@better-auth/electron 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/preload.d.mts

@@ -1,5 +1,7 @@
 import electron from "electron";
 import * as z from "zod";
+import * as jose from "jose";
+import { JWTVerifyGetKey } from "jose";
 import { Database } from "bun:sqlite";
 import { DatabaseSync } from "node:sqlite";
 import { D1Database } from "@cloudflare/workers-types";
@@ -30,6 +32,8 @@ type DBAdapterDebugLogOption = boolean | {
   findMany?: boolean | undefined;
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
+  consumeOne?: boolean | undefined;
+  incrementOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -205,7 +209,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
     /**
      * The model name.
      */
@@ -402,8 +406,14 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     where?: Where[] | undefined;
   }) => Promise<number>;
   /**
-   * ⚠︎ Update may not return the updated data
-   * if multiple where clauses are provided
+   * Update a single row matching the where clause.
+   *
+   * Returns the updated row, or `null` when no row matched. Empty `where`
+   * clauses return `null`; use `updateMany` for intentional bulk updates.
+   *
+   * This is not the race-safe primitive for guarded state transitions. Use
+   * `incrementOne` when the predicate is both selector and guard, and use
+   * `consumeOne` for single-use destructive reads.
    */
   update: <T>(data: {
     model: string;
@@ -423,6 +433,54 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     model: string;
     where: Where[];
   }) => Promise<number>;
+  /**
+   * Atomically consume a single row matching the where clause: delete it and
+   * return the deleted row, or return `null` if no row matched.
+   * Implementations MUST NOT delete any additional rows that also match a
+   * non-unique predicate.
+   *
+   * Under concurrent invocation against the same row, exactly one caller
+   * receives the row; subsequent racers receive `null`. This is the
+   * race-safe primitive for consuming single-use credentials
+   * (verification tokens, authorization codes, one-time tokens).
+   *
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee cross-process single-use semantics.
+   */
+  consumeOne: <T>(data: {
+    model: string;
+    where: Where[];
+  }) => Promise<T | null>;
+  /**
+   * Atomically apply signed numeric deltas to a single row matching the where
+   * clause. For each entry in `increment`, the operation applies
+   * `field = field + delta` in one atomic step; a negative delta decrements.
+   *
+   * The `where` clause is both the selector AND the guard: comparison
+   * operators are honored, so passing `{ field: "remaining", operator: "gt",
+   * value: 0 }` only mutates the row while `remaining` is still above zero.
+   * When the guard matches no row, the operation makes no change and returns
+   * `null`.
+   *
+   * The optional `set` map assigns absolute values to fields in the same
+   * atomic operation, alongside the increments.
+   *
+   * Returns the updated row, or `null` when the guard matched no row. Under
+   * concurrent invocation against the same row, this is the race-safe
+   * primitive for guarded counter updates (e.g. decrementing a remaining-uses
+   * counter only while it is still positive).
+   *
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee guarded counter semantics across runtimes.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: Where[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -504,6 +562,34 @@ interface CustomAdapter {
     model: string;
     where: CleanedWhere[];
   }) => Promise<number>;
+  /**
+   * Native atomic single-row consume.
+   * Implementing this method natively (e.g. `DELETE ... RETURNING *`,
+   * `findOneAndDelete`, `OUTPUT deleted.*`) gives one round trip and the
+   * strongest race-safety guarantee. Implementations must delete at most
+   * one matching row.
+   */
+  consumeOne: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<T | null>;
+  /**
+   * Native atomic guarded counter mutation. Applies
+   * `field = field + delta` for each entry in `increment` (negative deltas
+   * decrement), with `where` acting as both selector and guard and `set`
+   * assigning absolute values in the same operation. Returns the updated row,
+   * or `null` when the guard matched no row.
+   *
+   * Implementing this natively (e.g. `UPDATE ... SET n = n + $delta WHERE ...
+   * RETURNING *`) gives one round trip and the strongest race-safety
+   * guarantee.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   count: ({
     model,
     where
@@ -541,7 +627,6 @@ type BaseRateLimit = z.infer<typeof rateLimitSchema>;
 /**
  * Rate limit schema type used by better-auth for rate limiting
  */
-type RateLimit<DBOptions extends BetterAuthOptions["rateLimit"] = BetterAuthOptions["rateLimit"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify$1<BaseRateLimit & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"rateLimit", Plugins>>; //#endregion
 //#endregion
 //#region ../core/dist/db/schema/session.d.mts
 //#region src/db/schema/session.d.ts
@@ -610,6 +695,52 @@ declare const createLogger: (options?: Logger | undefined) => InternalLogger;
 //#endregion
 //#region ../core/dist/oauth2/oauth-provider.d.mts
 //#region src/oauth2/oauth-provider.d.ts
+/**
+ * id_token verification config for a social provider.
+ *
+ * Declares how a client-submitted id_token is verified. The shared verifier
+ * (`verifyProviderIdToken`) consumes this instead of each provider implementing its own
+ * boolean check, so verification is centralized and fail-closed: a provider without a config
+ * cannot accept a forged token by omission.
+ */
+type OAuthIdTokenConfig = {
+  /**
+   * JWKS resolver used to verify the JWS signature. Accepts a jose
+   * `createRemoteJWKSet` resolver or a key-resolving function
+   * `(protectedHeader) => key`.
+   */
+  jwks: JWTVerifyGetKey; /** Expected `iss`. Omit for providers whose issuer varies per tenant. */
+  issuer?: (string | string[]) | undefined; /** Expected `aud`, usually the client ID. */
+  audience: string | string[]; /** Permitted JWS algorithms. Defaults to the token's `alg` header. */
+  algorithms?: string[] | undefined; /** Maximum token age passed to jose (e.g. `"1h"`). */
+  maxTokenAge?: string | undefined;
+  /**
+   * How the `nonce` claim is compared to the expected nonce.
+   * - `"exact"` (default): strict equality.
+   * - `"exact-or-sha256"`: matches the raw nonce or its SHA-256 hex digest (Apple).
+   */
+  nonceComparison?: ("exact" | "exact-or-sha256") | undefined;
+  /**
+   * Accept non-JWS (opaque) tokens without signature verification. Identity is then
+   * resolved by getUserInfo from the access token via the provider userinfo endpoint,
+   * which validates it (e.g. Facebook Graph access tokens).
+   */
+  allowOpaqueToken?: boolean | undefined;
+  /**
+   * Provider-specific claim check applied after the signature, issuer,
+   * audience, max-age, and nonce checks pass. Return `false` to reject the
+   * token. Used to enforce constraints the standard checks cannot express,
+   * e.g. Google's hosted-domain (`hd`) restriction. Omitted by providers
+   * that have no extra claim requirement.
+   */
+  verifyClaims?: ((claims: Record<string, unknown>) => boolean) | undefined;
+} | {
+  /**
+   * Custom verifier for providers that cannot verify against a local JWKS, such as a
+   * remote verification endpoint (e.g. LINE).
+   */
+  verify: (token: string, nonce?: string) => Promise<boolean>;
+};
 interface OAuth2Tokens {
   tokenType?: string | undefined;
   accessToken?: string | undefined;
@@ -631,8 +762,30 @@ type OAuth2UserInfo = {
   image?: string | undefined;
   emailVerified: boolean;
 };
+/**
+ * Request metadata available to provider refresh hooks.
+ *
+ * The refresh flow may be triggered by endpoints such as `getAccessToken` or
+ * `refreshToken`; this context gives provider hooks access to the triggering
+ * request without exposing the full endpoint implementation surface.
+ */
+interface OAuthRefreshContext {
+  headers?: Headers | undefined;
+  request?: Request | undefined;
+}
 interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
   id: LiteralString;
+  /**
+   * Optional path under the resolved per-request `baseURL` where this
+   * provider's OAuth callback handler is mounted. Providers that use the
+   * shared `/callback/<id>` route can omit this.
+   *
+   * Custom paths must start with `/`.
+   *
+   * Endpoints compose `redirectURI = ctx.context.baseURL + callbackPath` per
+   * request, so the provider must not hardcode an origin or `baseURL` here.
+   */
+  callbackPath?: string | undefined;
   createAuthorizationURL: (data: {
     state: string;
     codeVerifier: string;
@@ -640,6 +793,19 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    /**
+     * OIDC nonce generated by the redirect initiator and persisted in OAuth
+     * state. Providers that set `requiresIdTokenNonce` must forward this to
+     * the authorization URL as the `nonce` parameter.
+     */
+    idTokenNonce?: string | undefined;
+    /**
+     * Extra query parameters to append to the authorization URL.
+     * Providers forward these to the shared `createAuthorizationURL` helper,
+     * which drops any keys present in `RESERVED_AUTHORIZATION_PARAMS`
+     * before applying them.
+     */
+    additionalParams?: Record<string, string> | undefined;
   }) => Awaitable<URL>;
   name: string;
   validateAuthorizationCode: (data: {
@@ -649,6 +815,12 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens | null>;
   getUserInfo: (token: OAuth2Tokens & {
+    /**
+     * OIDC nonce recovered from OAuth state. Providers that required an
+     * ID-token nonce must pass this to `verifyProviderIdToken` before
+     * trusting ID-token claims.
+     */
+    expectedIdTokenNonce?: string | undefined;
     /**
      * The user object from the provider
      * This is only available for some providers like Apple
@@ -665,23 +837,33 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
     data: T;
   } | null>;
   /**
-   * Custom function to refresh a token
+   * Custom function to refresh a token.
+   *
+   * Receives request metadata from the endpoint that triggered the refresh.
+   * Providers that don't need request-scoped data can ignore the second
+   * argument.
    */
-  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  refreshAccessToken?: ((refreshToken: string, ctx?: OAuthRefreshContext) => Promise<OAuth2Tokens>) | undefined;
   revokeToken?: ((token: string) => Promise<void>) | undefined;
   /**
-   * Verify the id token
-   * @param token - The id token
-   * @param nonce - The nonce
-   * @returns True if the id token is valid, false otherwise
+   * Declarative id_token verification config consumed by the shared
+   * `verifyProviderIdToken` verifier. Providers set this instead of implementing a boolean
+   * verify method, which keeps verification centralized and fail-closed.
    */
-  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  idToken?: OAuthIdTokenConfig | undefined;
   /**
    * The expected issuer identifier for this provider (RFC 9207).
    * When set, the callback handler validates the `iss` query parameter
    * against this value to prevent authorization server mix-up attacks.
    */
   issuer?: string | undefined;
+  /**
+   * Require shared OAuth redirect routes to bind ID-token verification to an
+   * authorization request nonce. When true, routes generate `idTokenNonce`,
+   * pass it to `createAuthorizationURL`, persist it in state, and provide it
+   * back to `getUserInfo` as `expectedIdTokenNonce`.
+   */
+  requiresIdTokenNonce?: boolean | undefined;
   /**
    * Disable implicit sign up for new users. When set to true for the provider,
    * sign-in need to be called with with requestSignUp as true to create new users.
@@ -691,6 +873,17 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    * Disable sign up for new users.
    */
   disableSignUp?: boolean | undefined;
+  /**
+   * Accept callbacks that arrive without a `state` parameter. When true,
+   * the shared OAuth callback handler restarts the flow server-side with
+   * fresh `state` and PKCE instead of rejecting the request. Intended for
+   * providers that initiate OAuth without RP-side flow kickoff (e.g.
+   * Clever). Leave unset for any provider that always initiates from the
+   * RP.
+   *
+   * @default false
+   */
+  allowIdpInitiated?: boolean | undefined;
   /**
    * Options for the provider
    */
@@ -700,9 +893,10 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
   /**
    * The client ID of your application.
    *
-   * This is usually a string but can be any type depending on the provider.
+   * Some providers accept multiple platform client IDs. The first entry is the
+   * primary client ID used for token endpoint client authentication.
    */
-  clientId?: unknown | undefined;
+  clientId?: LiteralString | string[] | undefined;
   /**
    * The client secret of your application
    */
@@ -803,6 +997,29 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
    * @default false
    */
   overrideUserInfoOnSignIn?: boolean | undefined;
+  /**
+   * Require this provider's email to be verified before a session is created.
+   *
+   * When the provider reports the email as unverified, the user and account are
+   * still created/linked, but no session is issued: the OAuth callback redirects
+   * with `?error=email_not_verified` and id-token sign-in returns a `403`
+   * `EMAIL_NOT_VERIFIED`. A verification email is (re)sent per the
+   * `emailVerification` settings (`sendOnSignUp` / `sendOnSignIn`).
+   *
+   * The gate checks the local user's verification state, not the provider's
+   * claim on each request: a user already verified through another method (or a
+   * prior verified sign-in) keeps access even if the provider later reports the
+   * email as unverified.
+   *
+   * This is opt-in per provider and is independent of
+   * `emailAndPassword.requireEmailVerification`; enabling that does not gate
+   * social sign-in. Only enable it for providers that report a trustworthy
+   * `email_verified` signal: several providers always report the email as
+   * unverified, which would block every sign-in.
+   *
+   * @default false
+   */
+  requireEmailVerification?: boolean | undefined;
 }; //#endregion
 //#endregion
 //#region ../core/dist/social-providers/apple.d.mts
@@ -819,7 +1036,7 @@ interface AppleProfile {
    * The email address is either the user's real email address or the proxy
    * address, depending on their status private email relay service.
    */
-  email: string;
+  email?: string;
   /**
    * A string or Boolean value that indicates whether the service verifies
    * the email. The value can either be a string ("true" or "false") or a
@@ -867,7 +1084,7 @@ interface AppleNonConformUser {
   email: string;
 }
 interface AppleOptions extends ProviderOptions<AppleProfile> {
-  clientId: string;
+  clientId: string | string[];
   appBundleIdentifier?: string | undefined;
   audience?: (string | string[]) | undefined;
 }
@@ -914,7 +1131,7 @@ interface CognitoProfile {
   [key: string]: any;
 }
 interface CognitoOptions extends ProviderOptions<CognitoProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The Cognito domain (e.g., "your-app.auth.us-east-1.amazoncognito.com")
    */
@@ -925,6 +1142,19 @@ interface CognitoOptions extends ProviderOptions<CognitoProfile> {
   region: string;
   userPoolId: string;
   requireClientSecret?: boolean | undefined;
+  /**
+   * Skip the Cognito hosted-UI identity-provider picker by preselecting an
+   * IdP (maps to the `identity_provider` query parameter on the authorize
+   * request). Accepts `"COGNITO"`, a SAML/OIDC provider name configured on
+   * the User Pool, or one of the social providers (`"Google"`, `"Facebook"`,
+   * `"LoginWithAmazon"`, `"SignInWithApple"`).
+   *
+   * Per-request overrides via `signIn.social({ additionalParams: { identity_provider } })`
+   * take precedence over this value.
+   *
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
+   */
+  identityProvider?: string | undefined;
 }
 //#endregion
 //#region ../core/dist/social-providers/discord.d.mts
@@ -967,7 +1197,7 @@ interface DiscordProfile extends Record<string, any> {
   /** whether the email on this account has been verified */
   verified: boolean;
   /** the user's email */
-  email: string;
+  email?: string | null;
   /**
    * the flags on a user's account:
    * https://discord.com/developers/docs/resources/user#user-object-user-flags
@@ -1009,8 +1239,8 @@ interface DiscordOptions extends ProviderOptions<DiscordProfile> {
 interface FacebookProfile {
   id: string;
   name: string;
-  email: string;
-  email_verified: boolean;
+  email?: string;
+  email_verified?: boolean;
   picture: {
     data: {
       height: number;
@@ -1021,7 +1251,7 @@ interface FacebookProfile {
   };
 }
 interface FacebookOptions extends ProviderOptions<FacebookProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * Extend list of fields to retrieve from the Facebook user profile.
    *
@@ -1071,7 +1301,7 @@ interface GithubProfile {
   company: string;
   blog: string;
   location: string;
-  email: string;
+  email: string | null;
   hireable: boolean;
   bio: string;
   twitter_username: string;
@@ -1098,6 +1328,15 @@ interface GithubOptions extends ProviderOptions<GithubProfile> {
   clientId: string;
 }
 //#endregion
+//#region ../core/dist/oauth2/client-assertion.d.mts
+type ClientAssertionGrantType = "authorization_code" | "refresh_token" | "client_credentials";
+interface ClientAssertionContext {
+  clientId: string;
+  tokenEndpoint: string;
+  grantType: ClientAssertionGrantType;
+}
+type ClientAssertionGetter = (context: ClientAssertionContext) => Awaitable<string>;
+//#endregion
 //#region ../core/dist/social-providers/microsoft-entra-id.d.mts
 //#region src/social-providers/microsoft-entra-id.d.ts
 /**
@@ -1125,7 +1364,7 @@ interface MicrosoftEntraIDProfile extends Record<string, any> {
   /** The primary username that represents the user */
   preferred_username: string;
   /** User's email address */
-  email: string;
+  email?: string;
   /** Human-readable value that identifies the subject of the token */
   name: string;
   /** Matches the parameter included in the original authorize request */
@@ -1204,26 +1443,34 @@ interface MicrosoftEntraIDProfile extends Record<string, any> {
   given_name: string;
 }
 interface MicrosoftOptions extends ProviderOptions<MicrosoftEntraIDProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The tenant ID of the Microsoft account
    * @default "common"
    */
-  tenantId?: string | undefined;
+  tenantId?: string;
   /**
    * The authentication authority URL. Use the default "https://login.microsoftonline.com" for standard Entra ID or "https://<tenant-id>.ciamlogin.com" for CIAM scenarios.
    * @default "https://login.microsoftonline.com"
    */
-  authority?: string | undefined;
+  authority?: string;
+  /**
+   * Function that returns a JWT client assertion for token endpoint authentication.
+   *
+   * Use this instead of `clientSecret` when your Microsoft Entra ID app is
+   * configured for client authentication with assertions (private_key_jwt or
+   * workload identity federation).
+   */
+  clientAssertion?: ClientAssertionGetter;
   /**
    * The size of the profile photo
    * @default 48
    */
-  profilePhotoSize?: (48 | 64 | 96 | 120 | 240 | 360 | 432 | 504 | 648) | undefined;
+  profilePhotoSize?: 48 | 64 | 96 | 120 | 240 | 360 | 432 | 504 | 648;
   /**
    * Disable profile photo
    */
-  disableProfilePhoto?: boolean | undefined;
+  disableProfilePhoto?: boolean;
 }
 //#endregion
 //#region ../core/dist/social-providers/google.d.mts
@@ -1255,7 +1502,7 @@ interface GoogleProfile {
   sub: string;
 }
 interface GoogleOptions extends ProviderOptions<GoogleProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The access type to use for the authorization code request
    */
@@ -1265,9 +1512,25 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   display?: ("page" | "popup" | "touch" | "wap") | undefined;
   /**
-   * The hosted domain of the user
+   * The hosted domain (Google Workspace) the user must belong to.
+   *
+   * This is sent to Google as the `hd` authorization hint and, when set, is
+   * also enforced against the `hd` claim of the returned id token/profile.
+   * Set `hd: "*"` to require any Workspace hosted-domain claim. Sign-in is
+   * rejected when the claim is missing or does not satisfy this restriction.
    */
   hd?: string | undefined;
+  /**
+   * Whether to send `include_granted_scopes=true` to Google's authorization
+   * endpoint, which lets new access tokens cover scopes from prior grants
+   * in addition to the ones requested for this flow. Set to `false` when
+   * each OAuth flow should request only its own scopes.
+   *
+   * Defaults to `true`.
+   *
+   * @see https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth
+   */
+  includeGrantedScopes?: boolean | undefined;
 }
 //#endregion
 //#region ../core/dist/social-providers/huggingface.d.mts
@@ -1539,8 +1802,8 @@ interface LinkedInProfile {
     country: string;
     language: string;
   };
-  email: string;
-  email_verified: boolean;
+  email?: string;
+  email_verified?: boolean;
 }
 interface LinkedInOptions extends ProviderOptions<LinkedInProfile> {
   clientId: string;
@@ -1985,6 +2248,7 @@ interface PaybinOptions extends ProviderOptions<PaybinProfile> {
 //#region ../core/dist/social-providers/paypal.d.mts
 //#region src/social-providers/paypal.d.ts
 interface PayPalProfile {
+  sub?: string | undefined;
   user_id: string;
   name: string;
   given_name: string;
@@ -2141,7 +2405,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2149,6 +2414,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2160,9 +2427,16 @@ declare const socialProviders: {
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      issuer: string;
+      audience: string | string[];
+      maxTokenAge: string;
+      nonceComparison: "exact-or-sha256";
+    };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2190,7 +2464,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2198,6 +2473,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2211,6 +2488,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2238,7 +2516,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2246,6 +2525,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2258,8 +2539,14 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      issuer: string;
+      audience: string | string[];
+      maxTokenAge: string;
+    };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2286,7 +2573,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2294,7 +2582,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2306,6 +2596,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2333,7 +2624,8 @@ declare const socialProviders: {
       state,
       scopes,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2341,6 +2633,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2351,9 +2645,23 @@ declare const socialProviders: {
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: {
+        (protectedHeader?: jose.JWSHeaderParameters, token?: jose.FlattenedJWSInput): Promise<jose.CryptoKey>;
+        coolingDown: boolean;
+        fresh: boolean;
+        reloading: boolean;
+        reload: () => Promise<void>;
+        jwks: () => jose.JSONWebKeySet | undefined;
+      };
+      issuer: string;
+      audience: string | string[];
+      algorithms: string[];
+      allowOpaqueToken: true;
+    };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2381,7 +2689,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2389,6 +2698,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2402,6 +2713,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2430,7 +2742,8 @@ declare const socialProviders: {
       scopes,
       loginHint,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2438,6 +2751,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2451,6 +2766,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens | null>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2481,6 +2797,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode({
       code,
@@ -2492,8 +2810,15 @@ declare const socialProviders: {
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
     }): Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      audience: string | string[];
+      maxTokenAge: string;
+      issuer: string | undefined;
+      verifyClaims: (claims: Record<string, unknown>) => boolean;
+    };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2524,7 +2849,8 @@ declare const socialProviders: {
       codeVerifier,
       redirectURI,
       loginHint,
-      display
+      display,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2532,6 +2858,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2544,8 +2872,15 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      issuer: string[];
+      audience: string | string[];
+      maxTokenAge: string;
+      verifyClaims: ((claims: Record<string, unknown>) => boolean) | undefined;
+    };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2573,7 +2908,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2581,6 +2917,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2594,6 +2932,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2620,7 +2959,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2628,7 +2968,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2640,6 +2982,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2667,7 +3010,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2675,6 +3019,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2688,6 +3034,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2714,7 +3061,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2722,6 +3070,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2734,6 +3084,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2764,6 +3115,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2777,6 +3130,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2804,7 +3158,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2812,6 +3167,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2825,6 +3182,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2852,7 +3210,8 @@ declare const socialProviders: {
       state,
       scopes,
       redirectURI,
-      codeVerifier
+      codeVerifier,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2860,6 +3219,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode({
       code,
@@ -2873,6 +3234,7 @@ declare const socialProviders: {
     }): Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2900,7 +3262,8 @@ declare const socialProviders: {
       state,
       scopes,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2908,6 +3271,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2920,6 +3285,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2947,7 +3313,8 @@ declare const socialProviders: {
       state,
       scopes,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2955,6 +3322,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2967,6 +3336,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2995,7 +3365,8 @@ declare const socialProviders: {
       scopes,
       codeVerifier,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3003,6 +3374,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3016,6 +3389,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3063,7 +3437,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3071,6 +3446,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): URL;
     validateAuthorizationCode: ({
       code,
@@ -3083,6 +3460,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3109,7 +3487,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3117,6 +3496,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3129,6 +3510,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3155,7 +3537,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3163,7 +3546,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3175,6 +3560,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3202,7 +3588,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3210,6 +3597,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3223,6 +3612,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3250,7 +3640,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3258,6 +3649,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3272,6 +3665,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(data: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3298,7 +3692,8 @@ declare const socialProviders: {
     createAuthorizationURL: ({
       state,
       redirectURI,
-      codeVerifier
+      codeVerifier,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3306,6 +3701,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3319,6 +3716,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3345,7 +3743,8 @@ declare const socialProviders: {
       state,
       scopes,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3353,6 +3752,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3365,6 +3766,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3391,7 +3793,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3399,6 +3802,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3411,6 +3816,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3458,7 +3864,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3466,6 +3873,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3478,6 +3887,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3527,7 +3937,8 @@ declare const socialProviders: {
       scopes,
       codeVerifier,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3535,6 +3946,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3547,8 +3960,11 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      verify: (token: string, nonce: string | undefined) => Promise<boolean>;
+    };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3598,7 +4014,8 @@ declare const socialProviders: {
       scopes,
       codeVerifier,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3606,6 +4023,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3619,6 +4038,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3645,7 +4065,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3653,6 +4074,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3673,8 +4096,8 @@ declare const socialProviders: {
       refreshToken: any;
       accessTokenExpiresAt: Date | undefined;
     }>);
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3723,7 +4146,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3731,6 +4155,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3744,6 +4170,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3771,7 +4198,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3779,6 +4207,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3792,6 +4222,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3819,7 +4250,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3827,6 +4259,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3839,6 +4273,7 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3865,7 +4300,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3873,6 +4309,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): URL;
     validateAuthorizationCode: ({
       code
@@ -3898,6 +4336,7 @@ declare const socialProviders: {
       scopes: string[];
     }>);
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3948,14 +4387,14 @@ type BaseAccount = z.infer<typeof accountSchema>;
  */
 type Account<DBOptions extends BetterAuthOptions["account"] = BetterAuthOptions["account"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify$1<BaseAccount & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"account", Plugins>>; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
 type Prettify<T> = { [K in keyof T]: T[K] } & {};
 type IsEmptyObject<T> = keyof T extends never ? true : false;
 type UnionToIntersection<Union> = (Union extends unknown ? (distributedUnion: Union) => void : never) extends ((mergedIntersection: infer Intersection) => void) ? Intersection & Union : never;
 type InferParamPath<Path> = Path extends `${infer _Start}:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}:${infer Param}` ? { [K in Param]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamPath<Rest> : {};
 type InferParamWildCard<Path> = Path extends `${infer _Start}/*:${infer Param}/${infer Rest}` | `${infer _Start}/**:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}/*` ? { [K in "_"]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamWildCard<Rest> : {}; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
 //#region src/standard-schema.d.ts
 /** The Standard Schema interface. */
 interface StandardSchemaV1$1<Input = unknown, Output = Input> {
@@ -4013,7 +4452,7 @@ declare namespace StandardSchemaV1$1 {
   type InferOutput<Schema extends StandardSchemaV1$1> = NonNullable<Schema["~standard"]["types"]>["output"];
 } //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/error.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/error.d.mts
 declare const statusCodes: {
   OK: number;
   CREATED: number;
@@ -4091,7 +4530,7 @@ declare const APIError: new (status?: Status | "OK" | "CREATED" | "ACCEPTED" | "
   errorStack: string | undefined;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
 //#region src/cookies.d.ts
 type CookiePrefixOptions = "host" | "secure";
 type CookieOptions = {
@@ -4181,7 +4620,7 @@ type CookieOptions = {
   prefix?: CookiePrefixOptions;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
 //#region src/openapi.d.ts
 type OpenAPISchemaType = "string" | "number" | "integer" | "boolean" | "array" | "object";
 interface OpenAPIParameter {
@@ -4203,7 +4642,7 @@ interface OpenAPIParameter {
   };
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
 //#region src/endpoint.d.ts
 interface EndpointBaseOptions {
   /**
@@ -4524,6 +4963,22 @@ type EndpointContext<Path extends string, Options extends EndpointOptions, Conte
    * @returns - The cookie string
    */
   setSignedCookie: (key: string, value: string, secret: string, options?: CookieOptions) => Promise<string>;
+  /**
+   * Response headers
+   *
+   * The live `Headers` for the response being built in the current
+   * request. Read it to inspect what has already been queued, e.g. to
+   * avoid emitting a `Set-Cookie` twice or to check headers set by an
+   * earlier handler in the chain.
+   *
+   * @example
+   * ```ts
+   * const alreadySet = ctx.responseHeaders
+   *   .getSetCookie()
+   *   .some((c) => c.startsWith("session="));
+   * ```
+   */
+  responseHeaders: Headers;
   /**
    * JSON
    *
@@ -4566,7 +5021,7 @@ type Endpoint<Path extends string = string, Options extends EndpointOptions = En
   path: Path;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
 //#region src/middleware.d.ts
 interface MiddlewareOptions extends Omit<EndpointOptions, "method"> {}
 type MiddlewareContext<Options extends MiddlewareOptions, Context = {}> = EndpointContext<string, Options & {
@@ -4673,7 +5128,7 @@ type Middleware<Options extends MiddlewareOptions = MiddlewareOptions, Handler e
   options: Options;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/context.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.7_zod@4.3.6/node_modules/better-call/dist/context.d.mts
 //#region src/context.d.ts
 type HTTPMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
 type Method = HTTPMethod | "*";
@@ -4813,7 +5268,13 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
     user: User;
     account: Account;
   }>;
-  createUser<T extends Record<string, any>>(user: Omit<User, "id" | "createdAt" | "updatedAt" | "emailVerified"> & Partial<User> & Record<string, any>): Promise<T & User>;
+  createUser<T extends Record<string, any>>(user: Omit<User, "id" | "createdAt" | "updatedAt" | "emailVerified"> & Partial<User> & Record<string, any>,
+  /**
+   * Provisioning source. The creation seam adds `action: "create-user"` and
+   * runs the `user.validateUserInfo` gate.
+   */
+
+  source: UserProvisioningSource): Promise<T & User>;
   createAccount<T extends Record<string, any>>(account: Omit<Account, "id" | "createdAt" | "updatedAt"> & Partial<Account> & T): Promise<T & Account>;
   listSessions(userId: string, options?: {
     onlyActiveSessions?: boolean | undefined;
@@ -4838,8 +5299,20 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
   updateSession(sessionToken: string, session: Partial<Session> & Record<string, any>): Promise<Session | null>;
   deleteSession(token: string): Promise<void>;
   deleteAccounts(userId: string): Promise<void>;
-  deleteAccount(accountId: string): Promise<void>;
-  deleteSessions(userIdOrSessionTokens: string | string[]): Promise<void>;
+  /**
+   * Delete an account by its primary key.
+   *
+   * @param id - The account row's primary key (the `id` column, not the `accountId` column).
+   */
+  deleteAccount(id: string): Promise<void>;
+  /**
+   * Delete every session belonging to a user.
+   */
+  deleteUserSessions(userId: string): Promise<void>;
+  /**
+   * Delete sessions by their session tokens.
+   */
+  deleteSessions(sessionTokens: string[]): Promise<void>;
   findOAuthUser(email: string, accountId: string, providerId: string): Promise<{
     user: User;
     linkedAccount: Account | null;
@@ -4857,14 +5330,45 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
   updateUserByEmail<T extends Record<string, any>>(email: string, data: Partial<User & Record<string, any>>): Promise<User & T>;
   updatePassword(userId: string, password: string): Promise<void>;
   findAccounts(userId: string): Promise<Account[]>;
-  findAccount(accountId: string): Promise<Account | null>;
   findAccountByProviderId(accountId: string, providerId: string): Promise<Account | null>;
   findAccountByUserId(userId: string): Promise<Account[]>;
   updateAccount(id: string, data: Partial<Account>): Promise<Account>;
   createVerificationValue(data: Omit<Verification, "createdAt" | "id" | "updatedAt"> & Partial<Verification>): Promise<Verification>;
   findVerificationValue(identifier: string): Promise<Verification | null>;
   deleteVerificationByIdentifier(identifier: string): Promise<void>;
+  /**
+   * Atomically consume a single-use verification row by `identifier` and
+   * return it. Only the first concurrent caller receives the latest row;
+   * subsequent callers receive `null`. Consuming one row invalidates the
+   * whole identifier so stale rows cannot be replayed. Rows past their
+   * `expiresAt` are treated as already invalid: the row is deleted but
+   * `null` is returned, so callers do not need to gate on `expiresAt`
+   * themselves. Callers MUST gate any state change (issue session, mint
+   * token, change password) on a non-null result.
+   *
+   * Replaces the racy `findVerificationValue` + `deleteVerificationByIdentifier`
+   * pair at single-use credential consumption sites.
+   */
+  consumeVerificationValue(identifier: string): Promise<Verification | null>;
+  /**
+   * First-writer-wins create keyed by a deterministic primary key derived from
+   * `identifier`. Returns `true` when this caller created the row and `false`
+   * when a row for the same identifier already existed.
+   *
+   * The dual of `consumeVerificationValue`: reserve races to create a marker
+   * exactly once, where consume races to delete one exactly once. Use it for
+   * replay tombstones (a SAML assertion id, a JWT `jti`) where the first caller
+   * wins. The database path is atomic via the primary key. Secondary-storage-only
+   * verification is not supported for reservation and runtime implementations
+   * should fail closed unless verification is backed by the database.
+   */
+  reserveVerificationValue(data: {
+    identifier: string;
+    value: string;
+    expiresAt: Date;
+  }): Promise<boolean>;
   updateVerificationByIdentifier(identifier: string, data: Partial<Verification>): Promise<Verification>;
+  refreshUserSessions(user: User): Promise<void>;
 }
 type CreateCookieGetterFn = (cookieName: string, overrideAttributes?: Partial<CookieOptions> | undefined) => BetterAuthCookie;
 type CheckPasswordFn<Options extends BetterAuthOptions = BetterAuthOptions> = (userId: string, ctx: GenericEndpointContext<Options>) => Promise<boolean>;
@@ -4920,7 +5424,7 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
      * - "cookie": Store state in an encrypted cookie (stateless)
      * - "database": Store state in the database
      *
-     * @default "cookie"
+     * @default "database" when `database` or `secondaryStorage` is configured, "cookie" otherwise
      */
     storeStateStrategy: "database" | "cookie";
   };
@@ -5303,6 +5807,73 @@ type GenerateIdFn = (options: {
   model: ModelNames;
   size?: number | undefined;
 }) => string | false;
+/**
+ * What Better Auth is about to do with an incoming identity when
+ * {@link BetterAuthOptions.user}'s `validateUserInfo` runs.
+ *
+ * - `create-user`: a brand-new user record is about to be created.
+ * - `link-account`: a new provider account is about to be linked to an
+ *   already-existing user.
+ * - `sign-in`: an existing OAuth or SSO user is signing in again. This is the
+ *   one case where the provider can assert *changed* data, so the hook receives
+ *   the fresh provider email and profile (not the stored row), letting a domain
+ *   or org policy reject a user whose provider identity moved out of bounds.
+ *
+ * Non-provider returning sign-ins are not re-validated: they carry only the
+ * stored row, which has not changed since `create-user` gated it. Use the admin
+ * plugin's ban controls or a `databaseHooks.session.create.before` hook to
+ * block those.
+ */
+type ValidateUserInfoAction = "create-user" | "link-account" | "sign-in";
+/**
+ * The authentication method that produced the incoming user info. The named
+ * methods cover Better Auth's built-ins; the open `string` keeps it extensible
+ * for plugins (for example `"scim"`).
+ */
+type ValidateUserInfoMethod = "oauth" | "sso-oidc" | "sso-saml" | "email-password" | "magic-link" | "email-otp" | "anonymous" | "siwe" | "phone-number" | "admin" | (string & {});
+/** OAuth-specific provisioning context; present only when `method` is `"oauth"`. */
+type ValidateUserInfoOAuthInfo = {
+  /** The social or generic OAuth provider id (e.g. `"google"`). */providerId: string; /** The raw provider profile (userinfo or id-token claims), unmapped. */
+  profile?: Record<string, unknown> | undefined;
+};
+/** SSO-specific provisioning context; present for OIDC and SAML SSO methods. */
+type ValidateUserInfoSSOInfo = {
+  /** The configured SSO provider id. */providerId: string; /** The raw OIDC claims or SAML assertion attributes, unmapped. */
+  profile?: Record<string, unknown> | undefined;
+};
+/** Provisioning origin passed to `createUser`; the creation seam adds `action: "create-user"` to build {@link ValidateUserInfoSource}. */
+type UserProvisioningSource = {
+  method: ValidateUserInfoMethod; /** Provider id and raw profile; present iff `method` is `"oauth"`. */
+  oauth?: ValidateUserInfoOAuthInfo | undefined; /** Provider id and raw profile; present iff `method` is `"sso-oidc"` or `"sso-saml"`. */
+  sso?: ValidateUserInfoSSOInfo | undefined;
+};
+/**
+ * The context passed to `validateUserInfo`: the lifecycle
+ * {@link ValidateUserInfoAction}, the {@link ValidateUserInfoMethod}, and (for
+ * OAuth/SSO provider methods) protocol-specific provider metadata.
+ *
+ * ```ts
+ * // Scope to one OAuth provider:
+ * if (source.oauth?.providerId !== "google") return;
+ * // Branch on the method:
+ * if (source.method === "anonymous") return { error: "no_anonymous" };
+ * // Inspect SSO claims:
+ * if (source.method === "sso-saml" && source.sso?.profile?.department !== "eng") {
+ *   return { error: "invalid_department" };
+ * }
+ * ```
+ */
+type ValidateUserInfoSource = UserProvisioningSource & {
+  action: ValidateUserInfoAction;
+};
+type ValidateUserInfoResult = {
+  /** A short, machine-readable rejection code, surfaced to the client. */error: string;
+  /**
+   * A human-readable reason, surfaced to the client. Do not put sensitive
+   * details here.
+   */
+  errorDescription?: string | undefined;
+};
 /**
  * Configuration for dynamic base URL resolution.
  * Allows Better Auth to work with multiple domains (e.g., Vercel preview deployments).
@@ -5347,8 +5918,30 @@ type DynamicBaseURLConfig = {
  */
 type BaseURLConfig = string | DynamicBaseURLConfig;
 interface BetterAuthRateLimitStorage {
-  get: (key: string) => Promise<RateLimit | null | undefined>;
-  set: (key: string, value: RateLimit, update?: boolean | undefined) => Promise<void>;
+  /**
+   * Atomically records one request against `key` within the rolling `window`
+   * (in seconds) and reports whether it is allowed.
+   *
+   * When `allowed` is true the count was incremented within the active window,
+   * or the window had elapsed and was reset to start at 1. When `allowed` is
+   * false the limit was already reached and `retryAfter` is the number of
+   * seconds until the window frees up.
+   *
+   * Performing the check and the increment in a single step closes the
+   * concurrent-bypass gap of the separate `get`/`set` path: N simultaneous
+   * requests can no longer all pass a stale read before any increment lands.
+   *
+   * Custom storages must implement this operation directly. Better Auth no
+   * longer accepts separate `get`/`set` rate-limit storage because that shape
+   * cannot enforce a distributed limit under concurrent requests.
+   */
+  consume: (key: string, rule: {
+    window: number;
+    max: number;
+  }) => Promise<{
+    allowed: boolean;
+    retryAfter: number | null;
+  }>;
 }
 type BetterAuthRateLimitRule = {
   /**
@@ -5423,7 +6016,7 @@ type BetterAuthAdvancedOptions = {
      * @example ["x-client-ip", "x-forwarded-for", "cf-connecting-ip"]
      *
      * @default
-     * @link https://github.com/better-auth/better-auth/blob/main/packages/better-auth/src/utils/get-request-ip.ts#L8
+     * @link https://github.com/better-auth/better-auth/blob/main/packages/core/src/utils/ip.ts
      */
     ipAddressHeaders?: string[];
     /**
@@ -5433,12 +6026,28 @@ type BetterAuthAdvancedOptions = {
      */
     disableIpTracking?: boolean;
     /**
-     * IPv6 subnet prefix length for rate limiting.
-     * IPv6 addresses will be normalized to this subnet.
+     * IPv6 prefix length used to collapse addresses before rate-limit keying.
+     * Any integer from 0 to 128 is accepted; common values are 32, 48, 56, 64, 128.
+     * Out-of-range values fall back to safe behavior (negative -> mask all, > 128 -> no mask).
      *
      * @default 64
      */
-    ipv6Subnet?: 128 | 64 | 48 | 32;
+    ipv6Subnet?: number;
+    /**
+     * Trusted reverse-proxy IPs or CIDR ranges. When set, a forwarded IP
+     * chain is walked right to left, trusted hops are skipped, and the
+     * first untrusted address is the client IP. Unset trusts only
+     * single-value IP headers. Use the actual address or subnet of your
+     * proxies, not a broad private range that also covers clients.
+     *
+     * This only interprets the forwarded header chain and cannot verify
+     * the direct sender. It is safe only when your origin is reachable
+     * through these proxies and clients cannot set forwarded headers
+     * directly.
+     *
+     * @example ["192.0.2.10", "10.0.0.0/24"]
+     */
+    trustedProxies?: string[];
   } | undefined;
   /**
    * Force cookies to always use the `Secure` attribute. By default,
@@ -5964,6 +6573,30 @@ type BetterAuthOptions = {
    * User configuration
    */
   user?: (BetterAuthDBOptions<"user", keyof BaseUser> & {
+    /**
+     * Gate which identities Better Auth admits. Called just before
+     * `create-user`, `link-account`, and (for OAuth) `sign-in`, across
+     * every authentication method, including stateless setups with no
+     * persistent database. On `sign-in` the hook receives the *fresh*
+     * provider email and profile, so a domain policy can reject a user
+     * whose provider identity moved out of bounds.
+     *
+     * Non-provider returning sign-ins are not re-validated; use the admin
+     * plugin's ban controls or a `databaseHooks.session.create.before`
+     * hook for those.
+     *
+     * Return nothing to allow; return `{ error }` to reject. Browser flows
+     * redirect to the configured error URL; programmatic flows surface a
+     * `403`.
+     *
+     * TODO: rename to `validateUser` (and the `ValidateUserInfo*` types).
+     * "UserInfo" is the OIDC term and misleads for the email/password,
+     * SIWE, phone, and admin methods.
+     */
+    validateUserInfo?: (data: {
+      user: Partial<User> & Record<string, unknown>;
+      source: ValidateUserInfoSource;
+    }, context: GenericEndpointContext) => Awaitable<void | ValidateUserInfoResult>;
     /**
      * Changing email configuration
      */
@@ -6105,6 +6738,20 @@ type BetterAuthOptions = {
        * @default "compact"
        */
       strategy?: "compact" | "jwt" | "jwe";
+      /**
+       * JWT-specific configuration for `strategy: "jwt"`.
+       */
+      jwt?: {
+        /**
+         * Which signing key is used for cookie-cache JWTs.
+         *
+         * - `"secret"`: uses the Better Auth secret with HS256.
+         * - `"jwt-plugin"`: uses the installed `jwt()` plugin's asymmetric signing keys.
+         *
+         * @default "secret"
+         */
+        signingKey?: "secret" | "jwt-plugin";
+      };
       /**
        * Controls stateless cookie cache refresh behavior.
        *
@@ -6187,6 +6834,25 @@ type BetterAuthOptions = {
        * @default false
        */
       disableImplicitLinking?: boolean;
+      /**
+       * Require the existing local user row to have
+       * `emailVerified: true` before implicit account linking
+       * uses the IdP's `email_verified` claim as ownership
+       * proof. Defaults to `true` so an attacker who
+       * pre-registers an unverified account at a victim's
+       * email cannot have the victim's OAuth identity linked
+       * into the attacker-owned row on first sign-in. Set to
+       * `false` for backward compatibility on apps whose
+       * users sign up via OAuth without verifying their email
+       * locally; understand the takeover risk before doing
+       * so.
+       *
+       * @default true
+       *
+       * @deprecated The option will be removed on the next
+       * minor; the gate will become unconditional.
+       */
+      requireLocalEmailVerified?: boolean;
       /**
        * List of trusted providers. Can be a static array or a function
        * that returns providers dynamically. The function is called
@@ -6224,7 +6890,11 @@ type BetterAuthOptions = {
        */
       allowUnlinkingAll?: boolean;
       /**
-       * If enabled (true), this will update the user information based on the newly linked account
+       * When enabled, linking an account copies the provider's profile onto
+       * the local user, matching the fields persisted on sign-up (`name`,
+       * `image`, and any `mapProfileToUser` fields). The local `email` and
+       * `emailVerified` are never changed, so a link cannot rebind the
+       * account's identity.
        *
        * @default false
        */
@@ -6257,13 +6927,17 @@ type BetterAuthOptions = {
      * - "cookie": Store state in an encrypted cookie (stateless)
      * - "database": Store state in the database
      *
-     * @default "cookie"
+     * @default "database" when `database` or `secondaryStorage` is configured, "cookie" otherwise
      */
     storeStateStrategy?: "database" | "cookie";
     /**
-     * Store account data after oauth flow on a cookie
+     * Store provider account data after an OAuth flow in an encrypted
+     * cookie. This includes OAuth token material such as access tokens,
+     * refresh tokens, ID tokens, scopes, and token expiry.
      *
-     * This is useful for database-less flow
+     * This is useful for database-less flows, but large provider tokens can
+     * still hit browser or proxy cookie/header limits even though Better Auth
+     * chunks oversized account cookies.
      *
      * @default false
      *
@@ -6766,6 +7440,23 @@ interface SecondaryStorage {
    * @returns - Value of the key
    */
   get: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically get a value and delete it from storage.
+   */
+  getAndDelete: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
+   *
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
+   *
+   * Required so secondary-storage-backed rate limiting can enforce the limit
+   * in one distributed-safe operation.
+   */
+  increment: (key: string, ttl: number) => Awaitable<number>;
   set: (
   /**
    * Key to store
@@ -7063,6 +7754,7 @@ declare const requestAuthOptionsSchema: z.ZodObject<{
   disableRedirect: z.ZodOptional<z.ZodBoolean>;
   scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
+  additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
   additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, z.core.$strip>;
 type ElectronRequestAuthOptions = z.infer<typeof requestAuthOptionsSchema>;