@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(plugin-auth): the phone-number password-reset request answers without waiting for the SMS send, as the emailed reset does
+
+Clause-②: no
+Metadata-protocol: none
+
+- **The rule.** `POST /api/v1/auth/phone-number/request-password-reset` answers at once, the same way for any number: the reset text is built and sent after the response, as the emailed reset (`POST /api/v1/auth/request-password-reset`) already sends its mail.
+- **A send that fails is logged on the server**, at error (`phone password-reset text was not delivered`), and never reaches the caller, who is answered `{ status: true }` either way, as before. The one-time code is in the text only, never in that line.
+- **Unchanged.** The answer's status and body; the per-number cooldown and hourly cap and the per-IP limit on the route; the text itself; and a server-side `auth.api.requestPasswordResetPhoneNumber` call, which carries no request and still awaits its send.
@@ -500,7 +500,7 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a
             `${invitation ? 'Account-invitation' : 'Password-reset'} email could not be sent to ${user.email}: ${result.error ?? 'delivery failed'}`,
           );
         }
-      }), (error) => logAfterResponseSendFailure(this.config.logger, 'password-reset', error)),
+      }), (error) => logAfterResponseSendFailure(this.config.logger, 'password-reset email', error)),
       // [#25060, ruling 1B on #25040] The mail half of "a sign-up for an
       // address that already has an account answers like a success". The
       // vendor calls this only when the address already has a row AND its
 
@@ -81,6 +81,7 @@ import {
   buildTwoFactorPluginSchema,
 } from './auth-schema-config.js';
 import { isPlaceholderEmail } from './placeholder-email.js';
+import { logAfterResponseSendFailure, sendAfterResponseOnPublicDoor } from './run-after-response.js';
 import {
   ONE_TIME_TOKEN_EXPIRES_IN_MINUTES,
   oneTimeTokenStoreHasher,
@@ -354,6 +355,15 @@ export async function buildPluginList(this: PluginListHost): Promise<any[]> {
     // by the admin create-user/import routes with a placeholder email
     // (see placeholder-email.ts), never by OTP self-signup.
     const otpCfg = this.config.phoneOtp ?? {};
+    // The reset text, sent the way the emailed reset sends its mail
+    // (`sendResetPassword`, `auth-manager-auth-instance.ts`): on the public
+    // door after the response, its failure logged on the server.
+    const sendPasswordResetText = sendAfterResponseOnPublicDoor(
+      async ({ phoneNumber: phone, code }: { phoneNumber: string; code: string }) => {
+        await this.deliverPhoneOtp(phone, code);
+      },
+      (error) => logAfterResponseSendFailure(this.config.logger, 'phone password-reset text', error),
+    );
     return phoneNumber({
       schema: buildPhoneNumberPluginSchema(),
       // Wrong-code attempts before the stored OTP is invalidated. Explicit
@@ -373,13 +383,19 @@ export async function buildPluginList(this: PluginListHost): Promise<any[]> {
         await this.deliverPhoneOtp(phone, code);
       },
       // Self-service password reset OTP (`/phone-number/request-password-
-      // reset`). better-auth invokes this via runInBackgroundOrAwait —
-      // errors are logged, the route still answers {status:true} — so a
-      // throw here can neither 500 the request nor leak whether the number
-      // is registered.
-      sendPasswordResetOTP: async ({ phoneNumber: phone, code }) => {
-        await this.deliverPhoneOtp(phone, code);
-      },
+      // reset`). The request answers the same way for any number, answers
+      // at once and does not wait on the SMS send, as the emailed reset
+      // does: a call that carries a `Request` — the public door — resolves
+      // immediately and the text is built and sent after the response
+      // (`sendAfterResponseOnPublicDoor`); what the send does is logged on
+      // the server and never reaches the caller, who is answered
+      // `{ status: true }` either way. better-auth hands this callback the
+      // endpoint context, not the `Request` the emailed reset is handed
+      // (`sendPasswordResetOTP(data, ctx)`, better-auth 1.7.12
+      // `plugins/phone-number/routes.mjs`), so the context's own `request`
+      // is what decides: a server-side `auth.api.*` call carries none and
+      // still awaits its send.
+      sendPasswordResetOTP: (data, ctx) => sendPasswordResetText(data, ctx?.request),
     });
     });
   }
 
@@ -267,12 +267,12 @@ describe('POST /phone-number/send-otp without a deliverable SMS service', () =>
       }),
     );
 
-    // better-auth runs this send through `runInBackgroundOrAwait`, which logs a
-    // throw and answers success — so the refusal cannot leak, by status or
-    // body, whether the number belongs to an account.
+    // On this public door the send runs after the response
+    // (`sendAfterResponseOnPublicDoor`) and what it throws is logged on the
+    // server — so the refusal cannot change the answer, by status or body.
     expect(response.status, await response.clone().text()).toBe(200);
     expect(await response.json()).toEqual({ status: true });
-    expect(deliver).toHaveBeenCalledTimes(1);
+    await vi.waitFor(() => expect(deliver).toHaveBeenCalledTimes(1));
     await expect(deliver.mock.results[0]?.value).rejects.toMatchObject({
       statusCode: 400,
       body: { code: 'SMS_SERVICE_REQUIRED' },
 
@@ -19,6 +19,14 @@
  *    answer is the one a succeeding send gets;
  *  - the server-side reset call (no `Request` — the identity import's) still
  *    awaits its send, because it reads the delivery receipt the send settles;
+ *  - the phone-number reset request (`plugins.phoneNumber` with an SMS
+ *    service) answers without waiting for the SMS send, as the emailed reset
+ *    does: a number with an account and a number without one get the same
+ *    answer while the reset text's send is still open, and the text still
+ *    goes out after the response; a text whose send fails is logged on the
+ *    server at error, without its code, and the answer is the one a sent text
+ *    gets; the server-side phone reset call (no `Request`) still awaits its
+ *    send;
  *  - `runAfterResponse` hands a task's synchronous throw to `onFailure` and
  *    survives an `onFailure` that throws.
  */
@@ -177,6 +185,118 @@ describe('a reset request answers without waiting on the reset mail', () => {
   }, 60_000);
 });
 
+describe('the phone-number reset request answers without waiting on the reset text', () => {
+  const PHONE = '+15550161';
+  const NO_ACCOUNT_PHONE = '+15550162';
+  const SYS = { context: { isSystem: true } } as never;
+
+  type Text = { to: string; templateParams?: { code?: string } };
+
+  /** A promise the case settles by hand. */
+  function deferred(): { promise: Promise<void>; resolve: () => void } {
+    let resolve!: () => void;
+    const promise = new Promise<void>((r) => {
+      resolve = r;
+    });
+    return { promise, resolve };
+  }
+
+  /**
+   * A deployment with phone-number sign-in and one account holding `PHONE`,
+   * whose SMS service hands each send to `answer`, and records every text it
+   * was handed (`texts`) and the number of every send that has settled
+   * (`settled`).
+   */
+  async function phoneDeployment(answer: () => Promise<unknown>) {
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const engine = await engines.take();
+    const logged: string[] = [];
+    const manager = new AuthManager({
+      secret: SECRET,
+      baseUrl: BASE,
+      dataEngine: engine as never,
+      plugins: { phoneNumber: true },
+      logger: { warn: () => {}, error: (message: string) => logged.push(message) },
+    } as never);
+    manager.setEmailService({ sendTemplate: async () => ({ status: 'sent' }) } as never);
+    const texts: Text[] = [];
+    const settled: string[] = [];
+    manager.setSmsService({
+      async send(input: Text) {
+        texts.push(input);
+        try {
+          return await answer();
+        } finally {
+          settled.push(input.to);
+        }
+      },
+      isConfigured: () => true,
+    } as never);
+    const signedUp = await post(manager, '/sign-up/email', { email: EMAIL, password: PASSWORD, name: 'Reset' });
+    expect(signedUp.status, await signedUp.clone().text()).toBe(200);
+    const [user] = (await engine.find('sys_user', { where: { email: EMAIL }, limit: 1 }, SYS)) as Array<{ id: string }>;
+    await engine.update('sys_user', { id: user.id, phone_number: PHONE, phone_number_verified: true }, SYS);
+    return { manager, texts, settled, logged };
+  }
+
+  async function requestPhoneReset(manager: AuthManager, phoneNumber: string): Promise<{ status: number; body: string }> {
+    const res = await post(manager, '/phone-number/request-password-reset', { phoneNumber });
+    return { status: res.status, body: await res.text() };
+  }
+
+  it('answers a number with an account and a number without one alike, while the reset text is still being sent', async () => {
+    const send = deferred();
+    const d = await phoneDeployment(async () => {
+      await send.promise;
+      return { id: 'sms1', status: 'sent' };
+    });
+
+    const forAccount = await requestPhoneReset(d.manager, PHONE);
+    const forNobody = await requestPhoneReset(d.manager, NO_ACCOUNT_PHONE);
+
+    expect(forAccount.status).toBe(200);
+    expect(forAccount).toEqual(forNobody);
+    // Both answers arrived while the text's send was still open.
+    expect(d.settled).toEqual([]);
+
+    // The control: the text still goes to the number, after the response.
+    send.resolve();
+    await vi.waitFor(() => expect(d.settled).toEqual([PHONE]));
+    expect(d.texts.map((t) => t.to)).toEqual([PHONE]);
+    expect(d.logged).toEqual([]);
+  }, 60_000);
+
+  it('logs a reset text whose send fails on the server, without its code, and answers as for a text that is sent', async () => {
+    const failing = await phoneDeployment(async () => ({ status: 'failed', error: 'carrier unavailable' }));
+    const sending = await phoneDeployment(async () => ({ id: 'sms1', status: 'sent' }));
+
+    const throughFailing = await requestPhoneReset(failing.manager, PHONE);
+    const throughSending = await requestPhoneReset(sending.manager, PHONE);
+
+    expect(throughFailing).toEqual(throughSending);
+    await vi.waitFor(() => expect(failing.logged).toHaveLength(1));
+    expect(failing.logged[0]).toContain('phone password-reset text was not delivered');
+    expect(failing.logged[0]).toContain('carrier unavailable');
+    const code = String(failing.texts[0]?.templateParams?.code ?? '');
+    expect(code, 'the text carries its code').not.toBe('');
+    expect(failing.logged[0]).not.toContain(code);
+  }, 60_000);
+
+  it('the server-side phone reset call (no Request) still awaits its send', async () => {
+    const d = await phoneDeployment(async () => {
+      await new Promise((resolve) => setImmediate(resolve));
+      return { id: 'sms1', status: 'sent' };
+    });
+    const api = (await d.manager.getApi()) as unknown as {
+      requestPasswordResetPhoneNumber(input: { body: { phoneNumber: string } }): Promise<unknown>;
+    };
+
+    await api.requestPasswordResetPhoneNumber({ body: { phoneNumber: PHONE } });
+
+    expect(d.settled).toEqual([PHONE]);
+  }, 60_000);
+});
+
 describe('runAfterResponse', () => {
   it("hands a task's synchronous throw to onFailure", async () => {
     const failures: unknown[] = [];
 
@@ -12,6 +12,9 @@
  * (`auth-manager-auth-instance.ts`, `sendResetPassword`), and what the send
  * does is the server's to log, never the caller's to see — which it already
  * never was: better-auth answers `{ status: true }` whatever the send does.
+ * The phone-number reset request answers the same way, and its reset text is
+ * sent after the response on the same terms (`auth-manager-plugin-list.ts`,
+ * `sendPasswordResetOTP`).
  *
  * ## How
  *
@@ -44,12 +47,14 @@ export function runAfterResponse(task: () => Promise<unknown>, onFailure: (error
 }
 
 /**
- * Wrap a better-auth mail callback — called as `(data, request)` — so that a
+ * Wrap a better-auth send callback — called as `(data, request)` — so that a
  * call carrying its `Request` (every HTTP request: the public door) resolves at
  * once and the send runs after the response ({@link runAfterResponse}), its
  * failure going to `onFailure`. A call without one (a server-side `auth.api.*`
  * call, such as the identity import's) is handed straight to `send` — the same
- * promise — and awaited by its caller exactly as before.
+ * promise — and awaited by its caller exactly as before. A callback better-auth
+ * hands the endpoint context instead (the phone-number reset's) is called
+ * with that context's `request`, the value the emailed reset is handed.
  */
 export function sendAfterResponseOnPublicDoor<D>(
   send: (data: D, request?: unknown) => Promise<unknown>,
@@ -76,11 +81,12 @@ type FailureLogger = {
  * `error` when the host logger carries it, else its guaranteed `warn`, else —
  * no host logger at all — the console: the level better-auth's own
  * background-task log used for the same failure while the send ran inside the
- * request. Called through the property, never an extracted reference (a
- * class-based logger needs its receiver).
+ * request. `what` names the send, its medium included (`password-reset
+ * email`, `phone password-reset text`). Called through the property, never an
+ * extracted reference (a class-based logger needs its receiver).
  */
 export function logAfterResponseSendFailure(logger: unknown, what: string, error: unknown): void {
-  const message = `[AuthManager] ${what} email was not delivered: ${
+  const message = `[AuthManager] ${what} was not delivered: ${
     error instanceof Error ? error.message : String(error)
   }`;
   const sink = logger as FailureLogger | undefined;
Original file line number	Diff line number	Diff line change
`@@ -500,7 +500,7 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a`
`500`	`500`	`${invitation ? 'Account-invitation' : 'Password-reset'} email could not be sent to ${user.email}: ${result.error ?? 'delivery failed'}`,
`501`	`501`	`);`
`502`	`502`	`}`
`503`		`- }), (error) => logAfterResponseSendFailure(this.config.logger, 'password-reset', error)),`
	`503`	`+ }), (error) => logAfterResponseSendFailure(this.config.logger, 'password-reset email', error)),`
`504`	`504`	`// [#25060, ruling 1B on #25040] The mail half of "a sign-up for an`
`505`	`505`	`// address that already has an account answers like a success". The`
`506`	`506`	`// vendor calls this only when the address already has a row AND its`