@better-auth/electron 1.7.0-beta.6 → 1.7.0-beta.8

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
+import { t as PACKAGE_VERSION } from "./version-DPq9tYZW.mjs";
 import { n as isProcessType, r as parseProtocolScheme, t as getChannelPrefixWithDelimiter } from "./utils-DxDKRT6e.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { base64, base64Url } from "@better-auth/utils/base64";

package/dist/index.d.mts

@@ -99,7 +99,7 @@ declare const electron: (options?: ElectronOptions | undefined) => {
             image?: string | null | undefined;
           } & Record<string, any>;
         } | null) => void;
-        socialProviders: better_auth0.UpstreamProvider[];
+        socialProviders: better_auth0.OAuthProvider[];
         authCookies: better_auth0.BetterAuthCookies;
         logger: ReturnType<typeof better_auth0.createLogger>;
         rateLimit: {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
+import { t as PACKAGE_VERSION } from "./version-DPq9tYZW.mjs";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { base64Url } from "@better-auth/utils/base64";

package/dist/preload.d.mts

@@ -757,57 +757,29 @@ type OAuth2UserInfo = {
   emailVerified: boolean;
 };
 /**
- * The result of building a provider authorization URL.
+ * Request metadata available to provider refresh hooks.
  *
- * `requestedScopes` is the effective set of scopes encoded in the URL (the
- * provider's built-in defaults + configured `options.scope` + per-request
- * `scopes`, composed by `resolveRequestedScopes`). Callers persist it so the
- * callback can fall back to the request when the provider omits `scope` from
- * its token response (RFC 6749 §5.1).
+ * The refresh flow may be triggered by endpoints such as `getAccessToken` or
+ * `refreshToken`; this context gives provider hooks access to the triggering
+ * request without exposing the full endpoint implementation surface.
  */
-interface AuthorizationURLResult {
-  url: URL;
-  requestedScopes: string[];
+interface OAuthRefreshContext {
+  headers?: Headers | undefined;
+  request?: Request | undefined;
 }
-/**
- * How much an RP trusts a provider's echoed token-response `scope` when
- * persisting `account.grantedScopes`.
- *
- * - `"full-grant"`: the echo is the user's complete current grant, so the seam
- *   replaces the stored grant with it. This is the only path that may narrow
- *   the grant. Declare it only for providers whose token response reports the
- *   full combined grant, e.g. Google with `include_granted_scopes`.
- * - `"projection"`: the echo is this request's subset, so the seam unions it
- *   onto the stored grant. The safe default for every provider.
- * - `"absent-echo"`: the provider omitted `scope`, so the grant equals what was
- *   requested (RFC 6749 §5.1) and the seam unions the requested set. Resolved
- *   at runtime by the persistence seam, never declared by a provider.
- *
- * @see https://www.rfc-editor.org/rfc/rfc6749#section-5.1
- */
-type GrantAuthority = "full-grant" | "projection" | "absent-echo";
-/**
- * The authority a provider may declare for its own echoed scope. `"absent-echo"`
- * is excluded because it is a runtime condition (an omitted echo), not a
- * provider trait.
- */
-type ProviderGrantAuthority = Exclude<GrantAuthority, "absent-echo">;
-interface UpstreamProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
+interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
   id: LiteralString;
   /**
-   * The path the provider redirects back to, relative to the app base URL,
-   * e.g. `/callback/google`.
-   */
-  callbackPath: string;
-  /**
-   * How the persistence seam treats this provider's echoed token-response
-   * `scope`. Declare `"full-grant"` only when the echo is the user's complete
-   * current grant (e.g. Google with `include_granted_scopes`); otherwise the
-   * echo is unioned onto the stored grant.
+   * Optional path under the resolved per-request `baseURL` where this
+   * provider's OAuth callback handler is mounted. Providers that use the
+   * shared `/callback/<id>` route can omit this.
    *
-   * @default "projection"
+   * Custom paths must start with `/`.
+   *
+   * Endpoints compose `redirectURI = ctx.context.baseURL + callbackPath` per
+   * request, so the provider must not hardcode an origin or `baseURL` here.
    */
-  grantAuthority?: ProviderGrantAuthority | undefined;
+  callbackPath?: string | undefined;
   createAuthorizationURL: (data: {
     state: string;
     codeVerifier: string;
@@ -815,6 +787,12 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    /**
+     * OIDC nonce generated by the redirect initiator and persisted in OAuth
+     * state. Providers that set `requiresIdTokenNonce` must forward this to
+     * the authorization URL as the `nonce` parameter.
+     */
+    idTokenNonce?: string | undefined;
     /**
      * Extra query parameters to append to the authorization URL.
      * Providers forward these to the shared `createAuthorizationURL` helper,
@@ -822,7 +800,7 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
      * before applying them.
      */
     additionalParams?: Record<string, string> | undefined;
-  }) => Awaitable<AuthorizationURLResult>;
+  }) => Awaitable<URL>;
   name: string;
   validateAuthorizationCode: (data: {
     code: string;
@@ -831,6 +809,12 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens | null>;
   getUserInfo: (token: OAuth2Tokens & {
+    /**
+     * OIDC nonce recovered from OAuth state. Providers that required an
+     * ID-token nonce must pass this to `verifyProviderIdToken` before
+     * trusting ID-token claims.
+     */
+    expectedIdTokenNonce?: string | undefined;
     /**
      * The user object from the provider
      * This is only available for some providers like Apple
@@ -847,9 +831,14 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
     data: T;
   } | null>;
   /**
-   * Custom function to refresh a token
+   * Custom function to refresh a token.
+   *
+   * Receives request metadata from the endpoint that triggered the refresh.
+   * Providers that don't need request-scoped data can ignore the second
+   * argument.
    */
-  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  refreshAccessToken?: ((refreshToken: string, ctx?: OAuthRefreshContext) => Promise<OAuth2Tokens>) | undefined;
+  revokeToken?: ((token: string) => Promise<void>) | undefined;
   /**
    * Declarative id_token verification config consumed by the shared
    * `verifyProviderIdToken` verifier. Providers set this instead of implementing a boolean
@@ -862,6 +851,13 @@ interface UpstreamProvider<T extends Record<string, any> = Record<string, any>,
    * against this value to prevent authorization server mix-up attacks.
    */
   issuer?: string | undefined;
+  /**
+   * Require shared OAuth redirect routes to bind ID-token verification to an
+   * authorization request nonce. When true, routes generate `idTokenNonce`,
+   * pass it to `createAuthorizationURL`, persist it in state, and provide it
+   * back to `getUserInfo` as `expectedIdTokenNonce`.
+   */
+  requiresIdTokenNonce?: boolean | undefined;
   /**
    * Disable implicit sign up for new users. When set to true for the provider,
    * sign-in need to be called with with requestSignUp as true to create new users.
@@ -1519,11 +1515,14 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   hd?: string | undefined;
   /**
-   * Enable incremental authorization via Google's `include_granted_scopes`
-   * parameter. When enabled, Google reports the user's full granted scope set
-   * in the token response.
+   * Whether to send `include_granted_scopes=true` to Google's authorization
+   * endpoint, which lets new access tokens cover scopes from prior grants
+   * in addition to the ones requested for this flow. Set to `false` when
+   * each OAuth flow should request only its own scopes.
    *
-   * @default true
+   * Defaults to `true`.
+   *
+   * @see https://developers.google.com/identity/protocols/oauth2/web-server#incrementalAuth
    */
   includeGrantedScopes?: boolean | undefined;
 }
@@ -2396,7 +2395,6 @@ declare const socialProviders: {
   apple: (options: AppleOptions) => {
     id: "apple";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2409,11 +2407,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2433,6 +2429,7 @@ declare const socialProviders: {
     };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2456,7 +2453,6 @@ declare const socialProviders: {
   atlassian: (options: AtlassianOptions) => {
     id: "atlassian";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2470,11 +2466,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2487,6 +2481,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2510,7 +2505,6 @@ declare const socialProviders: {
   cognito: (options: CognitoOptions) => {
     id: "cognito";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2524,11 +2518,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2547,6 +2539,7 @@ declare const socialProviders: {
       maxTokenAge: string;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2570,7 +2563,6 @@ declare const socialProviders: {
   discord: (options: DiscordOptions) => {
     id: "discord";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2583,11 +2575,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2599,6 +2589,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2622,7 +2613,6 @@ declare const socialProviders: {
   facebook: (options: FacebookOptions) => {
     id: "facebook";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2636,11 +2626,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -2666,6 +2654,7 @@ declare const socialProviders: {
     };
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2689,7 +2678,6 @@ declare const socialProviders: {
   figma: (options: FigmaOptions) => {
     id: "figma";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2703,11 +2691,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2720,6 +2706,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2743,7 +2730,6 @@ declare const socialProviders: {
   github: (options: GithubOptions) => {
     id: "github";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2758,11 +2744,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2775,6 +2759,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens | null>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2798,7 +2783,6 @@ declare const socialProviders: {
   microsoft: (options: MicrosoftOptions) => {
     id: "microsoft";
     name: string;
-    callbackPath: string;
     createAuthorizationURL(data: {
       state: string;
       codeVerifier: string;
@@ -2806,11 +2790,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode({
       code,
       codeVerifier,
@@ -2829,6 +2811,7 @@ declare const socialProviders: {
       verifyClaims: (claims: Record<string, unknown>) => boolean;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2853,8 +2836,6 @@ declare const socialProviders: {
   google: (options: GoogleOptions) => {
     id: "google";
     name: string;
-    callbackPath: string;
-    grantAuthority: "full-grant" | "projection";
     createAuthorizationURL({
       state,
       scopes,
@@ -2870,11 +2851,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2894,6 +2873,7 @@ declare const socialProviders: {
       verifyClaims: ((claims: Record<string, unknown>) => boolean) | undefined;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2917,7 +2897,6 @@ declare const socialProviders: {
   huggingface: (options: HuggingFaceOptions) => {
     id: "huggingface";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2931,11 +2910,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -2948,6 +2925,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -2971,7 +2949,6 @@ declare const socialProviders: {
   slack: (options: SlackOptions) => {
     id: "slack";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -2984,11 +2961,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3000,6 +2975,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3023,7 +2999,6 @@ declare const socialProviders: {
   spotify: (options: SpotifyOptions) => {
     id: "spotify";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3037,11 +3012,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3054,6 +3027,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3077,7 +3051,6 @@ declare const socialProviders: {
   twitch: (options: TwitchOptions) => {
     id: "twitch";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3090,11 +3063,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3106,6 +3077,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3129,7 +3101,6 @@ declare const socialProviders: {
   twitter: (options: TwitterOption) => {
     id: "twitter";
     name: string;
-    callbackPath: string;
     createAuthorizationURL(data: {
       state: string;
       codeVerifier: string;
@@ -3137,11 +3108,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3154,6 +3123,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3177,7 +3147,6 @@ declare const socialProviders: {
   dropbox: (options: DropboxOptions) => {
     id: "dropbox";
     name: string;
-    callbackPath: string;
     createAuthorizationURL: ({
       state,
       scopes,
@@ -3191,11 +3160,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }) => Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3208,6 +3175,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3231,7 +3199,6 @@ declare const socialProviders: {
   kick: (options: KickOptions) => {
     id: "kick";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3245,11 +3212,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode({
       code,
       redirectURI,
@@ -3262,6 +3227,7 @@ declare const socialProviders: {
     }): Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3285,7 +3251,6 @@ declare const socialProviders: {
   linear: (options: LinearOptions) => {
     id: "linear";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3299,11 +3264,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3315,6 +3278,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3338,7 +3302,6 @@ declare const socialProviders: {
   linkedin: (options: LinkedInOptions) => {
     id: "linkedin";
     name: string;
-    callbackPath: string;
     createAuthorizationURL: ({
       state,
       scopes,
@@ -3352,11 +3315,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }) => Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3368,6 +3329,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3391,7 +3353,6 @@ declare const socialProviders: {
   gitlab: (options: GitlabOptions) => {
     id: "gitlab";
     name: string;
-    callbackPath: string;
     createAuthorizationURL: ({
       state,
       scopes,
@@ -3406,11 +3367,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }) => Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI,
@@ -3423,6 +3382,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3467,7 +3427,6 @@ declare const socialProviders: {
   tiktok: (options: TiktokOptions) => {
     id: "tiktok";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3480,11 +3439,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): {
-      url: URL;
-      requestedScopes: string[];
-    };
+    }): URL;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3496,6 +3453,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3519,7 +3477,6 @@ declare const socialProviders: {
   reddit: (options: RedditOptions) => {
     id: "reddit";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3532,11 +3489,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3548,6 +3503,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3571,7 +3527,6 @@ declare const socialProviders: {
   roblox: (options: RobloxOptions) => {
     id: "roblox";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3584,11 +3539,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3600,6 +3553,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3623,7 +3577,6 @@ declare const socialProviders: {
   salesforce: (options: SalesforceOptions) => {
     id: "salesforce";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3637,11 +3590,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3654,6 +3605,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3677,7 +3629,6 @@ declare const socialProviders: {
   vk: (options: VkOption) => {
     id: "vk";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3691,11 +3642,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -3709,6 +3658,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(data: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3732,10 +3682,8 @@ declare const socialProviders: {
   zoom: (userOptions: ZoomOptions) => {
     id: "zoom";
     name: string;
-    callbackPath: string;
     createAuthorizationURL: ({
       state,
-      scopes,
       redirectURI,
       codeVerifier,
       additionalParams
@@ -3746,11 +3694,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }) => Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }) => Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI,
@@ -3763,6 +3709,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3785,7 +3732,6 @@ declare const socialProviders: {
   notion: (options: NotionOptions) => {
     id: "notion";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3799,11 +3745,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3815,6 +3759,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3838,7 +3783,6 @@ declare const socialProviders: {
   kakao: (options: KakaoOptions) => {
     id: "kakao";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3851,11 +3795,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3867,6 +3809,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3911,7 +3854,6 @@ declare const socialProviders: {
   naver: (options: NaverOptions) => {
     id: "naver";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3924,11 +3866,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -3940,6 +3880,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -3984,7 +3925,6 @@ declare const socialProviders: {
   line: (options: LineOptions) => {
     id: "line";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -3999,11 +3939,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -4019,6 +3957,7 @@ declare const socialProviders: {
       verify: (token: string, nonce: string | undefined) => Promise<boolean>;
     };
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4063,7 +4002,6 @@ declare const socialProviders: {
   paybin: (options: PaybinOptions) => {
     id: "paybin";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -4078,11 +4016,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -4095,6 +4031,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4118,7 +4055,6 @@ declare const socialProviders: {
   paypal: (options: PayPalOptions) => {
     id: "paypal";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       codeVerifier,
@@ -4131,11 +4067,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       redirectURI
@@ -4156,6 +4090,7 @@ declare const socialProviders: {
       accessTokenExpiresAt: Date | undefined;
     }>);
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4200,7 +4135,6 @@ declare const socialProviders: {
   polar: (options: PolarOptions) => {
     id: "polar";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -4214,11 +4148,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -4231,6 +4163,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4254,7 +4187,6 @@ declare const socialProviders: {
   railway: (options: RailwayOptions) => {
     id: "railway";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -4268,11 +4200,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -4285,6 +4215,7 @@ declare const socialProviders: {
     }) => Promise<OAuth2Tokens>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4308,7 +4239,6 @@ declare const socialProviders: {
   vercel: (options: VercelOptions) => {
     id: "vercel";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -4322,11 +4252,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): Promise<{
-      url: URL;
-      requestedScopes: string[];
-    }>;
+    }): Promise<URL>;
     validateAuthorizationCode: ({
       code,
       codeVerifier,
@@ -4338,6 +4266,7 @@ declare const socialProviders: {
       deviceId?: string | undefined;
     }) => Promise<OAuth2Tokens>;
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4361,7 +4290,6 @@ declare const socialProviders: {
   wechat: (options: WeChatOptions) => {
     id: "wechat";
     name: string;
-    callbackPath: string;
     createAuthorizationURL({
       state,
       scopes,
@@ -4374,11 +4302,9 @@ declare const socialProviders: {
       redirectURI: string;
       display?: string | undefined;
       loginHint?: string | undefined;
+      idTokenNonce?: string | undefined;
       additionalParams?: Record<string, string> | undefined;
-    }): {
-      url: URL;
-      requestedScopes: string[];
-    };
+    }): URL;
     validateAuthorizationCode: ({
       code
     }: {
@@ -4403,6 +4329,7 @@ declare const socialProviders: {
       scopes: string[];
     }>);
     getUserInfo(token: OAuth2Tokens & {
+      expectedIdTokenNonce?: string | undefined;
       user?: {
         name?: {
           firstName?: string;
@@ -4444,7 +4371,7 @@ declare const accountSchema: z.ZodObject<{
   idToken: z.ZodOptional<z.ZodNullable<z.ZodString>>;
   accessTokenExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodDate>>;
   refreshTokenExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodDate>>;
-  grantedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+  scope: z.ZodOptional<z.ZodNullable<z.ZodString>>;
   password: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 type BaseAccount = z.infer<typeof accountSchema>;
@@ -5330,6 +5257,10 @@ type GenericEndpointContext<Options extends BetterAuthOptions = BetterAuthOption
   context: AuthContext<Options>;
 };
 interface InternalAdapter<_Options extends BetterAuthOptions = BetterAuthOptions> {
+  createOAuthUser(user: Omit<User, "id" | "createdAt" | "updatedAt">, account: Omit<Account, "userId" | "id" | "createdAt" | "updatedAt"> & Partial<Account>): Promise<{
+    user: User;
+    account: Account;
+  }>;
   createUser<T extends Record<string, any>>(user: Omit<User, "id" | "createdAt" | "updatedAt" | "emailVerified"> & Partial<User> & Record<string, any>,
   /**
    * Provisioning source. The creation seam adds `action: "create-user"` and
@@ -5508,7 +5439,7 @@ type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> = Plugin
     session: Session & Record<string, any>;
     user: User & Record<string, any>;
   } | null) => void;
-  socialProviders: UpstreamProvider[];
+  socialProviders: OAuthProvider[];
   authCookies: BetterAuthCookies;
   logger: ReturnType<typeof createLogger>;
   rateLimit: {
@@ -5674,7 +5605,7 @@ declare const createAuthMiddleware: {
         image?: string | null | undefined;
       } & Record<string, any>;
     } | null) => void;
-    socialProviders: UpstreamProvider[];
+    socialProviders: OAuthProvider[];
     authCookies: BetterAuthCookies;
     logger: ReturnType<typeof createLogger>;
     rateLimit: {
@@ -5803,7 +5734,7 @@ declare const createAuthMiddleware: {
         image?: string | null | undefined;
       } & Record<string, any>;
     } | null) => void;
-    socialProviders: UpstreamProvider[];
+    socialProviders: OAuthProvider[];
     authCookies: BetterAuthCookies;
     logger: ReturnType<typeof createLogger>;
     rateLimit: {

package/dist/proxy.mjs

@@ -1,4 +1,4 @@
-import { t as PACKAGE_VERSION } from "./version-BTlyLl-N.mjs";
+import { t as PACKAGE_VERSION } from "./version-DPq9tYZW.mjs";
 import { r as parseProtocolScheme } from "./utils-DxDKRT6e.mjs";
 import { parseCookies } from "better-auth/cookies";
 //#region src/proxy.ts

package/dist/{version-BTlyLl-N.mjs → version-DPq9tYZW.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.6";
+const PACKAGE_VERSION = "1.7.0-beta.8";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/electron",
-  "version": "1.7.0-beta.6",
+  "version": "1.7.0-beta.8",
   "description": "Better Auth integration for Electron applications.",
   "type": "module",
   "license": "MIT",
@@ -80,8 +80,8 @@
     "better-sqlite3": "^12.6.2",
     "electron": "^41.2.2",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.6",
-    "better-auth": "1.7.0-beta.6"
+    "@better-auth/core": "1.7.0-beta.8",
+    "better-auth": "1.7.0-beta.8"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
@@ -89,8 +89,8 @@
     "better-call": "1.3.6",
     "conf": "^15.0.2",
     "electron": ">=36.0.0",
-    "@better-auth/core": "^1.7.0-beta.6",
-    "better-auth": "^1.7.0-beta.6"
+    "@better-auth/core": "^1.7.0-beta.8",
+    "better-auth": "^1.7.0-beta.8"
   },
   "peerDependenciesMeta": {
     "electron": {