@better-auth/electron 1.7.0-beta.3 → 1.7.0-beta.5

package/dist/preload.d.mts

@@ -1,5 +1,7 @@
 import electron from "electron";
 import * as z from "zod";
+import * as jose from "jose";
+import { JWTVerifyGetKey } from "jose";
 import { Database } from "bun:sqlite";
 import { DatabaseSync } from "node:sqlite";
 import { D1Database } from "@cloudflare/workers-types";
@@ -30,6 +32,7 @@ type DBAdapterDebugLogOption = boolean | {
   findMany?: boolean | undefined;
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
+  consumeOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -205,7 +208,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "count";
     /**
      * The model name.
      */
@@ -423,6 +426,26 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     model: string;
     where: Where[];
   }) => Promise<number>;
+  /**
+   * Atomically consume a single row matching the where clause: delete it and
+   * return the deleted row, or return `null` if no row matched.
+   * Implementations MUST NOT delete any additional rows that also match a
+   * non-unique predicate.
+   *
+   * Under concurrent invocation against the same row, exactly one caller
+   * receives the row; subsequent racers receive `null`. This is the
+   * race-safe primitive for consuming single-use credentials
+   * (verification tokens, authorization codes, one-time tokens).
+   *
+   * Always defined on the factory-wrapped adapter. When the underlying
+   * `CustomAdapter` does not implement `consumeOne`, the factory provides
+   * a fallback that wraps `findMany + deleteMany` in `transaction(...)`
+   * and returns the row only when the delete reports an affected row.
+   */
+  consumeOne: <T>(data: {
+    model: string;
+    where: Where[];
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -504,6 +527,19 @@ interface CustomAdapter {
     model: string;
     where: CleanedWhere[];
   }) => Promise<number>;
+  /**
+   * Optional native atomic single-row consume. When omitted, the adapter
+   * factory falls back to `transaction(findMany + deleteMany)`.
+   * Implementing this method natively (e.g. `DELETE ... RETURNING *`,
+   * `findOneAndDelete`, `OUTPUT deleted.*`) gives one round trip and the
+   * strongest race-safety guarantee. Implementations must delete at most
+   * one matching row. TODO(consume-one-required): tighten to required in the
+   * next minor on `next`.
+   */
+  consumeOne?: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<T | null>;
   count: ({
     model,
     where
@@ -610,6 +646,52 @@ declare const createLogger: (options?: Logger | undefined) => InternalLogger;
 //#endregion
 //#region ../core/dist/oauth2/oauth-provider.d.mts
 //#region src/oauth2/oauth-provider.d.ts
+/**
+ * id_token verification config for a social provider.
+ *
+ * Declares how a client-submitted id_token is verified. The shared verifier
+ * (`verifyProviderIdToken`) consumes this instead of each provider implementing its own
+ * boolean check, so verification is centralized and fail-closed: a provider without a config
+ * cannot accept a forged token by omission.
+ */
+type OAuthIdTokenConfig = {
+  /**
+   * JWKS resolver used to verify the JWS signature. Accepts a jose
+   * `createRemoteJWKSet` resolver or a key-resolving function
+   * `(protectedHeader) => key`.
+   */
+  jwks: JWTVerifyGetKey; /** Expected `iss`. Omit for providers whose issuer varies per tenant. */
+  issuer?: (string | string[]) | undefined; /** Expected `aud`, usually the client ID. */
+  audience: string | string[]; /** Permitted JWS algorithms. Defaults to the token's `alg` header. */
+  algorithms?: string[] | undefined; /** Maximum token age passed to jose (e.g. `"1h"`). */
+  maxTokenAge?: string | undefined;
+  /**
+   * How the `nonce` claim is compared to the expected nonce.
+   * - `"exact"` (default): strict equality.
+   * - `"exact-or-sha256"`: matches the raw nonce or its SHA-256 hex digest (Apple).
+   */
+  nonceComparison?: ("exact" | "exact-or-sha256") | undefined;
+  /**
+   * Accept non-JWS (opaque) tokens without signature verification. Identity is then
+   * resolved by getUserInfo from the access token via the provider userinfo endpoint,
+   * which validates it (e.g. Facebook Graph access tokens).
+   */
+  allowOpaqueToken?: boolean | undefined;
+  /**
+   * Provider-specific claim check applied after the signature, issuer,
+   * audience, max-age, and nonce checks pass. Return `false` to reject the
+   * token. Used to enforce constraints the standard checks cannot express,
+   * e.g. Google's hosted-domain (`hd`) restriction. Omitted by providers
+   * that have no extra claim requirement.
+   */
+  verifyClaims?: ((claims: Record<string, unknown>) => boolean) | undefined;
+} | {
+  /**
+   * Custom verifier for providers that cannot verify against a local JWKS, such as a
+   * remote verification endpoint (e.g. LINE).
+   */
+  verify: (token: string, nonce?: string) => Promise<boolean>;
+};
 interface OAuth2Tokens {
   tokenType?: string | undefined;
   accessToken?: string | undefined;
@@ -631,8 +713,58 @@ type OAuth2UserInfo = {
   image?: string | undefined;
   emailVerified: boolean;
 };
-interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
+/**
+ * The result of building a provider authorization URL.
+ *
+ * `requestedScopes` is the effective set of scopes encoded in the URL (the
+ * provider's built-in defaults + configured `options.scope` + per-request
+ * `scopes`, composed by `resolveRequestedScopes`). Callers persist it so the
+ * callback can fall back to the request when the provider omits `scope` from
+ * its token response (RFC 6749 §5.1).
+ */
+interface AuthorizationURLResult {
+  url: URL;
+  requestedScopes: string[];
+}
+/**
+ * How much an RP trusts a provider's echoed token-response `scope` when
+ * persisting `account.grantedScopes`.
+ *
+ * - `"full-grant"`: the echo is the user's complete current grant, so the seam
+ *   replaces the stored grant with it. This is the only path that may narrow
+ *   the grant. Declare it only for providers whose token response reports the
+ *   full combined grant, e.g. Google with `include_granted_scopes`.
+ * - `"projection"`: the echo is this request's subset, so the seam unions it
+ *   onto the stored grant. The safe default for every provider.
+ * - `"absent-echo"`: the provider omitted `scope`, so the grant equals what was
+ *   requested (RFC 6749 §5.1) and the seam unions the requested set. Resolved
+ *   at runtime by the persistence seam, never declared by a provider.
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc6749#section-5.1
+ */
+type GrantAuthority = "full-grant" | "projection" | "absent-echo";
+/**
+ * The authority a provider may declare for its own echoed scope. `"absent-echo"`
+ * is excluded because it is a runtime condition (an omitted echo), not a
+ * provider trait.
+ */
+type ProviderGrantAuthority = Exclude<GrantAuthority, "absent-echo">;
+interface UpstreamProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
   id: LiteralString;
+  /**
+   * The path the provider redirects back to, relative to the app base URL,
+   * e.g. `/callback/google`.
+   */
+  callbackPath: string;
+  /**
+   * How the persistence seam treats this provider's echoed token-response
+   * `scope`. Declare `"full-grant"` only when the echo is the user's complete
+   * current grant (e.g. Google with `include_granted_scopes`); otherwise the
+   * echo is unioned onto the stored grant.
+   *
+   * @default "projection"
+   */
+  grantAuthority?: ProviderGrantAuthority | undefined;
   createAuthorizationURL: (data: {
     state: string;
     codeVerifier: string;
@@ -640,7 +772,14 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
-  }) => Awaitable<URL>;
+    /**
+     * Extra query parameters to append to the authorization URL.
+     * Providers forward these to the shared `createAuthorizationURL` helper,
+     * which drops any keys present in `RESERVED_AUTHORIZATION_PARAMS`
+     * before applying them.
+     */
+    additionalParams?: Record<string, string> | undefined;
+  }) => Awaitable<AuthorizationURLResult>;
   name: string;
   validateAuthorizationCode: (data: {
     code: string;
@@ -668,14 +807,12 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    * Custom function to refresh a token
    */
   refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
-  revokeToken?: ((token: string) => Promise<void>) | undefined;
   /**
-   * Verify the id token
-   * @param token - The id token
-   * @param nonce - The nonce
-   * @returns True if the id token is valid, false otherwise
+   * Declarative id_token verification config consumed by the shared
+   * `verifyProviderIdToken` verifier. Providers set this instead of implementing a boolean
+   * verify method, which keeps verification centralized and fail-closed.
    */
-  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  idToken?: OAuthIdTokenConfig | undefined;
   /**
    * The expected issuer identifier for this provider (RFC 9207).
    * When set, the callback handler validates the `iss` query parameter
@@ -691,6 +828,17 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    * Disable sign up for new users.
    */
   disableSignUp?: boolean | undefined;
+  /**
+   * Accept callbacks that arrive without a `state` parameter. When true,
+   * the shared OAuth callback handler restarts the flow server-side with
+   * fresh `state` and PKCE instead of rejecting the request. Intended for
+   * providers that initiate OAuth without RP-side flow kickoff (e.g.
+   * Clever). Leave unset for any provider that always initiates from the
+   * RP.
+   *
+   * @default false
+   */
+  allowIdpInitiated?: boolean | undefined;
   /**
    * Options for the provider
    */
@@ -700,9 +848,10 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
   /**
    * The client ID of your application.
    *
-   * This is usually a string but can be any type depending on the provider.
+   * Some providers accept multiple platform client IDs. The first entry is the
+   * primary client ID used for token endpoint client authentication.
    */
-  clientId?: unknown | undefined;
+  clientId?: LiteralString | string[] | undefined;
   /**
    * The client secret of your application
    */
@@ -803,6 +952,29 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
    * @default false
    */
   overrideUserInfoOnSignIn?: boolean | undefined;
+  /**
+   * Require this provider's email to be verified before a session is created.
+   *
+   * When the provider reports the email as unverified, the user and account are
+   * still created/linked, but no session is issued: the OAuth callback redirects
+   * with `?error=email_not_verified` and id-token sign-in returns a `403`
+   * `EMAIL_NOT_VERIFIED`. A verification email is (re)sent per the
+   * `emailVerification` settings (`sendOnSignUp` / `sendOnSignIn`).
+   *
+   * The gate checks the local user's verification state, not the provider's
+   * claim on each request: a user already verified through another method (or a
+   * prior verified sign-in) keeps access even if the provider later reports the
+   * email as unverified.
+   *
+   * This is opt-in per provider and is independent of
+   * `emailAndPassword.requireEmailVerification`; enabling that does not gate
+   * social sign-in. Only enable it for providers that report a trustworthy
+   * `email_verified` signal: several providers always report the email as
+   * unverified, which would block every sign-in.
+   *
+   * @default false
+   */
+  requireEmailVerification?: boolean | undefined;
 }; //#endregion
 //#endregion
 //#region ../core/dist/social-providers/apple.d.mts
@@ -925,6 +1097,19 @@ interface CognitoOptions extends ProviderOptions<CognitoProfile> {
   region: string;
   userPoolId: string;
   requireClientSecret?: boolean | undefined;
+  /**
+   * Skip the Cognito hosted-UI identity-provider picker by preselecting an
+   * IdP (maps to the `identity_provider` query parameter on the authorize
+   * request). Accepts `"COGNITO"`, a SAML/OIDC provider name configured on
+   * the User Pool, or one of the social providers (`"Google"`, `"Facebook"`,
+   * `"LoginWithAmazon"`, `"SignInWithApple"`).
+   *
+   * Per-request overrides via `signIn.social({ additionalParams: { identity_provider } })`
+   * take precedence over this value.
+   *
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
+   */
+  identityProvider?: string | undefined;
 }
 //#endregion
 //#region ../core/dist/social-providers/discord.d.mts
@@ -1098,6 +1283,15 @@ interface GithubOptions extends ProviderOptions<GithubProfile> {
   clientId: string;
 }
 //#endregion
+//#region ../core/dist/oauth2/client-assertion.d.mts
+type ClientAssertionGrantType = "authorization_code" | "refresh_token" | "client_credentials";
+interface ClientAssertionContext {
+  clientId: string;
+  tokenEndpoint: string;
+  grantType: ClientAssertionGrantType;
+}
+type ClientAssertionGetter = (context: ClientAssertionContext) => Awaitable<string>;
+//#endregion
 //#region ../core/dist/social-providers/microsoft-entra-id.d.mts
 //#region src/social-providers/microsoft-entra-id.d.ts
 /**
@@ -1209,21 +1403,29 @@ interface MicrosoftOptions extends ProviderOptions<MicrosoftEntraIDProfile> {
    * The tenant ID of the Microsoft account
    * @default "common"
    */
-  tenantId?: string | undefined;
+  tenantId?: string;
   /**
    * The authentication authority URL. Use the default "https://login.microsoftonline.com" for standard Entra ID or "https://<tenant-id>.ciamlogin.com" for CIAM scenarios.
    * @default "https://login.microsoftonline.com"
    */
-  authority?: string | undefined;
+  authority?: string;
+  /**
+   * Function that returns a JWT client assertion for token endpoint authentication.
+   *
+   * Use this instead of `clientSecret` when your Microsoft Entra ID app is
+   * configured for client authentication with assertions (private_key_jwt or
+   * workload identity federation).
+   */
+  clientAssertion?: ClientAssertionGetter;
   /**
    * The size of the profile photo
    * @default 48
    */
-  profilePhotoSize?: (48 | 64 | 96 | 120 | 240 | 360 | 432 | 504 | 648) | undefined;
+  profilePhotoSize?: 48 | 64 | 96 | 120 | 240 | 360 | 432 | 504 | 648;
   /**
    * Disable profile photo
    */
-  disableProfilePhoto?: boolean | undefined;
+  disableProfilePhoto?: boolean;
 }
 //#endregion
 //#region ../core/dist/social-providers/google.d.mts
@@ -1265,9 +1467,22 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   display?: ("page" | "popup" | "touch" | "wap") | undefined;
   /**
-   * The hosted domain of the user
+   * The hosted domain (Google Workspace) the user must belong to.
+   *
+   * This is sent to Google as the `hd` authorization hint and, when set, is
+   * also enforced against the `hd` claim of the returned id token/profile.
+   * Sign-in is rejected when the claim is missing or does not match, so this
+   * can be used to restrict sign-in to a Workspace domain.
    */
   hd?: string | undefined;
+  /**
+   * Enable incremental authorization via Google's `include_granted_scopes`
+   * parameter. When enabled, Google reports the user's full granted scope set
+   * in the token response.
+   *
+   * @default true
+   */
+  includeGrantedScopes?: boolean | undefined;
 }
 //#endregion
 //#region ../core/dist/social-providers/huggingface.d.mts
@@ -2138,10 +2353,12 @@ declare const socialProviders: {
   apple: (options: AppleOptions) => {
     id: "apple";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2149,7 +2366,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2160,7 +2381,13 @@ declare const socialProviders: {
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      issuer: string;
+      audience: string | string[];
+      maxTokenAge: string;
+      nonceComparison: "exact-or-sha256";
+    };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
       user?: {
@@ -2186,11 +2413,13 @@ declare const socialProviders: {
   atlassian: (options: AtlassianOptions) => {
     id: "atlassian";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2198,7 +2427,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2234,11 +2467,13 @@ declare const socialProviders: {
   cognito: (options: CognitoOptions) => {
     id: "cognito";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2246,7 +2481,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2258,7 +2497,12 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      issuer: string;
+      audience: string | string[];
+      maxTokenAge: string;
+    };
     getUserInfo(token: OAuth2Tokens & {
       user?: {
         name?: {
@@ -2283,10 +2527,12 @@ declare const socialProviders: {
   discord: (options: DiscordOptions) => {
     id: "discord";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2294,7 +2540,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2329,11 +2579,13 @@ declare const socialProviders: {
   facebook: (options: FacebookOptions) => {
     id: "facebook";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2341,7 +2593,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2351,7 +2607,20 @@ declare const socialProviders: {
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: {
+        (protectedHeader?: jose.JWSHeaderParameters, token?: jose.FlattenedJWSInput): Promise<jose.CryptoKey>;
+        coolingDown: boolean;
+        fresh: boolean;
+        reloading: boolean;
+        reload: () => Promise<void>;
+        jwks: () => jose.JSONWebKeySet | undefined;
+      };
+      issuer: string;
+      audience: string | string[];
+      algorithms: string[];
+      allowOpaqueToken: true;
+    };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
       user?: {
@@ -2377,11 +2646,13 @@ declare const socialProviders: {
   figma: (options: FigmaOptions) => {
     id: "figma";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2389,7 +2660,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2425,12 +2700,14 @@ declare const socialProviders: {
   github: (options: GithubOptions) => {
     id: "github";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       loginHint,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2438,7 +2715,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2474,6 +2755,7 @@ declare const socialProviders: {
   microsoft: (options: MicrosoftOptions) => {
     id: "microsoft";
     name: string;
+    callbackPath: string;
     createAuthorizationURL(data: {
       state: string;
       codeVerifier: string;
@@ -2481,7 +2763,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode({
       code,
       codeVerifier,
@@ -2492,7 +2778,12 @@ declare const socialProviders: {
       codeVerifier?: string | undefined;
       deviceId?: string | undefined;
     }): Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      audience: string | string[];
+      maxTokenAge: string;
+      issuer: string | undefined;
+    };
     getUserInfo(token: OAuth2Tokens & {
       user?: {
         name?: {
@@ -2518,13 +2809,16 @@ declare const socialProviders: {
   google: (options: GoogleOptions) => {
     id: "google";
     name: string;
+    callbackPath: string;
+    grantAuthority: "full-grant" | "projection";
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
       redirectURI,
       loginHint,
-      display
+      display,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2532,7 +2826,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2544,7 +2842,13 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+      issuer: string[];
+      audience: string | string[];
+      maxTokenAge: string;
+      verifyClaims: ((claims: Record<string, unknown>) => boolean) | undefined;
+    };
     getUserInfo(token: OAuth2Tokens & {
       user?: {
         name?: {
@@ -2569,11 +2873,13 @@ declare const socialProviders: {
   huggingface: (options: HuggingFaceOptions) => {
     id: "huggingface";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2581,7 +2887,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2617,10 +2927,12 @@ declare const socialProviders: {
   slack: (options: SlackOptions) => {
     id: "slack";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2628,7 +2940,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2663,11 +2979,13 @@ declare const socialProviders: {
   spotify: (options: SpotifyOptions) => {
     id: "spotify";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2675,7 +2993,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2711,10 +3033,12 @@ declare const socialProviders: {
   twitch: (options: TwitchOptions) => {
     id: "twitch";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2722,7 +3046,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2757,6 +3085,7 @@ declare const socialProviders: {
   twitter: (options: TwitterOption) => {
     id: "twitter";
     name: string;
+    callbackPath: string;
     createAuthorizationURL(data: {
       state: string;
       codeVerifier: string;
@@ -2764,7 +3093,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2800,11 +3133,13 @@ declare const socialProviders: {
   dropbox: (options: DropboxOptions) => {
     id: "dropbox";
     name: string;
+    callbackPath: string;
     createAuthorizationURL: ({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2812,7 +3147,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }) => Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }) => Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2848,11 +3187,13 @@ declare const socialProviders: {
   kick: (options: KickOptions) => {
     id: "kick";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       redirectURI,
-      codeVerifier
+      codeVerifier,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2860,7 +3201,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode({
       code,
       redirectURI,
@@ -2896,11 +3241,13 @@ declare const socialProviders: {
   linear: (options: LinearOptions) => {
     id: "linear";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2908,7 +3255,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2943,11 +3294,13 @@ declare const socialProviders: {
   linkedin: (options: LinkedInOptions) => {
     id: "linkedin";
     name: string;
+    callbackPath: string;
     createAuthorizationURL: ({
       state,
       scopes,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -2955,7 +3308,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }) => Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }) => Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2990,12 +3347,14 @@ declare const socialProviders: {
   gitlab: (options: GitlabOptions) => {
     id: "gitlab";
     name: string;
+    callbackPath: string;
     createAuthorizationURL: ({
       state,
       scopes,
       codeVerifier,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3003,7 +3362,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }) => Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }) => Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI,
@@ -3060,10 +3423,12 @@ declare const socialProviders: {
   tiktok: (options: TiktokOptions) => {
     id: "tiktok";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3071,7 +3436,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): {
+      url: URL;
+      requestedScopes: string[];
+    };
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3106,10 +3475,12 @@ declare const socialProviders: {
   reddit: (options: RedditOptions) => {
     id: "reddit";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3117,7 +3488,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3152,10 +3527,12 @@ declare const socialProviders: {
   roblox: (options: RobloxOptions) => {
     id: "roblox";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3163,7 +3540,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3198,11 +3579,13 @@ declare const socialProviders: {
   salesforce: (options: SalesforceOptions) => {
     id: "salesforce";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3210,7 +3593,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3246,11 +3633,13 @@ declare const socialProviders: {
   vk: (options: VkOption) => {
     id: "vk";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3258,7 +3647,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3295,10 +3688,13 @@ declare const socialProviders: {
   zoom: (userOptions: ZoomOptions) => {
     id: "zoom";
     name: string;
+    callbackPath: string;
     createAuthorizationURL: ({
       state,
+      scopes,
       redirectURI,
-      codeVerifier
+      codeVerifier,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3306,7 +3702,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }) => Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }) => Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI,
@@ -3341,11 +3741,13 @@ declare const socialProviders: {
   notion: (options: NotionOptions) => {
     id: "notion";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       loginHint,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3353,7 +3755,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3388,10 +3794,12 @@ declare const socialProviders: {
   kakao: (options: KakaoOptions) => {
     id: "kakao";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3399,7 +3807,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3455,10 +3867,12 @@ declare const socialProviders: {
   naver: (options: NaverOptions) => {
     id: "naver";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3466,7 +3880,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3522,12 +3940,14 @@ declare const socialProviders: {
   line: (options: LineOptions) => {
     id: "line";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3535,7 +3955,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3547,7 +3971,9 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    idToken: {
+      verify: (token: string, nonce: string | undefined) => Promise<boolean>;
+    };
     getUserInfo(token: OAuth2Tokens & {
       user?: {
         name?: {
@@ -3593,12 +4019,14 @@ declare const socialProviders: {
   paybin: (options: PaybinOptions) => {
     id: "paybin";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
       redirectURI,
-      loginHint
+      loginHint,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3606,7 +4034,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3642,10 +4074,12 @@ declare const socialProviders: {
   paypal: (options: PayPalOptions) => {
     id: "paypal";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3653,7 +4087,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3673,7 +4111,6 @@ declare const socialProviders: {
       refreshToken: any;
       accessTokenExpiresAt: Date | undefined;
     }>);
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
     getUserInfo(token: OAuth2Tokens & {
       user?: {
         name?: {
@@ -3719,11 +4156,13 @@ declare const socialProviders: {
   polar: (options: PolarOptions) => {
     id: "polar";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3731,7 +4170,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3767,11 +4210,13 @@ declare const socialProviders: {
   railway: (options: RailwayOptions) => {
     id: "railway";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3779,7 +4224,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3815,11 +4264,13 @@ declare const socialProviders: {
   vercel: (options: VercelOptions) => {
     id: "vercel";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
       codeVerifier,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3827,7 +4278,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): Promise<URL>;
+      additionalParams?: Record<string, string> | undefined;
+    }): Promise<{
+      url: URL;
+      requestedScopes: string[];
+    }>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3862,10 +4317,12 @@ declare const socialProviders: {
   wechat: (options: WeChatOptions) => {
     id: "wechat";
     name: string;
+    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
-      redirectURI
+      redirectURI,
+      additionalParams
     }: {
       state: string;
       codeVerifier: string;
@@ -3873,7 +4330,11 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
-    }): URL;
+      additionalParams?: Record<string, string> | undefined;
+    }): {
+      url: URL;
+      requestedScopes: string[];
+    };
     validateAuthorizationCode: ({
       code
     }: {
@@ -3939,7 +4400,7 @@ declare const accountSchema: z.ZodObject<{
   idToken: z.ZodOptional<z.ZodNullable<z.ZodString>>;
   accessTokenExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodDate>>;
   refreshTokenExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodDate>>;
-  scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  grantedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
   password: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 type BaseAccount = z.infer<typeof accountSchema>;
@@ -3948,14 +4409,14 @@ type BaseAccount = z.infer<typeof accountSchema>;
  */
 type Account<DBOptions extends BetterAuthOptions["account"] = BetterAuthOptions["account"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify$1<BaseAccount & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"account", Plugins>>; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/helper.d.mts
 type Prettify<T> = { [K in keyof T]: T[K] } & {};
 type IsEmptyObject<T> = keyof T extends never ? true : false;
 type UnionToIntersection<Union> = (Union extends unknown ? (distributedUnion: Union) => void : never) extends ((mergedIntersection: infer Intersection) => void) ? Intersection & Union : never;
 type InferParamPath<Path> = Path extends `${infer _Start}:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}:${infer Param}` ? { [K in Param]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamPath<Rest> : {};
 type InferParamWildCard<Path> = Path extends `${infer _Start}/*:${infer Param}/${infer Rest}` | `${infer _Start}/**:${infer Param}/${infer Rest}` ? { [K in Param | keyof InferParamPath<Rest>]: string } : Path extends `${infer _Start}/*` ? { [K in "_"]: string } : Path extends `${infer _Start}/${infer Rest}` ? InferParamWildCard<Rest> : {}; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/standard-schema.d.mts
 //#region src/standard-schema.d.ts
 /** The Standard Schema interface. */
 interface StandardSchemaV1$1<Input = unknown, Output = Input> {
@@ -4013,7 +4474,7 @@ declare namespace StandardSchemaV1$1 {
   type InferOutput<Schema extends StandardSchemaV1$1> = NonNullable<Schema["~standard"]["types"]>["output"];
 } //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/error.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/error.d.mts
 declare const statusCodes: {
   OK: number;
   CREATED: number;
@@ -4091,7 +4552,7 @@ declare const APIError: new (status?: Status | "OK" | "CREATED" | "ACCEPTED" | "
   errorStack: string | undefined;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/cookies.d.mts
 //#region src/cookies.d.ts
 type CookiePrefixOptions = "host" | "secure";
 type CookieOptions = {
@@ -4181,7 +4642,7 @@ type CookieOptions = {
   prefix?: CookiePrefixOptions;
 };
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/openapi.d.mts
 //#region src/openapi.d.ts
 type OpenAPISchemaType = "string" | "number" | "integer" | "boolean" | "array" | "object";
 interface OpenAPIParameter {
@@ -4203,7 +4664,7 @@ interface OpenAPIParameter {
   };
 }
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/endpoint.d.mts
 //#region src/endpoint.d.ts
 interface EndpointBaseOptions {
   /**
@@ -4524,6 +4985,22 @@ type EndpointContext<Path extends string, Options extends EndpointOptions, Conte
    * @returns - The cookie string
    */
   setSignedCookie: (key: string, value: string, secret: string, options?: CookieOptions) => Promise<string>;
+  /**
+   * Response headers
+   *
+   * The live `Headers` for the response being built in the current
+   * request. Read it to inspect what has already been queued, e.g. to
+   * avoid emitting a `Set-Cookie` twice or to check headers set by an
+   * earlier handler in the chain.
+   *
+   * @example
+   * ```ts
+   * const alreadySet = ctx.responseHeaders
+   *   .getSetCookie()
+   *   .some((c) => c.startsWith("session="));
+   * ```
+   */
+  responseHeaders: Headers;
   /**
    * JSON
    *
@@ -4566,7 +5043,7 @@ type Endpoint<Path extends string = string, Options extends EndpointOptions = En
   path: Path;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/middleware.d.mts
 //#region src/middleware.d.ts
 interface MiddlewareOptions extends Omit<EndpointOptions, "method"> {}
 type MiddlewareContext<Options extends MiddlewareOptions, Context = {}> = EndpointContext<string, Options & {
@@ -4673,7 +5150,7 @@ type Middleware<Options extends MiddlewareOptions = MiddlewareOptions, Handler e
   options: Options;
 }; //#endregion
 //#endregion
-//#region ../../node_modules/.pnpm/better-call@1.3.5_zod@4.3.6/node_modules/better-call/dist/context.d.mts
+//#region ../../node_modules/.pnpm/better-call@1.3.6_zod@4.3.6/node_modules/better-call/dist/context.d.mts
 //#region src/context.d.ts
 type HTTPMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
 type Method = HTTPMethod | "*";
@@ -4809,11 +5286,13 @@ type GenericEndpointContext<Options extends BetterAuthOptions = BetterAuthOption
   context: AuthContext<Options>;
 };
 interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions> {
-  createOAuthUser(user: Omit<User, "id" | "createdAt" | "updatedAt">, account: Omit<Account, "userId" | "id" | "createdAt" | "updatedAt"> & Partial<Account>): Promise<{
-    user: User;
-    account: Account;
-  }>;
-  createUser<T extends Record<string, any>>(user: Omit<User, "id" | "createdAt" | "updatedAt" | "emailVerified"> & Partial<User> & Record<string, any>): Promise<T & User>;
+  createUser<T extends Record<string, any>>(user: Omit<User, "id" | "createdAt" | "updatedAt" | "emailVerified"> & Partial<User> & Record<string, any>,
+  /**
+   * Provisioning source. The creation seam adds `action: "create-user"` and
+   * runs the `user.validateUserInfo` gate.
+   */
+
+  source: UserProvisioningSource): Promise<T & User>;
   createAccount<T extends Record<string, any>>(account: Omit<Account, "id" | "createdAt" | "updatedAt"> & Partial<Account> & T): Promise<T & Account>;
   listSessions(userId: string, options?: {
     onlyActiveSessions?: boolean | undefined;
@@ -4844,7 +5323,14 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
    * @param id - The account row's primary key (the `id` column, not the `accountId` column).
    */
   deleteAccount(id: string): Promise<void>;
-  deleteSessions(userIdOrSessionTokens: string | string[]): Promise<void>;
+  /**
+   * Delete every session belonging to a user.
+   */
+  deleteUserSessions(userId: string): Promise<void>;
+  /**
+   * Delete sessions by their session tokens.
+   */
+  deleteSessions(sessionTokens: string[]): Promise<void>;
   findOAuthUser(email: string, accountId: string, providerId: string): Promise<{
     user: User;
     linkedAccount: Account | null;
@@ -4862,13 +5348,26 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
   updateUserByEmail<T extends Record<string, any>>(email: string, data: Partial<User & Record<string, any>>): Promise<User & T>;
   updatePassword(userId: string, password: string): Promise<void>;
   findAccounts(userId: string): Promise<Account[]>;
-  findAccount(accountId: string): Promise<Account | null>;
   findAccountByProviderId(accountId: string, providerId: string): Promise<Account | null>;
   findAccountByUserId(userId: string): Promise<Account[]>;
   updateAccount(id: string, data: Partial<Account>): Promise<Account>;
   createVerificationValue(data: Omit<Verification, "createdAt" | "id" | "updatedAt"> & Partial<Verification>): Promise<Verification>;
   findVerificationValue(identifier: string): Promise<Verification | null>;
   deleteVerificationByIdentifier(identifier: string): Promise<void>;
+  /**
+   * Atomically consume a single-use verification row by `identifier` and
+   * return it. Only the first concurrent caller receives the latest row;
+   * subsequent callers receive `null`. Consuming one row invalidates the
+   * whole identifier so stale rows cannot be replayed. Rows past their
+   * `expiresAt` are treated as already invalid: the row is deleted but
+   * `null` is returned, so callers do not need to gate on `expiresAt`
+   * themselves. Callers MUST gate any state change (issue session, mint
+   * token, change password) on a non-null result.
+   *
+   * Replaces the racy `findVerificationValue` + `deleteVerificationByIdentifier`
+   * pair at single-use credential consumption sites.
+   */
+  consumeVerificationValue(identifier: string): Promise<Verification | null>;
   updateVerificationByIdentifier(identifier: string, data: Partial<Verification>): Promise<Verification>;
   refreshUserSessions(user: User): Promise<void>;
 }
@@ -4926,7 +5425,7 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
      * - "cookie": Store state in an encrypted cookie (stateless)
      * - "database": Store state in the database
      *
-     * @default "cookie"
+     * @default "database" when `database` or `secondaryStorage` is configured, "cookie" otherwise
      */
     storeStateStrategy: "database" | "cookie";
   };
@@ -4948,7 +5447,7 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
     session: Session & Record<string, any>;
     user: User & Record<string, any>;
   } | null) => void;
-  socialProviders: OAuthProvider[];
+  socialProviders: UpstreamProvider[];
   authCookies: BetterAuthCookies;
   logger: ReturnType<typeof createLogger>;
   rateLimit: {
@@ -5114,7 +5613,7 @@ declare const createAuthMiddleware: {
         image?: string | null | undefined;
       } & Record<string, any>;
     } | null) => void;
-    socialProviders: OAuthProvider[];
+    socialProviders: UpstreamProvider[];
     authCookies: BetterAuthCookies;
     logger: ReturnType<typeof createLogger>;
     rateLimit: {
@@ -5243,7 +5742,7 @@ declare const createAuthMiddleware: {
         image?: string | null | undefined;
       } & Record<string, any>;
     } | null) => void;
-    socialProviders: OAuthProvider[];
+    socialProviders: UpstreamProvider[];
     authCookies: BetterAuthCookies;
     logger: ReturnType<typeof createLogger>;
     rateLimit: {
@@ -5309,6 +5808,73 @@ type GenerateIdFn = (options: {
   model: ModelNames;
   size?: number | undefined;
 }) => string | false;
+/**
+ * What Better Auth is about to do with an incoming identity when
+ * {@link BetterAuthOptions.user}'s `validateUserInfo` runs.
+ *
+ * - `create-user`: a brand-new user record is about to be created.
+ * - `link-account`: a new provider account is about to be linked to an
+ *   already-existing user.
+ * - `sign-in`: an existing OAuth or SSO user is signing in again. This is the
+ *   one case where the provider can assert *changed* data, so the hook receives
+ *   the fresh provider email and profile (not the stored row), letting a domain
+ *   or org policy reject a user whose provider identity moved out of bounds.
+ *
+ * Non-provider returning sign-ins are not re-validated: they carry only the
+ * stored row, which has not changed since `create-user` gated it. Use the admin
+ * plugin's ban controls or a `databaseHooks.session.create.before` hook to
+ * block those.
+ */
+type ValidateUserInfoAction = "create-user" | "link-account" | "sign-in";
+/**
+ * The authentication method that produced the incoming user info. The named
+ * methods cover Better Auth's built-ins; the open `string` keeps it extensible
+ * for plugins (for example `"scim"`).
+ */
+type ValidateUserInfoMethod = "oauth" | "sso-oidc" | "sso-saml" | "email-password" | "magic-link" | "email-otp" | "anonymous" | "siwe" | "phone-number" | "admin" | (string & {});
+/** OAuth-specific provisioning context; present only when `method` is `"oauth"`. */
+type ValidateUserInfoOAuthInfo = {
+  /** The social or generic OAuth provider id (e.g. `"google"`). */providerId: string; /** The raw provider profile (userinfo or id-token claims), unmapped. */
+  profile?: Record<string, unknown> | undefined;
+};
+/** SSO-specific provisioning context; present for OIDC and SAML SSO methods. */
+type ValidateUserInfoSSOInfo = {
+  /** The configured SSO provider id. */providerId: string; /** The raw OIDC claims or SAML assertion attributes, unmapped. */
+  profile?: Record<string, unknown> | undefined;
+};
+/** Provisioning origin passed to `createUser`; the creation seam adds `action: "create-user"` to build {@link ValidateUserInfoSource}. */
+type UserProvisioningSource = {
+  method: ValidateUserInfoMethod; /** Provider id and raw profile; present iff `method` is `"oauth"`. */
+  oauth?: ValidateUserInfoOAuthInfo | undefined; /** Provider id and raw profile; present iff `method` is `"sso-oidc"` or `"sso-saml"`. */
+  sso?: ValidateUserInfoSSOInfo | undefined;
+};
+/**
+ * The context passed to `validateUserInfo`: the lifecycle
+ * {@link ValidateUserInfoAction}, the {@link ValidateUserInfoMethod}, and (for
+ * OAuth/SSO provider methods) protocol-specific provider metadata.
+ *
+ * ```ts
+ * // Scope to one OAuth provider:
+ * if (source.oauth?.providerId !== "google") return;
+ * // Branch on the method:
+ * if (source.method === "anonymous") return { error: "no_anonymous" };
+ * // Inspect SSO claims:
+ * if (source.method === "sso-saml" && source.sso?.profile?.department !== "eng") {
+ *   return { error: "invalid_department" };
+ * }
+ * ```
+ */
+type ValidateUserInfoSource = UserProvisioningSource & {
+  action: ValidateUserInfoAction;
+};
+type ValidateUserInfoResult = {
+  /** A short, machine-readable rejection code, surfaced to the client. */error: string;
+  /**
+   * A human-readable reason, surfaced to the client. Do not put sensitive
+   * details here.
+   */
+  errorDescription?: string | undefined;
+};
 /**
  * Configuration for dynamic base URL resolution.
  * Allows Better Auth to work with multiple domains (e.g., Vercel preview deployments).
@@ -5439,12 +6005,13 @@ type BetterAuthAdvancedOptions = {
      */
     disableIpTracking?: boolean;
     /**
-     * IPv6 subnet prefix length for rate limiting.
-     * IPv6 addresses will be normalized to this subnet.
+     * IPv6 prefix length used to collapse addresses before rate-limit keying.
+     * Any integer from 0 to 128 is accepted; common values are 32, 48, 56, 64, 128.
+     * Out-of-range values fall back to safe behavior (negative -> mask all, > 128 -> no mask).
      *
      * @default 64
      */
-    ipv6Subnet?: 128 | 64 | 48 | 32;
+    ipv6Subnet?: number;
   } | undefined;
   /**
    * Force cookies to always use the `Secure` attribute. By default,
@@ -5970,6 +6537,30 @@ type BetterAuthOptions = {
    * User configuration
    */
   user?: (BetterAuthDBOptions<"user", keyof BaseUser> & {
+    /**
+     * Gate which identities Better Auth admits. Called just before
+     * `create-user`, `link-account`, and (for OAuth) `sign-in`, across
+     * every authentication method, including stateless setups with no
+     * persistent database. On `sign-in` the hook receives the *fresh*
+     * provider email and profile, so a domain policy can reject a user
+     * whose provider identity moved out of bounds.
+     *
+     * Non-provider returning sign-ins are not re-validated; use the admin
+     * plugin's ban controls or a `databaseHooks.session.create.before`
+     * hook for those.
+     *
+     * Return nothing to allow; return `{ error }` to reject. Browser flows
+     * redirect to the configured error URL; programmatic flows surface a
+     * `403`.
+     *
+     * TODO: rename to `validateUser` (and the `ValidateUserInfo*` types).
+     * "UserInfo" is the OIDC term and misleads for the email/password,
+     * SIWE, phone, and admin methods.
+     */
+    validateUserInfo?: (data: {
+      user: Partial<User> & Record<string, unknown>;
+      source: ValidateUserInfoSource;
+    }, context: GenericEndpointContext) => Awaitable<void | ValidateUserInfoResult>;
     /**
      * Changing email configuration
      */
@@ -6193,6 +6784,25 @@ type BetterAuthOptions = {
        * @default false
        */
       disableImplicitLinking?: boolean;
+      /**
+       * Require the existing local user row to have
+       * `emailVerified: true` before implicit account linking
+       * uses the IdP's `email_verified` claim as ownership
+       * proof. Defaults to `true` so an attacker who
+       * pre-registers an unverified account at a victim's
+       * email cannot have the victim's OAuth identity linked
+       * into the attacker-owned row on first sign-in. Set to
+       * `false` for backward compatibility on apps whose
+       * users sign up via OAuth without verifying their email
+       * locally; understand the takeover risk before doing
+       * so.
+       *
+       * @default true
+       *
+       * @deprecated The option will be removed on the next
+       * minor; the gate will become unconditional.
+       */
+      requireLocalEmailVerified?: boolean;
       /**
        * List of trusted providers. Can be a static array or a function
        * that returns providers dynamically. The function is called
@@ -6230,7 +6840,11 @@ type BetterAuthOptions = {
        */
       allowUnlinkingAll?: boolean;
       /**
-       * If enabled (true), this will update the user information based on the newly linked account
+       * When enabled, linking an account copies the provider's profile onto
+       * the local user, matching the fields persisted on sign-up (`name`,
+       * `image`, and any `mapProfileToUser` fields). The local `email` and
+       * `emailVerified` are never changed, so a link cannot rebind the
+       * account's identity.
        *
        * @default false
        */
@@ -6263,7 +6877,7 @@ type BetterAuthOptions = {
      * - "cookie": Store state in an encrypted cookie (stateless)
      * - "database": Store state in the database
      *
-     * @default "cookie"
+     * @default "database" when `database` or `secondaryStorage` is configured, "cookie" otherwise
      */
     storeStateStrategy?: "database" | "cookie";
     /**
@@ -6772,6 +7386,18 @@ interface SecondaryStorage {
    * @returns - Value of the key
    */
   get: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically get a value and delete it from storage.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. Single-use credential consumers use it when
+   * present to avoid a read-then-delete race.
+   *
+   * TODO(secondary-storage-atomic-consume): make this required in the next
+   * breaking release, or require database-backed verification storage for
+   * security-sensitive consume paths.
+   */
+  getAndDelete?: (key: string) => Awaitable<unknown>;
   set: (
   /**
    * Key to store
@@ -7069,6 +7695,7 @@ declare const requestAuthOptionsSchema: z.ZodObject<{
   disableRedirect: z.ZodOptional<z.ZodBoolean>;
   scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
+  additionalParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
   additionalData: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
 }, z.core.$strip>;
 type ElectronRequestAuthOptions = z.infer<typeof requestAuthOptionsSchema>;