@better-auth/core 1.7.0-beta.0 → 1.7.0-beta.10

package/dist/api/index.d.mts

@@ -8,6 +8,24 @@ import { EndpointContext, EndpointOptions, StrictEndpoint } from "better-call";
 import * as _better_auth_core0 from "@better-auth/core";
 
 //#region src/api/index.d.ts
+/**
+ * Response headers that forbid any intermediary (proxy, CDN, browser) from
+ * caching a response body. Credential-bearing responses (access/refresh tokens,
+ * ID tokens, client secrets, device codes) must carry them.
+ *
+ * Set `metadata: { noStore: true }` on an endpoint and {@link createAuthEndpoint}
+ * applies these to the responses its handler produces: the success body and any
+ * error the handler throws. A request rejected by schema or media-type
+ * validation before the handler runs is not covered, and carries no credentials
+ * to protect. Spread them into a hand-built `Response` or `APIError`'s headers
+ * for the rare endpoint that constructs its own response.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ */
+declare const NO_STORE_HEADERS: {
+  readonly "Cache-Control": "no-store";
+  readonly Pragma: "no-cache";
+};
 declare const optionsMiddleware: <InputCtx extends better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>;
 declare const createAuthMiddleware: {
   <Options extends better_call0.MiddlewareOptions, R>(options: Options, handler: (ctx: better_call0.MiddlewareContext<Options, {
@@ -272,7 +290,32 @@ declare const createAuthMiddleware: {
 type EndpointHandler<Path extends string, Options extends EndpointOptions, R> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;
 declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(path: Path, options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
 declare function createAuthEndpoint<Path extends string, Options extends EndpointOptions, R>(options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+declare namespace createAuthEndpoint {
+  /**
+   * Declare a **server-only** endpoint.
+   *
+   * The endpoint is callable through `auth.api.*` from trusted server code but is
+   * never registered on the HTTP router and never emitted into the OpenAPI
+   * schema. It takes no path because it has no URL to be reached at.
+   *
+   * Prefer this over the path-less `createAuthEndpoint({ ... }, handler)` form.
+   * Setting `metadata.SERVER_ONLY` makes the intent explicit at the call site and
+   * keeps the endpoint off the HTTP surface even if a path is later added by
+   * mistake: better-call's router skips an endpoint when its path is missing *or*
+   * when `SERVER_ONLY` is set, so the two together are defense in depth. Relying
+   * on path omission alone is invisible and one keystroke away from exposure.
+   *
+   * @example
+   * ```ts
+   * viewBackupCodes: createAuthEndpoint.serverOnly(
+   * 	{ method: "POST", body: schema },
+   * 	async (ctx) => { ... },
+   * )
+   * ```
+   */
+  function serverOnly<Path extends string, Options extends EndpointOptions, R>(options: Options, handler: EndpointHandler<Path, Options, R>): StrictEndpoint<Path, Options, R>;
+}
 type AuthEndpoint<Path extends string, Opts extends EndpointOptions, R> = ReturnType<typeof createAuthEndpoint<Path, Opts, R>>;
 type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
 //#endregion
-export { AuthEndpoint, AuthMiddleware, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };
+export { AuthEndpoint, AuthMiddleware, NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };

package/dist/api/index.mjs

@@ -1,6 +1,41 @@
 import { runWithEndpointContext } from "../context/endpoint-context.mjs";
-import { createEndpoint, createMiddleware } from "better-call";
+import { isAPIError } from "../utils/is-api-error.mjs";
+import { createEndpoint, createMiddleware, kAPIErrorHeaderSymbol } from "better-call";
 //#region src/api/index.ts
+/**
+* Response headers that forbid any intermediary (proxy, CDN, browser) from
+* caching a response body. Credential-bearing responses (access/refresh tokens,
+* ID tokens, client secrets, device codes) must carry them.
+*
+* Set `metadata: { noStore: true }` on an endpoint and {@link createAuthEndpoint}
+* applies these to the responses its handler produces: the success body and any
+* error the handler throws. A request rejected by schema or media-type
+* validation before the handler runs is not covered, and carries no credentials
+* to protect. Spread them into a hand-built `Response` or `APIError`'s headers
+* for the rare endpoint that constructs its own response.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+*/
+const NO_STORE_HEADERS = {
+	"Cache-Control": "no-store",
+	Pragma: "no-cache"
+};
+/**
+* Better-call's createEndpoint re-throws APIError without exposing the headers
+* accumulated on ctx.responseHeaders (e.g. Set-Cookie from deleteSessionCookie
+* before throw). Attach them to the error via kAPIErrorHeaderSymbol — matching
+* better-call's createMiddleware contract so the outer pipeline can merge them
+* into the response.
+*/
+function attachResponseHeadersToAPIError(responseHeaders, e) {
+	if (!isAPIError(e) || !responseHeaders) return;
+	Object.defineProperty(e, kAPIErrorHeaderSymbol, {
+		enumerable: false,
+		configurable: true,
+		value: responseHeaders,
+		writable: false
+	});
+}
 const optionsMiddleware = createMiddleware(async () => {
 	/**
 	* This will be passed on the instance of
@@ -17,14 +52,44 @@ function createAuthEndpoint(pathOrOptions, handlerOrOptions, handlerOrNever) {
 	const path = typeof pathOrOptions === "string" ? pathOrOptions : void 0;
 	const options = typeof handlerOrOptions === "object" ? handlerOrOptions : pathOrOptions;
 	const handler = typeof handlerOrOptions === "function" ? handlerOrOptions : handlerOrNever;
+	const noStore = options.metadata?.noStore === true;
+	const wrapped = async (ctx) => {
+		if (noStore) for (const [name, value] of Object.entries(NO_STORE_HEADERS)) ctx.setHeader(name, value);
+		const runtimeCtx = ctx;
+		try {
+			return await runWithEndpointContext(ctx, () => handler(ctx));
+		} catch (e) {
+			attachResponseHeadersToAPIError(runtimeCtx.responseHeaders, e);
+			throw e;
+		}
+	};
 	if (path) return createEndpoint(path, {
 		...options,
 		use: [...options?.use || [], ...use]
-	}, async (ctx) => runWithEndpointContext(ctx, () => handler(ctx)));
+	}, wrapped);
 	return createEndpoint({
 		...options,
 		use: [...options?.use || [], ...use]
-	}, async (ctx) => runWithEndpointContext(ctx, () => handler(ctx)));
+	}, wrapped);
+}
+/**
+* Set `metadata.SERVER_ONLY` while preserving any existing metadata
+* (`$Infer`, `openapi`, ...).
+*/
+function withServerOnly(options) {
+	return {
+		...options,
+		metadata: {
+			...options.metadata,
+			SERVER_ONLY: true
+		}
+	};
 }
+(function(_createAuthEndpoint) {
+	function serverOnly(options, handler) {
+		return createAuthEndpoint(withServerOnly(options), handler);
+	}
+	_createAuthEndpoint.serverOnly = serverOnly;
+})(createAuthEndpoint || (createAuthEndpoint = {}));
 //#endregion
-export { createAuthEndpoint, createAuthMiddleware, optionsMiddleware };
+export { NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };

package/dist/context/global.mjs

@@ -2,7 +2,7 @@
 const symbol = Symbol.for("better-auth:global");
 let bind = null;
 const __context = {};
-const __betterAuthVersion = "1.7.0-beta.0";
+const __betterAuthVersion = "1.7.0-beta.10";
 /**
 * We store context instance in the globalThis.
 *

package/dist/context/transaction.d.mts

@@ -1,10 +1,13 @@
 import { DBAdapter, DBTransactionAdapter } from "../db/adapter/index.mjs";
+import { BetterAuthOptions } from "../types/init-options.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 
 //#region src/context/transaction.d.ts
+type StoredAdapter = DBTransactionAdapter<BetterAuthOptions>;
 type HookContext = {
-  adapter: DBTransactionAdapter;
+  adapter: StoredAdapter;
   pendingHooks: Array<() => Promise<void>>;
+  isTransactionActive: boolean;
 };
 /**
  * This is for internal use only. Most users should use `getCurrentAdapter` instead.
@@ -12,9 +15,9 @@ type HookContext = {
  * It is exposed for advanced use cases where you need direct access to the AsyncLocalStorage instance.
  */
 declare const getCurrentDBAdapterAsyncLocalStorage: () => Promise<AsyncLocalStorage<HookContext>>;
-declare const getCurrentAdapter: (fallback: DBTransactionAdapter) => Promise<DBTransactionAdapter>;
-declare const runWithAdapter: <R>(adapter: DBAdapter, fn: () => R) => Promise<R>;
-declare const runWithTransaction: <R>(adapter: DBAdapter, fn: () => R) => Promise<R>;
+declare const getCurrentAdapter: <Options extends BetterAuthOptions = BetterAuthOptions>(fallback: DBTransactionAdapter<Options>) => Promise<DBTransactionAdapter<Options>>;
+declare const runWithAdapter: <R, Options extends BetterAuthOptions = BetterAuthOptions>(adapter: DBAdapter<Options>, fn: () => R) => Promise<R>;
+declare const runWithTransaction: <R, Options extends BetterAuthOptions = BetterAuthOptions>(adapter: DBAdapter<Options>, fn: () => R) => Promise<R>;
 /**
  * Queue a hook to be executed after the current transaction commits.
  * If not in a transaction, the hook will execute immediately.

package/dist/context/transaction.mjs

@@ -35,7 +35,8 @@ const runWithAdapter = async (adapter, fn) => {
 		try {
 			result = await als.run({
 				adapter,
-				pendingHooks
+				pendingHooks,
+				isTransactionActive: false
 			}, fn);
 		} catch (err) {
 			error = err;
@@ -50,9 +51,10 @@ const runWithAdapter = async (adapter, fn) => {
 	});
 };
 const runWithTransaction = async (adapter, fn) => {
-	let called = true;
+	let called = false;
 	return ensureAsyncStorage().then(async (als) => {
 		called = true;
+		if (als.getStore()?.isTransactionActive) return fn();
 		const pendingHooks = [];
 		let result;
 		let error;
@@ -61,7 +63,8 @@ const runWithTransaction = async (adapter, fn) => {
 			result = await adapter.transaction(async (trx) => {
 				return als.run({
 					adapter: trx,
-					pendingHooks
+					pendingHooks,
+					isTransactionActive: true
 				}, fn);
 			});
 		} catch (e) {

package/dist/db/adapter/factory.mjs

@@ -1,9 +1,7 @@
+import { BetterAuthError } from "../../error/index.mjs";
 import { getAuthTables } from "../get-tables.mjs";
 import { getColorDepth } from "../../env/color-depth.mjs";
 import { TTY_COLORS, createLogger } from "../../env/logger.mjs";
-import { BetterAuthError } from "../../error/index.mjs";
-import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME } from "../../instrumentation/attributes.mjs";
-import { withSpan } from "../../instrumentation/tracer.mjs";
 import { safeJSONParse } from "../../utils/json.mjs";
 import { initGetDefaultModelName } from "./get-default-model-name.mjs";
 import { initGetDefaultFieldName } from "./get-default-field-name.mjs";
@@ -12,6 +10,7 @@ import { initGetFieldAttributes } from "./get-field-attributes.mjs";
 import { initGetFieldName } from "./get-field-name.mjs";
 import { initGetModelName } from "./get-model-name.mjs";
 import { withApplyDefault } from "./utils.mjs";
+import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, withSpan } from "@better-auth/core/instrumentation";
 //#region src/db/adapter/factory.ts
 let debugLogs = [];
 let transactionId = -1;
@@ -58,6 +57,8 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 					else if (method === "findMany" && !config.debugLogs.findMany) return;
 					else if (method === "delete" && !config.debugLogs.delete) return;
 					else if (method === "deleteMany" && !config.debugLogs.deleteMany) return;
+					else if (method === "consumeOne" && !config.debugLogs.consumeOne) return;
+					else if (method === "incrementOne" && !config.debugLogs.incrementOne) return;
 					else if (method === "count" && !config.debugLogs.count) return;
 				}
 				logger.info(`[${config.adapterName}]`, ...args);
@@ -457,6 +458,7 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 				where: unsafeWhere,
 				action: "update"
 			});
+			if (where.length === 0) return null;
 			debugLog({ method: "update" }, `${formatTransactionId(thisTransactionId)} ${formatStep(1, 4)}`, `${formatMethod("update")} ${formatAction("Unsafe Input")}:`, {
 				model,
 				data: unsafeData
@@ -515,6 +517,7 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 				where,
 				update: data
 			}));
+			if (typeof updatedCount !== "number" || !Number.isFinite(updatedCount)) throw new BetterAuthError(`Adapter "${config.adapterId}" updateMany must return a finite number affected row count.`);
 			debugLog({ method: "updateMany" }, `${formatTransactionId(thisTransactionId)} ${formatStep(3, 4)}`, `${formatMethod("updateMany")} ${formatAction("DB Result")}:`, {
 				model,
 				data: updatedCount
@@ -677,6 +680,91 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 			});
 			return res;
 		},
+		consumeOne: async ({ model: unsafeModel, where: unsafeWhere }) => {
+			transactionId++;
+			const thisTransactionId = transactionId;
+			const model = getModelName(unsafeModel);
+			const where = transformWhereClause({
+				model: unsafeModel,
+				where: unsafeWhere,
+				action: "consumeOne"
+			});
+			unsafeModel = getDefaultModelName(unsafeModel);
+			debugLog({ method: "consumeOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(1, 3)}`, `${formatMethod("consumeOne")} ${formatAction("ConsumeOne")}:`, {
+				model,
+				where
+			});
+			if (typeof adapterInstance.consumeOne !== "function") throw new BetterAuthError(`Adapter "${config.adapterId}" must implement consumeOne for atomic single-use credential consumption.`);
+			const res = await withSpan(`db consumeOne ${model}`, {
+				[ATTR_DB_OPERATION_NAME]: "consumeOne",
+				[ATTR_DB_COLLECTION_NAME]: model
+			}, () => adapterInstance.consumeOne({
+				model,
+				where
+			}));
+			debugLog({ method: "consumeOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(2, 3)}`, `${formatMethod("consumeOne")} ${formatAction("DB Result")}:`, {
+				model,
+				data: res
+			});
+			let transformed = res;
+			if (!config.disableTransformOutput && res) transformed = await transformOutput(res, unsafeModel, void 0, void 0);
+			debugLog({ method: "consumeOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(3, 3)}`, `${formatMethod("consumeOne")} ${formatAction("Parsed Result")}:`, {
+				model,
+				data: transformed
+			});
+			return transformed;
+		},
+		incrementOne: async ({ model: unsafeModel, where: unsafeWhere, increment: unsafeIncrement, set: unsafeSet }) => {
+			const hasIncrement = Object.keys(unsafeIncrement).length > 0;
+			const hasSet = !!unsafeSet && Object.keys(unsafeSet).length > 0;
+			if (!hasIncrement && !hasSet) throw new BetterAuthError("incrementOne requires a non-empty `increment` or `set`; both were empty.");
+			transactionId++;
+			const thisTransactionId = transactionId;
+			const model = getModelName(unsafeModel);
+			const where = transformWhereClause({
+				model: unsafeModel,
+				where: unsafeWhere,
+				action: "incrementOne"
+			});
+			unsafeModel = getDefaultModelName(unsafeModel);
+			debugLog({ method: "incrementOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(1, 3)}`, `${formatMethod("incrementOne")} ${formatAction("IncrementOne")}:`, {
+				model,
+				where,
+				increment: unsafeIncrement,
+				set: unsafeSet
+			});
+			if (typeof adapterInstance.incrementOne !== "function") throw new BetterAuthError(`Adapter "${config.adapterId}" must implement incrementOne for atomic guarded counter updates.`);
+			const mappedKeys = config.mapKeysTransformInput ?? {};
+			const increment = {};
+			for (const [field, delta] of Object.entries(unsafeIncrement)) increment[mappedKeys[field] || getFieldName({
+				model: unsafeModel,
+				field
+			})] = delta;
+			let set;
+			if (unsafeSet && !config.disableTransformInput) set = await transformInput(unsafeSet, unsafeModel, "update");
+			else set = unsafeSet;
+			if (Object.keys(increment).length === 0 && (!set || Object.keys(set).length === 0)) throw new BetterAuthError("incrementOne resolved to an empty update: every increment/set field was unknown to the schema or transformed away.");
+			const res = await withSpan(`db incrementOne ${model}`, {
+				[ATTR_DB_OPERATION_NAME]: "incrementOne",
+				[ATTR_DB_COLLECTION_NAME]: model
+			}, () => adapterInstance.incrementOne({
+				model,
+				where,
+				increment,
+				set
+			}));
+			debugLog({ method: "incrementOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(2, 3)}`, `${formatMethod("incrementOne")} ${formatAction("DB Result")}:`, {
+				model,
+				data: res
+			});
+			let transformed = res;
+			if (!config.disableTransformOutput && res) transformed = await transformOutput(res, unsafeModel, void 0, void 0);
+			debugLog({ method: "incrementOne" }, `${formatTransactionId(thisTransactionId)} ${formatStep(3, 3)}`, `${formatMethod("incrementOne")} ${formatAction("Parsed Result")}:`, {
+				model,
+				data: transformed
+			});
+			return transformed;
+		},
 		count: async ({ model: unsafeModel, where: unsafeWhere }) => {
 			transactionId++;
 			const thisTransactionId = transactionId;

package/dist/db/adapter/get-id-field.mjs

@@ -40,12 +40,12 @@ const initGetIdField = ({ usePlural, schema, disableIdGeneration, options, custo
 					if (useUUIDs) {
 						if (shouldGenerateId && !forceAllowId) return value;
 						if (disableIdGeneration) return void 0;
-						if (supportsUUIDs) return void 0;
 						if (forceAllowId && typeof value === "string") if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) return value;
 						else {
 							const stack = (/* @__PURE__ */ new Error()).stack?.split("\n").filter((_, i) => i !== 1).join("\n").replace("Error:", "");
 							logger.warn("[Adapter Factory] - Invalid UUID value for field `id` provided when `forceAllowId` is true. Generating a new UUID.", stack);
 						}
+						if (supportsUUIDs) return void 0;
 						if (typeof value !== "string" && !supportsUUIDs) return crypto.randomUUID();
 						return;
 					}

package/dist/db/adapter/index.d.mts

@@ -22,6 +22,8 @@ type DBAdapterDebugLogOption = boolean | {
   findMany?: boolean | undefined;
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
+  consumeOne?: boolean | undefined;
+  incrementOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -197,7 +199,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
     /**
      * The model name.
      */
@@ -394,8 +396,14 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     where?: Where[] | undefined;
   }) => Promise<number>;
   /**
-   * ⚠︎ Update may not return the updated data
-   * if multiple where clauses are provided
+   * Update a single row matching the where clause.
+   *
+   * Returns the updated row, or `null` when no row matched. Empty `where`
+   * clauses return `null`; use `updateMany` for intentional bulk updates.
+   *
+   * This is not the race-safe primitive for guarded state transitions. Use
+   * `incrementOne` when the predicate is both selector and guard, and use
+   * `consumeOne` for single-use destructive reads.
    */
   update: <T>(data: {
     model: string;
@@ -415,6 +423,54 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     model: string;
     where: Where[];
   }) => Promise<number>;
+  /**
+   * Atomically consume a single row matching the where clause: delete it and
+   * return the deleted row, or return `null` if no row matched.
+   * Implementations MUST NOT delete any additional rows that also match a
+   * non-unique predicate.
+   *
+   * Under concurrent invocation against the same row, exactly one caller
+   * receives the row; subsequent racers receive `null`. This is the
+   * race-safe primitive for consuming single-use credentials
+   * (verification tokens, authorization codes, one-time tokens).
+   *
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee cross-process single-use semantics.
+   */
+  consumeOne: <T>(data: {
+    model: string;
+    where: Where[];
+  }) => Promise<T | null>;
+  /**
+   * Atomically apply signed numeric deltas to a single row matching the where
+   * clause. For each entry in `increment`, the operation applies
+   * `field = field + delta` in one atomic step; a negative delta decrements.
+   *
+   * The `where` clause is both the selector AND the guard: comparison
+   * operators are honored, so passing `{ field: "remaining", operator: "gt",
+   * value: 0 }` only mutates the row while `remaining` is still above zero.
+   * When the guard matches no row, the operation makes no change and returns
+   * `null`.
+   *
+   * The optional `set` map assigns absolute values to fields in the same
+   * atomic operation, alongside the increments.
+   *
+   * Returns the updated row, or `null` when the guard matched no row. Under
+   * concurrent invocation against the same row, this is the race-safe
+   * primitive for guarded counter updates (e.g. decrementing a remaining-uses
+   * counter only while it is still positive).
+   *
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee guarded counter semantics across runtimes.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: Where[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -496,6 +552,34 @@ interface CustomAdapter {
     model: string;
     where: CleanedWhere[];
   }) => Promise<number>;
+  /**
+   * Native atomic single-row consume.
+   * Implementing this method natively (e.g. `DELETE ... RETURNING *`,
+   * `findOneAndDelete`, `OUTPUT deleted.*`) gives one round trip and the
+   * strongest race-safety guarantee. Implementations must delete at most
+   * one matching row.
+   */
+  consumeOne: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<T | null>;
+  /**
+   * Native atomic guarded counter mutation. Applies
+   * `field = field + delta` for each entry in `increment` (negative deltas
+   * decrement), with `where` acting as both selector and guard and `set`
+   * assigning absolute values in the same operation. Returns the updated row,
+   * or `null` when the guard matched no row.
+   *
+   * Implementing this natively (e.g. `UPDATE ... SET n = n + $delta WHERE ...
+   * RETURNING *`) gives one round trip and the strongest race-safety
+   * guarantee.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   count: ({
     model,
     where

package/dist/db/adapter/types.d.mts

@@ -94,7 +94,7 @@ type AdapterFactoryCustomizeAdapterCreator = (config: {
   }: {
     where: W;
     model: string;
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
   }) => W extends undefined ? undefined : CleanedWhere[];
 }) => CustomAdapter;
 type AdapterTestDebugLogs = {

package/dist/db/get-tables.mjs

@@ -8,7 +8,8 @@ const getAuthTables = (options) => {
 				...acc[key]?.fields,
 				...value.fields
 			},
-			modelName: value.modelName || key
+			modelName: value.modelName || key,
+			disableMigrations: value.disableMigration ?? acc[key]?.disableMigrations
 		};
 		return acc;
 	}, {});

package/dist/db/type.d.mts

@@ -141,6 +141,23 @@ interface SecondaryStorage {
    * @returns - Value of the key
    */
   get: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically get a value and delete it from storage.
+   */
+  getAndDelete: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
+   *
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
+   *
+   * Required so secondary-storage-backed rate limiting can enforce the limit
+   * in one distributed-safe operation.
+   */
+  increment: (key: string, ttl: number) => Awaitable<number>;
   set: (
   /**
    * Key to store

package/dist/env/env-impl.mjs

@@ -27,7 +27,7 @@ const env = new Proxy(_envShim, {
 function toBoolean(val) {
 	return val ? val !== "false" : false;
 }
-const nodeENV = typeof process !== "undefined" && process.env && process.env.NODE_ENV || "";
+const nodeENV = env.NODE_ENV ?? "";
 /** Detect if `NODE_ENV` environment variable is `production` */
 const isProduction = nodeENV === "production";
 /** Detect if `NODE_ENV` environment variable is `dev` or `development` */

package/dist/error/codes.d.mts

@@ -36,6 +36,7 @@ declare const BASE_ERROR_CODES: {
   USER_ALREADY_EXISTS: RawError<"USER_ALREADY_EXISTS">;
   USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
   EMAIL_CAN_NOT_BE_UPDATED: RawError<"EMAIL_CAN_NOT_BE_UPDATED">;
+  CHANGE_EMAIL_DISABLED: RawError<"CHANGE_EMAIL_DISABLED">;
   CREDENTIAL_ACCOUNT_NOT_FOUND: RawError<"CREDENTIAL_ACCOUNT_NOT_FOUND">;
   ACCOUNT_NOT_FOUND: RawError<"ACCOUNT_NOT_FOUND">;
   SESSION_EXPIRED: RawError<"SESSION_EXPIRED">;

package/dist/error/codes.mjs

@@ -23,6 +23,7 @@ const BASE_ERROR_CODES = defineErrorCodes({
 	USER_ALREADY_EXISTS: "User already exists.",
 	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.",
 	EMAIL_CAN_NOT_BE_UPDATED: "Email can not be updated",
+	CHANGE_EMAIL_DISABLED: "Change email is disabled",
 	CREDENTIAL_ACCOUNT_NOT_FOUND: "Credential account not found",
 	SESSION_EXPIRED: "Session expired. Re-authenticate to perform this action.",
 	FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't unlink your last account",

package/dist/error/index.d.mts

@@ -7,7 +7,14 @@ declare class BetterAuthError extends Error {
     cause?: unknown | undefined;
   });
 }
+type BaseAPIErrorInstance = InstanceType<typeof APIError$1>;
 declare class APIError extends APIError$1 {
+  status: BaseAPIErrorInstance["status"];
+  body: BaseAPIErrorInstance["body"];
+  headers: BaseAPIErrorInstance["headers"];
+  statusCode: BaseAPIErrorInstance["statusCode"];
+  message: string;
+  errorStack: BaseAPIErrorInstance["errorStack"];
   constructor(...args: ConstructorParameters<typeof APIError$1>);
   static fromStatus(status: ConstructorParameters<typeof APIError$1>[0], body?: ConstructorParameters<typeof APIError$1>[1]): APIError;
   static from(status: ConstructorParameters<typeof APIError$1>[0], error: {

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 import { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection } from "./types/helper.mjs";
 import { BetterAuthPlugin, BetterAuthPluginErrorCodePart, HookEndpointContext } from "./types/plugin.mjs";
-import { BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthDBOptions, BetterAuthOptions, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, DynamicBaseURLConfig, GenerateIdFn, StoreIdentifierOption } from "./types/init-options.mjs";
+import { BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthDBOptions, BetterAuthOptions, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, DynamicBaseURLConfig, GenerateIdFn, StoreIdentifierOption, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource } from "./types/init-options.mjs";
 import { BetterAuthCookie, BetterAuthCookies } from "./types/cookie.mjs";
 import { SecretConfig } from "./types/secret.mjs";
 import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./types/plugin-client.mjs";
 import { StandardSchemaV1 } from "./types/index.mjs";
-export { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };
+export { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };

package/dist/instrumentation/api.mjs

@@ -0,0 +1,12 @@
+import { noopOpenTelemetryAPI } from "./noop.mjs";
+//#region src/instrumentation/api.ts
+let openTelemetryAPIPromise;
+let openTelemetryAPI;
+function getOpenTelemetryAPI() {
+	if (!openTelemetryAPIPromise) openTelemetryAPIPromise = import("@opentelemetry/api").then((mod) => {
+		openTelemetryAPI = mod;
+	}).catch(() => void 0);
+	return openTelemetryAPI ?? noopOpenTelemetryAPI;
+}
+//#endregion
+export { getOpenTelemetryAPI };

package/dist/instrumentation/noop.mjs

@@ -0,0 +1,42 @@
+//#region src/instrumentation/noop.ts
+function createNoopSpan() {
+	const span = {
+		end() {},
+		setAttribute(_key, _value) {},
+		setStatus(_status) {},
+		recordException(_exception) {},
+		updateName(_name) {
+			return span;
+		}
+	};
+	return span;
+}
+function createNoopTracer(noopSpan) {
+	function startActiveSpan(_name, ...rest) {
+		const fn = rest[rest.length - 1];
+		return fn(noopSpan);
+	}
+	return { startActiveSpan };
+}
+function createNoopTraceAPI() {
+	const noopTracer = createNoopTracer(createNoopSpan());
+	return {
+		getTracer(_name, _version) {
+			return noopTracer;
+		},
+		getActiveSpan() {}
+	};
+}
+function createNoopOpenTelemetryAPI() {
+	return {
+		SpanStatusCode: {
+			UNSET: 0,
+			OK: 1,
+			ERROR: 2
+		},
+		trace: createNoopTraceAPI()
+	};
+}
+const noopOpenTelemetryAPI = createNoopOpenTelemetryAPI();
+//#endregion
+export { noopOpenTelemetryAPI };