@better-auth/electron 1.7.0-beta.5 → 1.7.0-beta.7

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-DzWb5tB_.mjs";
+import { t as PACKAGE_VERSION } from "./version-DQW8cveo.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";
@@ -578,6 +578,16 @@ const electronClient = (options) => {
 	const cookieName = `${opts.storagePrefix}.cookie`;
 	const localCacheName = `${opts.storagePrefix}.local_cache`;
 	const { getDecrypted, setEncrypted } = storageAdapter(opts.storage, new Set([cookieName, localCacheName]));
+	const clearSessionCache = () => {
+		setEncrypted(cookieName, "{}");
+		store?.atoms.session?.set({
+			...store.atoms.session.get(),
+			data: null,
+			error: null,
+			isPending: false
+		});
+		setEncrypted(localCacheName, "{}");
+	};
 	if ((isDevelopment() || isTest()) && /^(?!\.)(?!.*\.\.)(?!.*\.$)[^.]+\.[^.]+$/.test(scheme)) console.warn("The provided scheme does not follow the reverse domain name notation. For example: `app.example.com` -> `com.example.app`.");
 	return {
 		id: "electron",
@@ -597,16 +607,7 @@ const electronClient = (options) => {
 					"user-agent": app.userAgentFallback,
 					"x-skip-oauth-proxy": "true"
 				};
-				if (url.endsWith("/sign-out")) {
-					setEncrypted(cookieName, "{}");
-					store?.atoms.session?.set({
-						...store.atoms.session.get(),
-						data: null,
-						error: null,
-						isPending: false
-					});
-					setEncrypted(localCacheName, "{}");
-				}
+				if (url.endsWith("/sign-out")) clearSessionCache();
 				return {
 					url,
 					options
@@ -629,6 +630,7 @@ const electronClient = (options) => {
 						const data = context.data;
 						setEncrypted(localCacheName, JSON.stringify(data));
 					}
+					if (context.request.url.toString().includes("/sign-out")) clearSessionCache();
 				},
 				onError: async (context) => {
 					webContents.getFocusedWebContents()?.send(`${getChannelPrefixWithDelimiter(opts.channelPrefix)}error`, {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-DzWb5tB_.mjs";
+import { t as PACKAGE_VERSION } from "./version-DQW8cveo.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";
@@ -53,14 +53,13 @@ const electronToken = (_opts) => createAuthEndpoint("/electron/token", {
 		}
 	}
 }, async (ctx) => {
-	const token = await ctx.context.internalAdapter.findVerificationValue(`electron:${ctx.body.token}`);
-	if (!token || token.expiresAt < /* @__PURE__ */ new Date()) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
+	const token = await ctx.context.internalAdapter.consumeVerificationValue(`electron:${ctx.body.token}`);
+	if (!token) throw APIError.from("NOT_FOUND", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	const tokenRecord = safeJSONParse$1(token.value);
 	if (!tokenRecord) throw APIError.from("INTERNAL_SERVER_ERROR", ELECTRON_ERROR_CODES.INVALID_TOKEN);
 	if (tokenRecord.state !== ctx.body.state) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.STATE_MISMATCH);
 	if (!tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.MISSING_CODE_CHALLENGE);
 	if (await generateCodeChallenge(ctx.body.code_verifier) !== tokenRecord.codeChallenge) throw APIError.from("BAD_REQUEST", ELECTRON_ERROR_CODES.INVALID_CODE_VERIFIER);
-	await ctx.context.internalAdapter.deleteVerificationByIdentifier(`electron:${ctx.body.token}`);
 	const user = await ctx.context.internalAdapter.findUserById(tokenRecord.userId);
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const session = await ctx.context.internalAdapter.createSession(user.id);

package/dist/preload.d.mts

@@ -33,6 +33,7 @@ type DBAdapterDebugLogOption = boolean | {
   delete?: boolean | undefined;
   deleteMany?: boolean | undefined;
   consumeOne?: boolean | undefined;
+  incrementOne?: boolean | undefined;
   count?: boolean | undefined;
 } | {
   /**
@@ -208,7 +209,7 @@ interface DBAdapterFactoryConfig<Options extends BetterAuthOptions = BetterAuthO
     /**
      * The action which was called from the adapter.
      */
-    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "count";
+    action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
     /**
      * The model name.
      */
@@ -437,15 +438,43 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
    * race-safe primitive for consuming single-use credentials
    * (verification tokens, authorization codes, one-time tokens).
    *
-   * Always defined on the factory-wrapped adapter. When the underlying
-   * `CustomAdapter` does not implement `consumeOne`, the factory provides
-   * a fallback that wraps `findMany + deleteMany` in `transaction(...)`
-   * and returns the row only when the delete reports an affected row.
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee cross-process single-use semantics.
    */
   consumeOne: <T>(data: {
     model: string;
     where: Where[];
   }) => Promise<T | null>;
+  /**
+   * Atomically apply signed numeric deltas to a single row matching the where
+   * clause. For each entry in `increment`, the operation applies
+   * `field = field + delta` in one atomic step; a negative delta decrements.
+   *
+   * The `where` clause is both the selector AND the guard: comparison
+   * operators are honored, so passing `{ field: "remaining", operator: "gt",
+   * value: 0 }` only mutates the row while `remaining` is still above zero.
+   * When the guard matches no row, the operation makes no change and returns
+   * `null`.
+   *
+   * The optional `set` map assigns absolute values to fields in the same
+   * atomic operation, alongside the increments.
+   *
+   * Returns the updated row, or `null` when the guard matched no row. Under
+   * concurrent invocation against the same row, this is the race-safe
+   * primitive for guarded counter updates (e.g. decrementing a remaining-uses
+   * counter only while it is still positive).
+   *
+   * Always defined on the factory-wrapped adapter. The underlying
+   * `CustomAdapter` must implement this natively; there is no portable
+   * fallback that can guarantee guarded counter semantics across runtimes.
+   */
+  incrementOne: <T>(data: {
+    model: string;
+    where: Where[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
+  }) => Promise<T | null>;
   /**
    * Execute multiple operations in a transaction.
    * If the adapter doesn't support transactions, operations will be executed sequentially.
@@ -528,17 +557,32 @@ interface CustomAdapter {
     where: CleanedWhere[];
   }) => Promise<number>;
   /**
-   * Optional native atomic single-row consume. When omitted, the adapter
-   * factory falls back to `transaction(findMany + deleteMany)`.
+   * Native atomic single-row consume.
    * Implementing this method natively (e.g. `DELETE ... RETURNING *`,
    * `findOneAndDelete`, `OUTPUT deleted.*`) gives one round trip and the
    * strongest race-safety guarantee. Implementations must delete at most
-   * one matching row. TODO(consume-one-required): tighten to required in the
-   * next minor on `next`.
+   * one matching row.
+   */
+  consumeOne: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<T | null>;
+  /**
+   * Native atomic guarded counter mutation. Applies
+   * `field = field + delta` for each entry in `increment` (negative deltas
+   * decrement), with `where` acting as both selector and guard and `set`
+   * assigning absolute values in the same operation. Returns the updated row,
+   * or `null` when the guard matched no row.
+   *
+   * Implementing this natively (e.g. `UPDATE ... SET n = n + $delta WHERE ...
+   * RETURNING *`) gives one round trip and the strongest race-safety
+   * guarantee.
    */
-  consumeOne?: <T>(data: {
+  incrementOne: <T>(data: {
     model: string;
     where: CleanedWhere[];
+    increment: Record<string, number>;
+    set?: Record<string, unknown> | undefined;
   }) => Promise<T | null>;
   count: ({
     model,
@@ -577,7 +621,6 @@ type BaseRateLimit = z.infer<typeof rateLimitSchema>;
 /**
  * Rate limit schema type used by better-auth for rate limiting
  */
-type RateLimit<DBOptions extends BetterAuthOptions["rateLimit"] = BetterAuthOptions["rateLimit"], Plugins extends BetterAuthOptions["plugins"] = BetterAuthOptions["plugins"]> = Prettify$1<BaseRateLimit & InferDBFieldsFromOptions<DBOptions> & InferDBFieldsFromPlugins<"rateLimit", Plugins>>; //#endregion
 //#endregion
 //#region ../core/dist/db/schema/session.d.mts
 //#region src/db/schema/session.d.ts
@@ -713,6 +756,17 @@ type OAuth2UserInfo = {
   image?: string | undefined;
   emailVerified: boolean;
 };
+/**
+ * Request metadata available to provider refresh hooks.
+ *
+ * The refresh flow may be triggered by endpoints such as `getAccessToken` or
+ * `refreshToken`; this context gives provider hooks access to the triggering
+ * request without exposing the full endpoint implementation surface.
+ */
+interface OAuthRefreshContext {
+  headers?: Headers | undefined;
+  request?: Request | undefined;
+}
 /**
  * The result of building a provider authorization URL.
  *
@@ -772,6 +826,12 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    /**
+     * OIDC nonce generated by the redirect initiator and persisted in OAuth
+     * state. Providers that set `requiresIdTokenNonce` must forward this to
+     * the authorization URL as the `nonce` parameter.
+     */
+    idTokenNonce?: string | undefined;
     /**
      * Extra query parameters to append to the authorization URL.
      * Providers forward these to the shared `createAuthorizationURL` helper,
@@ -788,6 +848,12 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens | null>;
   getUserInfo: (token: OAuth2Tokens & {
+    /**
+     * OIDC nonce recovered from OAuth state. Providers that required an
+     * ID-token nonce must pass this to `verifyProviderIdToken` before
+     * trusting ID-token claims.
+     */
+    expectedIdTokenNonce?: string | undefined;
     /**
      * The user object from the provider
      * This is only available for some providers like Apple
@@ -804,9 +870,13 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
     data: T;
   } | null>;
   /**
-   * Custom function to refresh a token
+   * Custom function to refresh a token.
+   *
+   * Receives request metadata from the endpoint that triggered the refresh.
+   * Providers that don't need request-scoped data can ignore the second
+   * argument.
    */
-  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  refreshAccessToken?: ((refreshToken: string, ctx?: OAuthRefreshContext) => Promise<OAuth2Tokens>) | undefined;
   /**
    * Declarative id_token verification config consumed by the shared
    * `verifyProviderIdToken` verifier. Providers set this instead of implementing a boolean
@@ -819,6 +889,13 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
    * against this value to prevent authorization server mix-up attacks.
    */
   issuer?: string | undefined;
+  /**
+   * Require shared OAuth redirect routes to bind ID-token verification to an
+   * authorization request nonce. When true, routes generate `idTokenNonce`,
+   * pass it to `createAuthorizationURL`, persist it in state, and provide it
+   * back to `getUserInfo` as `expectedIdTokenNonce`.
+   */
+  requiresIdTokenNonce?: boolean | undefined;
   /**
    * Disable implicit sign up for new users. When set to true for the provider,
    * sign-in need to be called with with requestSignUp as true to create new users.
@@ -2366,6 +2443,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2390,6 +2468,7 @@ declare const socialProviders: {
     };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2427,6 +2506,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2444,6 +2524,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2481,6 +2562,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2504,6 +2586,7 @@ declare const socialProviders: {
       maxTokenAge: string;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2540,6 +2623,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2556,6 +2640,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2593,6 +2678,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2623,6 +2709,7 @@ declare const socialProviders: {
     };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2660,6 +2747,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2677,6 +2765,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2715,6 +2804,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2732,6 +2822,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens | null>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2763,6 +2854,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2783,8 +2875,10 @@ declare const socialProviders: {
       audience: string | string[];
       maxTokenAge: string;
       issuer: string | undefined;
+      verifyClaims: (claims: Record<string, unknown>) => boolean;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2826,6 +2920,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2850,6 +2945,7 @@ declare const socialProviders: {
       verifyClaims: ((claims: Record<string, unknown>) => boolean) | undefined;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2887,6 +2983,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2904,6 +3001,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2940,6 +3038,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -2956,6 +3055,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2993,6 +3093,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3010,6 +3111,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3046,6 +3148,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3062,6 +3165,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3093,6 +3197,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3110,6 +3215,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3147,6 +3253,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -3164,6 +3271,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3201,6 +3309,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3218,6 +3327,7 @@ declare const socialProviders: {
     }): Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3255,6 +3365,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3271,6 +3382,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3308,6 +3420,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -3324,6 +3437,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3362,6 +3476,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -3379,6 +3494,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3436,6 +3552,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): {
       url: URL;
@@ -3452,6 +3569,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3488,6 +3606,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3504,6 +3623,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3540,6 +3660,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3556,6 +3677,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3593,6 +3715,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3610,6 +3733,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3647,6 +3771,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3665,6 +3790,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(data: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3702,6 +3828,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }) => Promise<{
       url: URL;
@@ -3719,6 +3846,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3755,6 +3883,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3771,6 +3900,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3807,6 +3937,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3823,6 +3954,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3880,6 +4012,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3896,6 +4029,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3955,6 +4089,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -3975,6 +4110,7 @@ declare const socialProviders: {
       verify: (token: string, nonce: string | undefined) => Promise<boolean>;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4034,6 +4170,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -4051,6 +4188,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4087,6 +4225,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -4112,6 +4251,7 @@ declare const socialProviders: {
       accessTokenExpiresAt: Date | undefined;
     }>);
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4170,6 +4310,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -4187,6 +4328,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4224,6 +4366,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -4241,6 +4384,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4278,6 +4422,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): Promise<{
       url: URL;
@@ -4294,6 +4439,7 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4330,6 +4476,7 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
     }): {
       url: URL;
@@ -4359,6 +4506,7 @@ declare const socialProviders: {
       scopes: string[];
     }>);
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -5368,6 +5516,23 @@ interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions
    * pair at single-use credential consumption sites.
    */
   consumeVerificationValue(identifier: string): Promise<Verification | null>;
+  /**
+   * First-writer-wins create keyed by a deterministic primary key derived from
+   * `identifier`. Returns `true` when this caller created the row and `false`
+   * when a row for the same identifier already existed.
+   *
+   * The dual of `consumeVerificationValue`: reserve races to create a marker
+   * exactly once, where consume races to delete one exactly once. Use it for
+   * replay tombstones (a SAML assertion id, a JWT `jti`) where the first caller
+   * wins. The database path is atomic via the primary key. Secondary-storage-only
+   * verification is not supported for reservation and runtime implementations
+   * should fail closed unless verification is backed by the database.
+   */
+  reserveVerificationValue(data: {
+    identifier: string;
+    value: string;
+    expiresAt: Date;
+  }): Promise<boolean>;
   updateVerificationByIdentifier(identifier: string, data: Partial<Verification>): Promise<Verification>;
   refreshUserSessions(user: User): Promise<void>;
 }
@@ -5919,8 +6084,30 @@ type DynamicBaseURLConfig = {
  */
 type BaseURLConfig = string | DynamicBaseURLConfig;
 interface BetterAuthRateLimitStorage {
-  get: (key: string) => Promise<RateLimit | null | undefined>;
-  set: (key: string, value: RateLimit, update?: boolean | undefined) => Promise<void>;
+  /**
+   * Atomically records one request against `key` within the rolling `window`
+   * (in seconds) and reports whether it is allowed.
+   *
+   * When `allowed` is true the count was incremented within the active window,
+   * or the window had elapsed and was reset to start at 1. When `allowed` is
+   * false the limit was already reached and `retryAfter` is the number of
+   * seconds until the window frees up.
+   *
+   * Performing the check and the increment in a single step closes the
+   * concurrent-bypass gap of the separate `get`/`set` path: N simultaneous
+   * requests can no longer all pass a stale read before any increment lands.
+   *
+   * Custom storages must implement this operation directly. Better Auth no
+   * longer accepts separate `get`/`set` rate-limit storage because that shape
+   * cannot enforce a distributed limit under concurrent requests.
+   */
+  consume: (key: string, rule: {
+    window: number;
+    max: number;
+  }) => Promise<{
+    allowed: boolean;
+    retryAfter: number | null;
+  }>;
 }
 type BetterAuthRateLimitRule = {
   /**
@@ -6702,6 +6889,20 @@ type BetterAuthOptions = {
        * @default "compact"
        */
       strategy?: "compact" | "jwt" | "jwe";
+      /**
+       * JWT-specific configuration for `strategy: "jwt"`.
+       */
+      jwt?: {
+        /**
+         * Which signing key is used for cookie-cache JWTs.
+         *
+         * - `"secret"`: uses the Better Auth secret with HS256.
+         * - `"jwt-plugin"`: uses the installed `jwt()` plugin's asymmetric signing keys.
+         *
+         * @default "secret"
+         */
+        signingKey?: "secret" | "jwt-plugin";
+      };
       /**
        * Controls stateless cookie cache refresh behavior.
        *
@@ -6881,9 +7082,13 @@ type BetterAuthOptions = {
      */
     storeStateStrategy?: "database" | "cookie";
     /**
-     * Store account data after oauth flow on a cookie
+     * Store provider account data after an OAuth flow in an encrypted
+     * cookie. This includes OAuth token material such as access tokens,
+     * refresh tokens, ID tokens, scopes, and token expiry.
      *
-     * This is useful for database-less flow
+     * This is useful for database-less flows, but large provider tokens can
+     * still hit browser or proxy cookie/header limits even though Better Auth
+     * chunks oversized account cookies.
      *
      * @default false
      *
@@ -7388,16 +7593,21 @@ interface SecondaryStorage {
   get: (key: string) => Awaitable<unknown>;
   /**
    * Atomically get a value and delete it from storage.
+   */
+  getAndDelete: (key: string) => Awaitable<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
    *
-   * This is optional for backwards compatibility with existing secondary
-   * storage implementations. Single-use credential consumers use it when
-   * present to avoid a read-then-delete race.
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
    *
-   * TODO(secondary-storage-atomic-consume): make this required in the next
-   * breaking release, or require database-backed verification storage for
-   * security-sensitive consume paths.
+   * Required so secondary-storage-backed rate limiting can enforce the limit
+   * in one distributed-safe operation.
    */
-  getAndDelete?: (key: string) => Awaitable<unknown>;
+  increment: (key: string, ttl: number) => Awaitable<number>;
   set: (
   /**
    * Key to store

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-DzWb5tB_.mjs";
+import { t as PACKAGE_VERSION } from "./version-DQW8cveo.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/{version-DzWb5tB_.mjs → version-DQW8cveo.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.5";
+const PACKAGE_VERSION = "1.7.0-beta.7";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.7.0-beta.5",
+  "version": "1.7.0-beta.7",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -80,17 +80,17 @@
     "better-sqlite3": "^12.6.2",
     "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.5",
-    "better-auth": "1.7.0-beta.5"
+    "@better-auth/core": "1.7.0-beta.7",
+    "better-auth": "1.7.0-beta.7"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.1",
-    "@better-fetch/fetch": "1.2.2",
+    "@better-auth/utils": "0.4.2",
+    "@better-fetch/fetch": "1.3.1",
     "better-call": "1.3.6",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.7.0-beta.5",
-    "better-auth": "^1.7.0-beta.5"
+    "@better-auth/core": "^1.7.0-beta.7",
+    "better-auth": "^1.7.0-beta.7"
   },
   "peerDependenciesMeta": {
     "electron": {