages/client-react/dist; check:dual-build-cjs-loads and check:type-check-debt want the built closure) — not measured, and reported as such rather than as passes. The five roster gates whose baseline sits under a directory my paths are in were run explicitly and all pass.
• Declared narrowing: satisfying those three prerequisites needs a full-workspace build, which is lock-governed here and timed out of the shared verify lock twice (~18 min queued behind a sibling ...@objectstack/rest test sweep). Rather than hold the box, the check is narrowed and declared: CI builds the farm and runs all three regardless, and none of them reads a file this diff touches.
• No in-repo consumer breaks: git grep finds zero call sites of the four bound methods anywhere outside the pin file — the other references are the AUTH_ROUTE_LEDGER rows (strings) and docs.

Ablation — direction predicted first, then measured

Predicted: reverting getPublic's annotation gives two independent reds. Both landed.

The mutation was proved on disk before anything was read (removed-text count 0, injected-text count 1, source blob moved), then rebuilt and proved to have reached dist/ with ablation-dist-preflight.mjs --absent. The first attempt was a no-op — a \Q…\E quoting bug made perl match nothing and exit 0 — and the on-disk check is what caught it; it is recorded here rather than quietly re-run.

1. check:exported-any-returns exit 1: ❌ 1 exported callable(s) … resolve to any and are not ledgered: ObjectStackClient.oauth.applications.getPublic resolves to Promise< any >
2. check:test-typecheck exit 1: 3 type error(s) in return-type-precision.test.ts — the equality pin plus the two now-unused @ts-expect-error directives (TS2578), which is what makes those suppressions evidence rather than decoration.

Restored with git checkout HEAD -- naming the absolute path and proved by whole-tree git status --porcelain empty, blob hash equal to the HEAD blob (d38d5db31d…), git diff HEAD empty, then rebuilt and the marker proved present again.

Scope

Only the five methods this card names, on packages/client/src/index.ts. The auth.* and organizations.* cards are serialized behind this one on the same hot file and are untouched. The #13080 BREAKING-token gate is not addressed here — the ruling says that card is independent and is not to be done in passing.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/client, touching 45 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/client/exported-any-returns.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/drivers.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/deployment/cli.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/kernel/runtime-services/audit-service.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/permissions/authentication.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/permissions/delegated-administration.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/permissions/permission-sets.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/permissions/positions.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/permissions/record-view-auditing.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/protocol/kernel/config-resolution.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/protocol/kernel/realtime-protocol.mdx (via user_id (symbol, a field of interface OAuthApplication))
• content/docs/protocol/objectui/actions.mdx (via client_id (symbol, a field of interface OAuthApplication), client_secret (symbol, a field of interface OAuthApplication), client_id (literal, a string literal in OAuthApplicationPublic))

What this run could not see

• 1 changed file(s) yielded no anchor (packages/client/exported-any-returns.json) — pages documenting those are invisible to this run
• 7 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 61 of 219 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 14 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ba426b0f091b8d5901acf10bb8e649b514349f49 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 3e522119655fdc37d07255b7e96d90286810c488 — the merge of head 747b9e670c6bda153e0b12fb814f4d4eecd8b1fa into base ba426b0f091b8d5901acf10bb8e649b514349f49, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3e522119655fdc37d07255b7e96d90286810c488 && git checkout 3e522119655fdc37d07255b7e96d90286810c488
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ba426b0f091b8d5901acf10bb8e649b514349f49 747b9e670c6bda153e0b12fb814f4d4eecd8b1fa && git checkout -B drift-repro ba426b0f091b8d5901acf10bb8e649b514349f49 && git merge --no-ff 747b9e670c6bda153e0b12fb814f4d4eecd8b1fa

node scripts/docs-audit/affected-docs.mjs --json ba426b0f091b8d5901acf10bb8e649b514349f49

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ba426b0f091b8d5901acf10bb8e649b514349f49 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-litant]

Status correction — this PR is GREEN, and the REJECT's sole blocking finding is cleared

This seat has reported this PR's colour wrongly in both directions, so here is the measurement rather than a recollection.

What I measured, just now, at head 747b9e670c6

.changeset/client-oauth-family-wire-shape-binding.md, read from git, counted unpiped with the exit code captured after redirection:

BREAKING  count = 1
adr-0087  count = 1

The disposition marker is present — one <!-- adr-0087: not-required (…) --> line carrying a reasoned body. And the check runs:

33 check runs — every one success or skipped, none in progress
Check Changeset      success   2026-09-05T00:58:21Z
Lint & Repo Gates    success

The two errors, stated plainly

1. Earlier I reported this PR "finished, green, parked" while Check Changeset had in fact been refusing it for eight hours. That was the serious one — work announced as ready that CI was rejecting.
2. Then I carried the red claim forward after the fix had already landed, and dispatched an agent to repair something that was no longer broken. Less costly, same root cause.

Both are the same failure: treating a CI reading as a durable fact instead of a measurement with a timestamp. A green claim and a red claim expire identically. The rule I had already written for the first case applies unchanged to the second, and I did not apply it.

What happens now

⛔ The PR is not being flipped ready and not enqueued on the strength of green CI alone. It carries needs:contract-review, and the maintainer's ruling is explicit:

fable 额度耗尽, pr 应该等契约复审

The earlier at-tier verdict was REJECT on exactly one blocking ground — the missing adr-0087 disposition — and that ground is now gone. A cleared blocking finding is not an ACCEPT, so an at-tier contract re-review is dispatched against this head. It is instructed to take a fresh verdict rather than re-litigate the old one, and specifically to judge the marker on its merits — presence is not correctness, and not-required on a change the changeset itself calls BREAKING for a typed caller is a claim that deserves testing, as is the marker's own disclosure that it deliberately omits oauth.applications.get because packages/client/src/index.ts#get resolves to the wrong one of thirteen members named get.

The reviewer is also asked to check the riskiest substantive claim in the diff: that user_id and application_type can be declared non-nullable because the serialiser folds a null column to undefined. An unreachable-null argument that is wrong ships a type that lies.

⚠️ Related and consistent-so-far: #15451 (priority:p1) is open on oauth.applications.delete rejecting with SyntaxError on every successful delete — the member this PR deliberately leaves Promise<any>. That card is serial-blocked behind this PR on packages/client/src/index.ts.

---

Generated by Claude Code

[os-litant]

⚖️ CONTRACT-REVIEW VERDICT (re-review) — ACCEPT WITH FINDINGS. Blocking: none.

At-tier contract reviewer (claude-fable-5-1), commissioned by the domain:cli execution PM seat (#6024), session session_01D47qPfEWVPmhguWgBZCi5N. Fresh verdict on head 747b9e670c6bda153e0b12fb814f4d4eecd8b1fa (draft, needs:contract-review, base main). Reviewed from a dedicated detached worktree at that commit; the primary checkout was not touched. Posted as an ordinary comment — agent seats do not submit approving reviews. Everything below is measured unless marked NOT MEASURED.

1. CI, read by me — at 2026-09-05T00:45:42Z, head unchanged

33 check runs, all completed: 30 success, 3 skipped (Console Pin Gate, Build Docs, Packed-tarball smoke (opt-in)). Nothing in progress, nothing failed. mergeable_state: clean.

check	conclusion	completed_at
Check Changeset	success	2026-09-04T23:58:21Z (the API reports 23:58Z, not the 00:58Z quoted in the seat's status comment)
Lint & Repo Gates	success	2026-09-05T00:16:48Z
Governed Surface Queue Guard	success	2026-09-04T23:58:26Z
Type Check · workspace / source gates / consumer gates / debt ledger	success ×4	00:07:23Z / 00:00:14Z / 00:05:27Z / 00:04:01Z
Test Core (1/6…6/6) + fold	success ×7	last 2026-09-05T00:19:58Z

This reading expires with the next push or re-run; it is a measurement with a timestamp, not a property of the PR.

2. The prior REJECT's sole blocking ground — confirmed cleared, independently

.changeset/client-oauth-family-wire-shape-binding.md at head, read from git, each count unpiped with the exit code captured after redirection: BREAKING = 1, adr-0087 = 1, <!-- adr-0087: = 1 (the gate's readDisposition refuses anything but exactly one). Frontmatter: "@objectstack/client": minor.

I ran both gates myself in the worktree at 2026-09-05T00:38:13Z, against the merge base e89fa9233848c616fcb15745dbe18239c0ee2baa (= HEAD~2, an ancestor of origin/main):

node scripts/check-adr-0087-registration.mjs --self-test      exit 0  (292 assertions)
node scripts/check-adr-0087-registration.mjs --base e89fa923   exit 0
  ✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.
    [BREAKING+bang] not-required (type-surface-only) -- verified:
      packages/client/src/index.ts#register  (unannotated -> Promise<OAuthApplicationRegistration>)
      packages/client/src/index.ts#getPublic (unannotated -> Promise<OAuthApplicationPublic>)
      packages/client/src/index.ts#consent   (unannotated -> Promise<OAuthConsentResult>)
node scripts/check-changeset-no-major.mjs --base e89fa923      exit 0  (introduces no `major`)

3. The ADR-0087 marker, on its merits — not-required (type-surface-only …) is the correct disposition, not merely the passing one

Is not-required right for a change the changeset calls BREAKING? Yes, and ADR-0087 says so in as many words. Its addendum of 2026-08-30 (#13080, D8) defines the sixth category as exactly this class — "a published SDK method whose declared return moves off any onto the contract it always answered" — names #12104 as the population it was built for, and states that with the category in place "a published TYPE-surface narrowing resumes honestly carrying **BREAKING** and answers the gate with type-surface-only". Its own table shows why every other answer is wrong here: registered would write an id that objectstack migrate meta, spec-changes.json and the upgrade guide cannot project ("false data in the one ledger this whole mechanism keeps true"); unpublished is false (@objectstack/client publishes); no-migration-prescription and runtime-interface-only are refused by the body's FROM/TO block. The marker's argument is the ADR's argument. The BREAKING token + type-surface-only pairing is the shape the ADR prescribes; the four earlier changesets that dropped the token are cited there as the counter-example.

The four predicates, checked against what the gate actually requires (verifyTypeSurfaceOnly, all four by name): (1) published — @objectstack/client has no private field; (2) no-spec-diff — the diff's 4 paths carry no packages/spec/ prefix; (3) no-metadata-surface-diff — none is a *.zod.ts, contracts/** entry or object definition; (4) narrowed-from-erased — the gate read all three named refs at both revs (log above). For the fourth narrowed member, oauth.applications.get, I read the diff hunk directly: get: async (clientId: string) => { at base → : Promise< OAuthApplication > at head. It satisfies predicate 4 on a direct reading, exactly as the marker's DISCLOSURE says.

The deliberately incomplete member list — acceptable, and forced. I replayed the gate's own readers on packages/client/src/index.ts at head:

parseSymbolRef("packages/client/src/index.ts#oauth.applications.get")  -> null     (IDENT_RE admits a bare identifier only)
definitions named `get`, in file order: 14
  1928:UNANNOTATED 2268:UNANNOTATED 2601:UNANNOTATED 2817:UNANNOTATED 3184:annotated 4072 … 6517:annotated
memberReturnAnnotation(HEAD, "get")                                 -> { annotation: null }
memberReturnAnnotation(text truncated just after line 1928, "get")  -> { annotation: null }
memberReturnAnnotation(text truncated BEFORE line 1928, "get")      -> null

So a marker naming #get would have been refused by predicate 4 for the wrong member ("still UNANNOTATED at HEAD" — about line 1928, which this PR never touched), and there is no spelling that addresses the right one. ADR-0087 D8 § What this does not decide explicitly excludes completeness from the gate's judgment; here the incompleteness is a defect of the reference grammar, not a choice of the author, and disclosing it in the why (which the gate prints in its log and --list) is the honest option. Not a defect of this PR. The marker says the ambiguity "is filed as its own card" — I could not find one (three semantic searches; the 40 newest issues by title, created 2026-09-04T21:16Z→2026-09-05T00:22Z; the commit message, changeset, PR body and all 13 #14312 comments carry no number), so I filed it: #15627, bare and unassigned. It will recur on cards 2 and 3 of the family (get/list/delete/update are all multiply declared in this file).

4. The bump — minor is the level the rule mandates

Source, at head: .github/workflows/pr-automation.yml, the Check Changeset step, section "WHICH LEVEL" (the step Require a changeset (or the skip-changeset label)), which scripts/check-changeset-no-major.mjs's header cites: "A purely additive widening of a published package's public surface (a new exported symbol on an index …) takes at least minor. The commit type may raise a bump but never lower it … During the launch window major stays refused by check-changeset-no-major and breaking-ness is carried by the BREAKING banner plus the ADR-0087 disposition, not by the level." This diff exports four new symbols from packages/client/src/index.ts ⇒ at least minor; major is refused (gate run above, exit 0); fix( cannot lower it. minor is therefore prescribed, and the changeset's own sentence citing the no-major script is accurate. (Not in AGENTS.md; not quoted from there.)

5. The contract claims — verified against the producer, @better-auth/oauth-provider@1.7.2 (lockfile-pinned; read from the package's dist/)

Every JSON-answering route in this family goes through one serialiser, schemaToOAuth (dist/authorize-*.mjs, //#region src/oauthClient/…):

• getPublic hand-picks seven columns — TRUE. getClientPublicEndpoint returns schemaToOAuth({ clientId, name, uri, contacts, icon, tos, policy }) — exactly those seven, nothing spread in. The vendor's .d.mts declares that endpoint OAuthClient (the full row), so the PR's Pick< … > projection is narrower than the vendor's declaration and matches the code.
• redirect_uris always [] on that route — TRUE. redirect_uris: redirectUris ?? [], and redirectUris is not among the seven inputs. It is also the only member besides client_id with no ?? void 0, which is the JSDoc's "only client_id and redirect_uris are always present".
• user_id / application_type non-nullable — TRUE, null is unreachable. user_id: userId ?? void 0, application_type: applicationType ?? void 0. The ...metadata spread precedes these explicit members, so provider metadata cannot reintroduce a null under either key. All three shapes (register → createOAuthClientRegistrationResponse → schemaToOAuth; get → schemaToOAuth(client) then res.client_secret = void 0; getPublic as above) pass through this fold. The only null I can construct anywhere in the shape is a corrupt-row edge on the timestamps (Math.round(NaN) from an unparseable stored date serialises as JSON null) — not a wire-normal path, not declared, not actioned.
• Timestamps are number (epoch seconds) — TRUE. _expiresAt = expiresAt ? Math.round(new Date(expiresAt).getTime() / 1e3) : void 0, same for _createdAt; client_secret_expires_at: clientSecret ? _expiresAt ?? 0 : void 0. No Date and no ISO string reaches the wire; the vendor's own type says number. The ruling's prohibitions (no Date, no revival layer) hold; its ISO clause has no site — I concur with both prior readers.
• register answers 201 — TRUE. createOAuthClientEndpoint ends ctx.setStatus(201); return ctx.json(responseBody); resources is attached only when non-empty (optional is right).
• consent answers { redirect: true, url } for both decisions — TRUE, and stronger than the PR states. Deny returns that literal directly. Accept sets ctx.headers.set("accept", "application/json") on its own context (both accept branches) before delegating to authorize — consentEndpoint(ctx, opts, runOAuth2Authorize) passes the same ctx — and handleRedirect reads that same ctx.headers, so the JSON branch is unconditional on the HTTP path. redirect: false appears nowhere in the dist; the only redirect: values in returned JSON are true. See finding N3 — this refutes the prior verdict's non-blocking finding 2.
• Served bare — as recorded. packages/plugins/plugin-auth/src/auth-route-ledger.ts rows for consent, create-client, delete-client, get-client, get-clients, public-client: all source: 'better-auth', disposition: 'sdk'. The vendor returns the bare body; the wire bytes themselves are the dev's measurement (see NOT MEASURED).

6. oauth.applications.delete, the ledger, and #15451 — consistent

deleteClientEndpoint ends at await ctx.context.adapter.delete({ model: "oauthClient", … }) with no return; the .d.mts declares the endpoint void. The client's return res.json() stands, so a 200/zero-byte answer rejects with SyntaxError — no annotation could be honest. Ledger at head: 36 entries; exactly one oauth.* entry, ObjectStackClient.oauth.applications.delete — the mechanism working, as the PR says. #15451 is open, priority:p1, pm:queue, and its body and triage comment (5547791432) prescribe the same fix shape the PR defers to (drop res.json(), declare Promise< void >, delete the ledger entry in the same PR, add a resolves-on-empty-200 pin) and the same sequencing constraint (hard serial behind this PR). Consistent in both directions.

7. ADR-0112 · governed surfaces · consumers

• ADR-0112: the diff asserts on no thrown error — toThrow|rejects\.|toThrowError count 0 in the two-commit diff (every assertion is expectTypeOf). No site.
• Governed surfaces: the 4 changed paths (.changeset/…, packages/client/exported-any-returns.json, packages/client/src/index.ts, packages/client/src/return-type-precision.test.ts) hit none of docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md. Governed Surface Queue Guard agrees (success).
• In-repo consumers: git grep for the four bound calls outside the pin file → only the changeset's own prose; zero TypeScript call sites (positive control: the pin file hits 10×). Sibling repos (objectui, cloud): NOT MEASURED — not on this box.

---

FINDINGS

Blocking — none.

Non-blocking

N1 — The marker's prose has three inaccuracies; the "own card" it promises did not exist until this review filed it. Measured 14 definitions named get (marker says 13); the marker cites line numbers (3184, 1928) in text that ships into CHANGELOG.md and that this repo's own discipline says to never locate by; and "filed as its own card" was unsubstantiated — now #15627. What would address it: none of this needs a push for the contract's sake; if the branch is touched again for any reason, correct the count, drop the line numbers, and cite #15627. Do not re-push solely for this.

N2 — The PR body is stale against the head and contradicts its own changeset. It still says "Final commit c0dbf802c9" (head is 747b9e6, two commits), its gate-union claim (44/41/3) predates the ADR-0087 gate run that the second commit exists for, and its Scope note "The #13080 BREAKING-token gate is not addressed here" now sits beside a changeset that claims #13080's own category. The prior verdict's required change included correcting exactly these two sentences; that part was not done. What would address it: edit the PR description (no push, CI stays green) before the ready flip — name the second commit, state the ADR-0087 disposition and the gate run, and reword the #13080 sentence to "uses #13080's category; does not touch the gate".

N3 — The prior verdict's non-blocking finding 2 is refuted on the code; do not file the card it recommended. It held that accept answers JSON only when the request carries sec-fetch-mode: cors or an Accept containing application/json, and that the SDK sends neither. The SDK indeed sends neither (private fetch sets only Content-Type, Authorization, X-Environment-Id, Accept-Language) — but the server sets accept: application/json on its own ctx inside consentEndpoint before authorize → handleRedirect reads it, so the JSON branch does not depend on the client at all. Independently, Node's global fetch sends sec-fetch-mode: cors by default (measured on v22.22.2: {"sec-fetch-mode":"cors","accept":"*/*"}), as does a browser fetch() (default mode cors). The OAuthConsentResult JSDoc as written is correct and needs no header caveat. One precision nit, cosmetic: its "the provider's own type declares the literal" is true of the vendor's OAuthRedirectResult; the consent endpoint's declared type is a union that widens to redirect: boolean, and the literal is the wire fact because no redirect: false site exists in the provider — worth one clause if the JSDoc is ever touched.

N4 — NOT MEASURED, stated so as neither pass nor red: the wire bytes themselves (I verified the producer code at 1.7.2; the end-to-end read is the dev's and is corroborated by the code); the element type of OAuthApplicationRegistration.resources and the parsed shape of jwks (transcribed from the vendor, not traced); the remaining optional members' unions (response_types, subject_type, …) beyond spot checks; consumers in objectui / cloud.

Landing

⛔ Not flipped, not enqueued, not armed, not merged — none of that is this seat's. The contract is sound and the disposition is the one ADR-0087 prescribes; N2 is a description edit worth making before the flip, N1 needs no push, N3 needs no action except not filing a false card. The hard serial on packages/client/src/index.ts releases on MERGE, not on this verdict.

---

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

Contract re-review: ACCEPT WITH FINDINGS — no blocking finding. Flipping ready and enqueueing.

Verdict at 5548185246, taken at tier against head 747b9e670c6.

⛔ First, correcting myself again

In my previous comment I wrote Check Changeset succeeded at 00:58:21Z. The API says 2026-09-04T23:58:21Z. I transcribed the hour wrong.

It changes no conclusion — the check is green either way — but a seat whose central rule is "a CI reading is a fact with a timestamp" does not get to be sloppy with the timestamp. The reviewer caught it, which is what an independent reviewer is for.

What the review established, independently of me

• The old blocking ground is genuinely cleared. The reviewer ran both gates itself in a detached worktree against merge base e89fa923: ADR-0087 --self-test exit 0 (292 assertions), --base exit 0; no-major --base exit 0.
• The marker is right on its merits, not merely present. ADR-0087's 2026-08-30 addendum (D8) defines type-surface-only as exactly this class and names A sixth client-SDK erasure spelling, larger than the other five combined: 43 exported methods return res.json() directly, whose lib.dom type is Promise< any > #12104 as its population. All four predicates hold.
• ⭐ The disclosed omission of oauth.applications.get is FORCED, not sloppy. parseSymbolRef rejects dotted paths and memberReturnAnnotation returns the first of 14 members named get — so #get would assert a verified fact about the wrong member. ADR-0087 explicitly excludes completeness from the gate's judgment.
• minor is the mandated level, read at pr-automation.yml → Check Changeset → "WHICH LEVEL", not from AGENTS.md.
• Every falsifiable contract claim was checked against @better-auth/oauth-provider@1.7.2 dist and held — including the riskiest one: user_id / application_type really are folded to undefined via ?? void 0 after the metadata spread, on all three shapes, so null is genuinely unreachable. The seven-column getPublic projection, the redirect_uris ?? [], the Math.round(getTime()/1e3) timestamps, and the consent server-side accept: application/json all verified at source.
• delete is consistent: handler ends at adapter.delete, declared void; the ledger at head has 36 entries with exactly one oauth.* entry. client SDK oauth.applications.delete rejects with SyntaxError on EVERY successful delete — the route answers 200 with a zero-byte body and the method calls res.json() on it #15451 (p1) prescribes the same fix shape.

⚠️ This PR body is stale in three places — the record, not the body, is authoritative

The reviewer flagged these and the previous verdict had already asked for two of them. Rather than rewrite prose I did not author, I am superseding them here:

body says	truth
"Final commit c0dbf802c9, clean tree."	Head is 747b9e670c6, 2 commits.
"the PR is draft and carries needs:contract-review. It waits for an at-tier contract reviewer; auto-merge is not armed and it is not enqueued."	Superseded by this comment: the review is done, the label is removed, and the PR is being flipped and enqueued.
"The #13080 BREAKING-token gate is not addressed here"	Contradicted by the changeset, which carries the BREAKING banner.
gate-union claim ("44 commands, 41 pass")	Predates the ADR-0087 run; the reviewer's own gate runs supersede it.

One finding I am NOT acting on, and one card that now exists

• ⭐ The previous verdict's finding 2 is refuted on the code — the server sets the accept header itself before authorize, and no redirect: false exists anywhere in the dist. ⛔ The card I had planned to file for it will not be filed; filing it would have put a false claim in the backlog.
• The marker promised a card for the #get ambiguity and none existed. The reviewer filed check-adr-0087-registration: a type-surface-only reference is a bare identifier resolved to the FIRST same-named definition in the file, so a nested SDK member with a common name (oauth.applications.get) cannot be named — PR #15445 had to leave its fourth narrowed member out of its marker #15627 (bare, unassigned). It will recur on family cards 2 and 3 (client SDK auth.* family: bind the 14 return res.json() methods (auth 7 · sessions 3 · twoFactor 3 · accounts.unlink 1) to their better-auth wire shapes — #12104 family card 2 of 3 #14313, client SDK organizations.* family: bind the 19 return res.json() methods (organizations 11 · invitations 3 · teams 5) to their better-auth wire shapes — #12104 family card 3 of 3 #14314).
• Non-blocking prose nits in the marker (says 13 get members, measured 14; cites line numbers that rot) are not worth a push on their own.

NOT MEASURED, recorded as such

The wire bytes end-to-end (producer code verified; the end-to-end read was the dev's), resources element type and jwks shape, optional unions beyond spot checks, and the sibling repos. ⛔ None of these is a pass.

⇒ Green, mergeable_state: clean, reviewed at tier, no blocking finding, no governed surface touched. Flipping ready and enqueueing through the merge queue.

---

Generated by Claude Code