@better-auth/electron 1.7.0-beta.2 → 1.7.0-beta.4

package/dist/{client-D6xRwPM0.d.mts → client-DIzl-aw0.d.mts}

@@ -248,6 +248,7 @@ declare const requestAuthOptionsSchema: z.ZodObject<{
   disableRedirect: z.ZodOptional<z.ZodBoolean>;
   scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
+  additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
   additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, z.core.$strip>;
 type ElectronRequestAuthOptions = z.infer<typeof requestAuthOptionsSchema>;

package/dist/client.d.mts

@@ -1,2 +1,2 @@
-import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { _ as setupRenderer, a as authenticate, c as ElectronClientOptions, d as Storage, f as FetchUserImageResult, g as SetupRendererConfig, h as ExposedBridges, i as ElectronRequestAuthOptions, l as ElectronProxyClientOptions, m as normalizeUserOutput, n as handleDeepLink, o as kElectron, p as fetchUserImage, r as ElectronAuthenticateOptions, s as requestAuth, t as electronClient, u as ElectronSharedClientOptions, y as ElectronSharedOptions } from "./client-DIzl-aw0.mjs";
 export { ElectronAuthenticateOptions, ElectronClientOptions, ElectronProxyClientOptions, ElectronRequestAuthOptions, ElectronSharedClientOptions, ElectronSharedOptions, ExposedBridges, FetchUserImageResult, SetupRendererConfig, Storage, authenticate, electronClient, fetchUserImage, handleDeepLink, kElectron, normalizeUserOutput, requestAuth, setupRenderer };

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BVHIqaH7.mjs";
+import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
@@ -8,7 +8,7 @@ import * as z from "zod";
 import { Buffer } from "node:buffer";
 import { createHash } from "@better-auth/utils/hash";
 import { signInSocial } from "better-auth/api";
-import { parseSetCookieHeader } from "better-auth/cookies";
+import { cookieNameRegex, parseSetCookieHeader } from "better-auth/cookies";
 import electron, { shell } from "electron";
 import { isDevelopment as isDevelopment$1 } from "@better-auth/core/env";
 import { isPublicRoutableHost } from "@better-auth/core/utils/host";
@@ -474,10 +474,13 @@ function getCookie(cookie) {
 	try {
 		parsed = JSON.parse(cookie);
 	} catch (_e) {}
-	return Object.entries(parsed).reduce((acc, [key, value]) => {
-		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) return acc;
-		return `${acc}; ${key}=${value.value}`;
-	}, "");
+	const pairs = [];
+	for (const [key, value] of Object.entries(parsed)) {
+		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) continue;
+		if (!cookieNameRegex.test(key)) continue;
+		pairs.push(`${key}=${encodeURIComponent(value.value)}`);
+	}
+	return pairs.join("; ");
 }
 /**
 * Compare if session cookies have actually changed by comparing their values.

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-D6xRwPM0.mjs";
+import { f as FetchUserImageResult, m as normalizeUserOutput, p as fetchUserImage, v as ElectronOptions, y as ElectronSharedOptions } from "./client-DIzl-aw0.mjs";
 import * as better_auth0 from "better-auth";
 import * as z from "zod";
 import * as _better_auth_core0 from "@better-auth/core";

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BVHIqaH7.mjs";
+import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";

package/dist/preload.d.mts

@@ -30,6 +30,7 @@ type DBAdapterDebugLogOption = boolean | {
   findMany?: boolean | undefined;
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
+  consumeOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -205,7 +206,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "count";
     /**
      * The model name.
      */
@@ -423,6 +424,26 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     model: string;
     where: Where[];
   }) => Promise<number>;
+  /**
+   * Atomically consume a single row matching the where clause: delete it and
+   * return the deleted row, or return `null` if no row matched.
+   * Implementations MUST NOT delete any additional rows that also match a
+   * non-unique predicate.
+   *
+   * Under concurrent invocation against the same row, exactly one caller
+   * receives the row; subsequent racers receive `null`. This is the
+   * race-safe primitive for consuming single-use credentials
+   * (verification tokens, authorization codes, one-time tokens).
+   *
+   * Always defined on the factory-wrapped adapter. When the underlying
+   * `CustomAdapter` does not implement `consumeOne`, the factory provides
+   * a fallback that wraps `findMany + deleteMany` in `transaction(...)`
+   * and returns the row only when the delete reports an affected row.
+   */
+  consumeOne: <T>(data: {
+    model: string;
+    where: Where[];
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -504,6 +525,19 @@ interface CustomAdapter {
     model: string;
     where: CleanedWhere[];
   }) => Promise<number>;
+  /**
+   * Optional native atomic single-row consume. When omitted, the adapter
+   * factory falls back to `transaction(findMany + deleteMany)`.
+   * Implementing this method natively (e.g. `DELETE ... RETURNING *`,
+   * `findOneAndDelete`, `OUTPUT deleted.*`) gives one round trip and the
+   * strongest race-safety guarantee. Implementations must delete at most
+   * one matching row. TODO(consume-one-required): tighten to required in the
+   * next minor on `next`.
+   */
+  consumeOne?: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<T | null>;
   count: ({
     model,
     where
@@ -640,6 +674,13 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    /**
+     * Extra query parameters to append to the authorization URL.
+     * Providers forward these to the shared `createAuthorizationURL` helper,
+     * which drops any keys present in `RESERVED_AUTHORIZATION_PARAMS`
+     * before applying them.
+     */
+    additionalParams?: Record<string, string> | undefined;
   }) => Awaitable<URL>;
   name: string;
   validateAuthorizationCode: (data: {
@@ -691,6 +732,17 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    * Disable sign up for new users.
    */
   disableSignUp?: boolean | undefined;
+  /**
+   * Accept callbacks that arrive without a `state` parameter. When true,
+   * the shared OAuth callback handler restarts the flow server-side with
+   * fresh `state` and PKCE instead of rejecting the request. Intended for
+   * providers that initiate OAuth without RP-side flow kickoff (e.g.
+   * Clever). Leave unset for any provider that always initiates from the
+   * RP.
+   *
+   * @default false
+   */
+  allowIdpInitiated?: boolean | undefined;
   /**
    * Options for the provider
    */
@@ -700,9 +752,10 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
   /**
    * The client ID of your application.
    *
-   * This is usually a string but can be any type depending on the provider.
+   * Some providers accept multiple platform client IDs. The first entry is the
+   * primary client ID used for token endpoint client authentication.
    */
-  clientId?: unknown | undefined;
+  clientId?: LiteralString | string[] | undefined;
   /**
    * The client secret of your application
    */
@@ -819,7 +872,7 @@ interface AppleProfile {
    * The email address is either the user's real email address or the proxy
    * address, depending on their status private email relay service.
    */
-  email: string;
+  email?: string;
   /**
    * A string or Boolean value that indicates whether the service verifies
    * the email. The value can either be a string ("true" or "false") or a
@@ -925,6 +978,19 @@ interface CognitoOptions extends ProviderOptions<CognitoProfile> {
   region: string;
   userPoolId: string;
   requireClientSecret?: boolean | undefined;
+  /**
+   * Skip the Cognito hosted-UI identity-provider picker by preselecting an
+   * IdP (maps to the `identity_provider` query parameter on the authorize
+   * request). Accepts `"COGNITO"`, a SAML/OIDC provider name configured on
+   * the User Pool, or one of the social providers (`"Google"`, `"Facebook"`,
+   * `"LoginWithAmazon"`, `"SignInWithApple"`).
+   *
+   * Per-request overrides via `signIn.social({ additionalParams: { identity_provider } })`
+   * take precedence over this value.
+   *
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
+   */
+  identityProvider?: string | undefined;
 }
 //#endregion
 //#region ../core/dist/social-providers/discord.d.mts
@@ -967,7 +1033,7 @@ interface DiscordProfile extends Record<string, any> {
   /** whether the email on this account has been verified */
   verified: boolean;
   /** the user's email */
-  email: string;
+  email?: string | null;
   /**
    * the flags on a user's account:
    * https://discord.com/developers/docs/resources/user#user-object-user-flags
@@ -1009,8 +1075,8 @@ interface DiscordOptions extends ProviderOptions<DiscordProfile> {
 interface FacebookProfile {
   id: string;
   name: string;
-  email: string;
-  email_verified: boolean;
+  email?: string;
+  email_verified?: boolean;
   picture: {
     data: {
       height: number;
@@ -1071,7 +1137,7 @@ interface GithubProfile {
   company: string;
   blog: string;
   location: string;
-  email: string;
+  email: string | null;
   hireable: boolean;
   bio: string;
   twitter_username: string;
@@ -1125,7 +1191,7 @@ interface MicrosoftEntraIDProfile extends Record<string, any> {
   /** The primary username that represents the user */
   preferred_username: string;
   /** User's email address */
-  email: string;
+  email?: string;
   /** Human-readable value that identifies the subject of the token */
   name: string;
   /** Matches the parameter included in the original authorize request */
@@ -1539,8 +1605,8 @@ interface LinkedInProfile {
     country: string;
     language: string;
   };
-  email: string;
-  email_verified: boolean;
+  email?: string;
+  email_verified?: boolean;
 }
 interface LinkedInOptions extends ProviderOptions<LinkedInProfile> {
   clientId: string;
@@ -2141,7 +2207,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2149,6 +2216,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2190,7 +2258,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2198,6 +2267,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2238,7 +2308,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2246,6 +2317,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2286,7 +2358,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2294,7 +2367,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2333,7 +2407,8 @@ declare const socialProviders: {
       state,
       scopes,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2341,6 +2416,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2381,7 +2457,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2389,6 +2466,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2430,7 +2508,8 @@ declare const socialProviders: {
       scopes,
       loginHint,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2438,6 +2517,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2481,6 +2561,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode({
       code,
@@ -2524,7 +2605,8 @@ declare const socialProviders: {
       codeVerifier,
       redirectURI,
       loginHint,
-      display
+      display,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2532,6 +2614,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2573,7 +2656,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2581,6 +2665,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2620,7 +2705,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2628,7 +2714,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2667,7 +2754,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2675,6 +2763,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2714,7 +2803,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2722,6 +2812,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2764,6 +2855,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2804,7 +2896,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2812,6 +2905,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2852,7 +2946,8 @@ declare const socialProviders: {
       state,
       scopes,
       redirectURI,
-      codeVerifier
+      codeVerifier,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2860,6 +2955,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode({
       code,
@@ -2900,7 +2996,8 @@ declare const socialProviders: {
       state,
       scopes,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2908,6 +3005,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2947,7 +3045,8 @@ declare const socialProviders: {
       state,
       scopes,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2955,6 +3054,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -2995,7 +3095,8 @@ declare const socialProviders: {
       scopes,
       codeVerifier,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3003,6 +3104,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3063,7 +3165,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3071,6 +3174,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): URL;
     validateAuthorizationCode: ({
       code,
@@ -3109,7 +3213,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3117,6 +3222,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3155,7 +3261,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3163,7 +3270,8 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3202,7 +3310,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3210,6 +3319,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3250,7 +3360,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3258,6 +3369,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3298,7 +3410,8 @@ declare const socialProviders: {
     createAuthorizationURL: ({
       state,
       redirectURI,
-      codeVerifier
+      codeVerifier,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3306,6 +3419,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3345,7 +3459,8 @@ declare const socialProviders: {
       state,
       scopes,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3353,6 +3468,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3391,7 +3507,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3399,6 +3516,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3458,7 +3576,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3466,6 +3585,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3527,7 +3647,8 @@ declare const socialProviders: {
       scopes,
       codeVerifier,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3535,6 +3656,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3598,7 +3720,8 @@ declare const socialProviders: {
       scopes,
       codeVerifier,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3606,6 +3729,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3645,7 +3769,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3653,6 +3778,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3723,7 +3849,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3731,6 +3858,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3771,7 +3899,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3779,6 +3908,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3819,7 +3949,8 @@ declare const socialProviders: {
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3827,6 +3958,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
@@ -3865,7 +3997,8 @@ declare const socialProviders: {
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3873,6 +4006,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      additionalParams?: Record<string, string> | undefined;
     }): URL;
     validateAuthorizationCode: ({
       code
@@ -4838,8 +4972,20 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
   updateSession(sessionToken: string, session: Partial<Session> & Record<string, any>): Promise<Session | null>;
   deleteSession(token: string): Promise<void>;
   deleteAccounts(userId: string): Promise<void>;
-  deleteAccount(accountId: string): Promise<void>;
-  deleteSessions(userIdOrSessionTokens: string | string[]): Promise<void>;
+  /**
+   * Delete an account by its primary key.
+   *
+   * @param id - The account row's primary key (the `id` column, not the `accountId` column).
+   */
+  deleteAccount(id: string): Promise<void>;
+  /**
+   * Delete every session belonging to a user.
+   */
+  deleteUserSessions(userId: string): Promise<void>;
+  /**
+   * Delete sessions by their session tokens.
+   */
+  deleteSessions(sessionTokens: string[]): Promise<void>;
   findOAuthUser(email: string, accountId: string, providerId: string): Promise<{
     user: User;
     linkedAccount: Account | null;
@@ -4857,14 +5003,28 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
   updateUserByEmail<T extends Record<string, any>>(email: string, data: Partial<User & Record<string, any>>): Promise<User & T>;
   updatePassword(userId: string, password: string): Promise<void>;
   findAccounts(userId: string): Promise<Account[]>;
-  findAccount(accountId: string): Promise<Account | null>;
   findAccountByProviderId(accountId: string, providerId: string): Promise<Account | null>;
   findAccountByUserId(userId: string): Promise<Account[]>;
   updateAccount(id: string, data: Partial<Account>): Promise<Account>;
   createVerificationValue(data: Omit<Verification, "createdAt" | "id" | "updatedAt"> & Partial<Verification>): Promise<Verification>;
   findVerificationValue(identifier: string): Promise<Verification | null>;
   deleteVerificationByIdentifier(identifier: string): Promise<void>;
+  /**
+   * Atomically consume a single-use verification row by `identifier` and
+   * return it. Only the first concurrent caller receives the latest row;
+   * subsequent callers receive `null`. Consuming one row invalidates the
+   * whole identifier so stale rows cannot be replayed. Rows past their
+   * `expiresAt` are treated as already invalid: the row is deleted but
+   * `null` is returned, so callers do not need to gate on `expiresAt`
+   * themselves. Callers MUST gate any state change (issue session, mint
+   * token, change password) on a non-null result.
+   *
+   * Replaces the racy `findVerificationValue` + `deleteVerificationByIdentifier`
+   * pair at single-use credential consumption sites.
+   */
+  consumeVerificationValue(identifier: string): Promise<Verification | null>;
   updateVerificationByIdentifier(identifier: string, data: Partial<Verification>): Promise<Verification>;
+  refreshUserSessions(user: User): Promise<void>;
 }
 type CreateCookieGetterFn = (cookieName: string, overrideAttributes?: Partial<CookieOptions> | undefined) => BetterAuthCookie;
 type CheckPasswordFn<Options extends BetterAuthOptions = BetterAuthOptions> = (userId: string, ctx: GenericEndpointContext<Options>) => Promise<boolean>;
@@ -4920,7 +5080,7 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
      * - "cookie": Store state in an encrypted cookie (stateless)
      * - "database": Store state in the database
      *
-     * @default "cookie"
+     * @default "database" when `database` or `secondaryStorage` is configured, "cookie" otherwise
      */
     storeStateStrategy: "database" | "cookie";
   };
@@ -5433,12 +5593,13 @@ type BetterAuthAdvancedOptions = {
      */
     disableIpTracking?: boolean;
     /**
-     * IPv6 subnet prefix length for rate limiting.
-     * IPv6 addresses will be normalized to this subnet.
+     * IPv6 prefix length used to collapse addresses before rate-limit keying.
+     * Any integer from 0 to 128 is accepted; common values are 32, 48, 56, 64, 128.
+     * Out-of-range values fall back to safe behavior (negative -> mask all, > 128 -> no mask).
      *
      * @default 64
      */
-    ipv6Subnet?: 128 | 64 | 48 | 32;
+    ipv6Subnet?: number;
   } | undefined;
   /**
    * Force cookies to always use the `Secure` attribute. By default,
@@ -6187,6 +6348,25 @@ type BetterAuthOptions = {
        * @default false
        */
       disableImplicitLinking?: boolean;
+      /**
+       * Require the existing local user row to have
+       * `emailVerified: true` before implicit account linking
+       * uses the IdP's `email_verified` claim as ownership
+       * proof. Defaults to `true` so an attacker who
+       * pre-registers an unverified account at a victim's
+       * email cannot have the victim's OAuth identity linked
+       * into the attacker-owned row on first sign-in. Set to
+       * `false` for backward compatibility on apps whose
+       * users sign up via OAuth without verifying their email
+       * locally; understand the takeover risk before doing
+       * so.
+       *
+       * @default true
+       *
+       * @deprecated The option will be removed on the next
+       * minor; the gate will become unconditional.
+       */
+      requireLocalEmailVerified?: boolean;
       /**
        * List of trusted providers. Can be a static array or a function
        * that returns providers dynamically. The function is called
@@ -6224,7 +6404,11 @@ type BetterAuthOptions = {
        */
       allowUnlinkingAll?: boolean;
       /**
-       * If enabled (true), this will update the user information based on the newly linked account
+       * When enabled, linking an account copies the provider's profile onto
+       * the local user, matching the fields persisted on sign-up (`name`,
+       * `image`, and any `mapProfileToUser` fields). The local `email` and
+       * `emailVerified` are never changed, so a link cannot rebind the
+       * account's identity.
        *
        * @default false
        */
@@ -6257,7 +6441,7 @@ type BetterAuthOptions = {
      * - "cookie": Store state in an encrypted cookie (stateless)
      * - "database": Store state in the database
      *
-     * @default "cookie"
+     * @default "database" when `database` or `secondaryStorage` is configured, "cookie" otherwise
      */
     storeStateStrategy?: "database" | "cookie";
     /**
@@ -6766,6 +6950,18 @@ interface SecondaryStorage {
    * @returns - Value of the key
    */
   get: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically get a value and delete it from storage.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. Single-use credential consumers use it when
+   * present to avoid a read-then-delete race.
+   *
+   * TODO(secondary-storage-atomic-consume): make this required in the next
+   * breaking release, or require database-backed verification storage for
+   * security-sensitive consume paths.
+   */
+  getAndDelete?: (key: string) => Awaitable<unknown>;
   set: (
   /**
    * Key to store
@@ -7063,6 +7259,7 @@ declare const requestAuthOptionsSchema: z.ZodObject<{
   disableRedirect: z.ZodOptional<z.ZodBoolean>;
   scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
+  additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
   additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, z.core.$strip>;
 type ElectronRequestAuthOptions = z.infer<typeof requestAuthOptionsSchema>;

package/dist/proxy.d.mts

@@ -1,4 +1,4 @@
-import { l as ElectronProxyClientOptions } from "./client-D6xRwPM0.mjs";
+import { l as ElectronProxyClientOptions } from "./client-DIzl-aw0.mjs";
 import { electron } from "./index.mjs";
 
 //#region src/proxy.d.ts

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BVHIqaH7.mjs";
+import { t as PACKAGE_VERSION } from "./version-5EiO_U3Z.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/storage.d.mts

@@ -1,4 +1,4 @@
-import { d as Storage } from "./client-D6xRwPM0.mjs";
+import { d as Storage } from "./client-DIzl-aw0.mjs";
 import { Options } from "conf";
 
 //#region src/storage.d.ts

package/dist/{version-BVHIqaH7.mjs → version-5EiO_U3Z.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.2";
+const PACKAGE_VERSION = "1.7.0-beta.4";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.7.0-beta.2",
+  "version": "1.7.0-beta.4",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -80,17 +80,17 @@
     "better-sqlite3": "^12.6.2",
     "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.2",
-    "better-auth": "1.7.0-beta.2"
+    "@better-auth/core": "1.7.0-beta.4",
+    "better-auth": "1.7.0-beta.4"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.0",
+    "@better-auth/utils": "0.4.1",
     "@better-fetch/fetch": "1.1.21",
     "better-call": "1.3.5",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.7.0-beta.2",
-    "better-auth": "^1.7.0-beta.2"
+    "@better-auth/core": "^1.7.0-beta.4",
+    "better-auth": "^1.7.0-beta.4"
   },
   "peerDependenciesMeta": {
     "electron": {