Release v5.2.8 (#3375)

Upgrades to Better Auth 1.7, expands Custom Styles coverage of item headers, and adds a human-approval step to the AI agent's resume edits.

Breaking for self-hosters using a custom OAuth provider: the callback path changes from /api/auth/oauth2/callback/custom to /api/auth/callback/custom, and installs using OAUTH_DISCOVERY_URL need one additional UPDATE after upgrading. Both are documented in docs/self-hosting/sso.mdx.

- Better Auth 1.7, with the account issuer migration and the jwks alg/crv columns the 1.7 jwt plugin requires
- Agent edits gated behind an approval step, with crash-safe runs and context pruning
- item-header now covers every section header row on every template; adds the item-header-row part
- Fixes provider unlinking, auth error messages, and version conflicts on freshly created resumes
- New /auth/error page, translated across all 53 target locales
- DeepSeek Harness plugin moved into packages/dsh-plugin
- Dependency bumps across the workspace

packages/db/package.json

@@ -30,7 +30,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@types/pg": "^8.23.0",
+		"@types/pg": "^8.23.1",
 		"@typescript/native-preview": "7.0.0-dev.20260707.2",
 		"drizzle-kit": "1.0.0-rc.4",
 		"typescript": "^7.0.2"

packages/db/src/schema/auth.ts

@@ -78,6 +78,10 @@ export const account = pg.pgTable(
 			.$defaultFn(() => generateId()),
 		accountId: pg.text("account_id").notNull(),
 		providerId: pg.text("provider_id").notNull().default("credential"),
+		// Better Auth 1.7 scopes account identity to (issuer, accountId) rather than providerId.
+		// Real OIDC issuers are stored verbatim; providers without one get a synthetic
+		// `local:`/`local:oauth:` namespace. See migrations/*_account_issuer for the backfill.
+		issuer: pg.text("issuer").notNull(),
 		userId: pg
 			.text("user_id")
 			.notNull()
@@ -100,7 +104,7 @@ export const account = pg.pgTable(
 			.defaultNow()
 			.$onUpdate(() => /* @__PURE__ */ new Date()),
 	},
-	(t) => [pg.index().on(t.userId)],
+	(t) => [pg.index().on(t.userId), pg.uniqueIndex("account_issuer_account_id_unique_idx").on(t.issuer, t.accountId)],
 );
 
 export const verification = pg.pgTable(
@@ -236,6 +240,11 @@ export const jwks = pg.pgTable("jwks", {
 	privateKey: pg.text("private_key").notNull(),
 	createdAt: pg.timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
 	expiresAt: pg.timestamp("expires_at", { withTimezone: true }),
+	// Better Auth 1.7 added `alg` and `crv` to the jwt plugin's jwks model. Both are optional to
+	// the plugin, but the Drizzle adapter rejects a model whose columns it cannot find, so every
+	// session verification throws until they exist. Existing rows keep NULL and stay valid.
+	alg: pg.text("alg"),
+	crv: pg.text("crv"),
 });
 
 export const oauthClient = pg.pgTable(

packages/db/vitest.config.ts

@@ -1,6 +1,6 @@
 import { fileURLToPath } from "node:url";
 // @boundaries-ignore root shared Vitest config
-import { createVitestProjectConfig } from "../../vitest.shared";
+import { createVitestProjectConfig } from "../../vitest.shared.mts";
 
 export default createVitestProjectConfig({
 	name: "@reactive-resume/db",