@better-auth/oauth-provider 1.7.0-beta.9 → 1.7.0-rc.1

package/dist/client-resource.d.mts

@@ -1,4 +1,4 @@
-import { c as ResourceServerMetadata } from "./oauth-Di-k6QeJ.mjs";
+import { c as ResourceServerMetadata } from "./oauth-ScTJEcFV.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
 import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-DO8lmoDw.mjs";
-import { t as PACKAGE_VERSION } from "./version-M87fotrf.mjs";
+import { t as PACKAGE_VERSION } from "./version--aseHtsu.mjs";
 import { t as raiseResourceServerChallenge } from "./resource-challenge-B-cqv4ur.mjs";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { r as oauthProvider } from "./oauth-C7baUP-L.mjs";
+import { r as oauthProvider } from "./oauth-BrNRbP2A.mjs";
 import * as _better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-M87fotrf.mjs";
+import { t as PACKAGE_VERSION } from "./version--aseHtsu.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 //#region src/client.ts
 const oauthProviderClient = () => {

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { A as OAuthProviderExtension, B as StoreTokenType, C as OAuthConsent, D as OAuthOpaqueAccessToken, E as OAuthMetadataExtensionInput, F as OAuthTokenResponse, H as VerificationValue, I as OAuthUserInfoExtensionInput, L as Prompt, M as OAuthResource, N as OAuthResourceInput, O as OAuthOptions, P as OAuthTokenIssueParams, R as SchemaClient, S as OAuthClientResource, T as OAuthExtensionGrantHandlerInput, U as ClientRegistrationRequest, V as StoredAuthorizationQuery, W as ResourceUriSchema, _ as OAuthClaimExtensionInput, a as GrantType, b as OAuthClientAuthenticationResult, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthorizationQuery, h as OAuthAuthenticatedClient, i as Confirmation, j as OAuthRefreshToken, k as OAuthProviderApi, l as TokenEndpointAuthMethod, m as InitialAccessTokenAuthorization, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClientAuthenticationInput, w as OAuthExtensionGrantHandler, x as OAuthClientAuthenticationStrategy, y as OAuthClientAuthenticationRequest, z as Scope } from "./oauth-Di-k6QeJ.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-C7baUP-L.mjs";
+import { A as OAuthProviderExtension, B as StoreTokenType, C as OAuthConsent, D as OAuthOpaqueAccessToken, E as OAuthMetadataExtensionInput, F as OAuthTokenResponse, H as VerificationValue, I as OAuthUserInfoExtensionInput, L as Prompt, M as OAuthResource, N as OAuthResourceInput, O as OAuthOptions, P as OAuthTokenIssueParams, R as SchemaClient, S as OAuthClientResource, T as OAuthExtensionGrantHandlerInput, U as ClientRegistrationRequest, V as StoredAuthorizationQuery, W as ResourceUriSchema, _ as OAuthClaimExtensionInput, a as GrantType, b as OAuthClientAuthenticationResult, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthorizationQuery, h as OAuthAuthenticatedClient, i as Confirmation, j as OAuthRefreshToken, k as OAuthProviderApi, l as TokenEndpointAuthMethod, m as InitialAccessTokenAuthorization, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClientAuthenticationInput, w as OAuthExtensionGrantHandler, x as OAuthClientAuthenticationStrategy, y as OAuthClientAuthenticationRequest, z as Scope } from "./oauth-ScTJEcFV.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-BrNRbP2A.mjs";
 import { getSessionFromCtx } from "better-auth/api";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { C as STANDARD_CLAIM_NAMES, D as getRequestedUserInfoClaims, E as filterClaimsRequestUserInfoClaims, S as STANDARD_CLAIMS, T as claimsRequestParameterSchema, _ as invalidateResourceCache, a as invalidateRefreshFamily, b as resolveResourcePolicy, c as ResourceUriSchema, d as clientRegistrationRequestSchema, f as JWS_ALGORITHMS, g as getResource, h as extractRepeatedResourceFromForm, i as getOAuthProviderApi, l as SafeUrlSchema, m as buildClientResourceLinkId, o as tokenEndpoint, p as assertIdentifierValid, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as isAudienceClaimAllowed, w as getSupportedClaims, x as seedResources, y as logEnforcePerClientResourcesResolution } from "./introspect-Bzbar3iY.mjs";
+import { C as STANDARD_CLAIM_NAMES, D as getRequestedUserInfoClaims, E as filterClaimsRequestUserInfoClaims, S as STANDARD_CLAIMS, T as claimsRequestParameterSchema, _ as invalidateResourceCache, a as invalidateRefreshFamily, b as resolveResourcePolicy, c as ResourceUriSchema, d as clientRegistrationRequestSchema, f as JWS_ALGORITHMS, g as getResource, h as extractRepeatedResourceFromForm, i as getOAuthProviderApi, l as SafeUrlSchema, m as buildClientResourceLinkId, o as tokenEndpoint, p as assertIdentifierValid, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as isAudienceClaimAllowed, w as getSupportedClaims, x as seedResources, y as logEnforcePerClientResourcesResolution } from "./introspect-DvHp2a64.mjs";
 import { D as applyOAuthProviderMetadataExtensions, E as verifyOAuthQueryParams, F as getSupportedGrantTypes, L as isExtensionTokenEndpointAuthMethod, M as getClientDiscoveries, P as getSupportedAuthMethods, R as validateOAuthProviderExtensions, S as storeToken, T as validateClientCredentials, _ as removePromptFromQuery, a as getClient, b as searchParamsToQuery, c as getStoredToken, d as mergeDiscoveryMetadata, g as removeMaxAgeFromQuery, h as parsePrompt, i as extractClientCredentials, j as extendOAuthProvider, l as isPKCERequired, m as parseClientMetadata, n as decryptStoredClientSecret, o as getJwtPlugin, p as parseBearerToken, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, w as toResourceList, x as storeClientSecret, y as resolveSubjectIdentifier } from "./utils-DO8lmoDw.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
 import { n as consumeClientAssertion, r as isPrivateHostname } from "./client-assertion-D-tAYsKC.mjs";
-import { t as PACKAGE_VERSION } from "./version-M87fotrf.mjs";
+import { t as PACKAGE_VERSION } from "./version--aseHtsu.mjs";
 import { t as raiseResourceServerChallenge } from "./resource-challenge-B-cqv4ur.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP } from "@better-auth/core/utils/host";
@@ -2829,6 +2829,18 @@ const schema = {
 			type: "date",
 			required: false
 		},
+		rotatedAt: {
+			type: "date",
+			required: false
+		},
+		rotationReplayResponse: {
+			type: "string",
+			required: false
+		},
+		rotationReplayExpiresAt: {
+			type: "date",
+			required: false
+		},
 		authTime: {
 			type: "date",
 			required: false
@@ -3023,6 +3035,7 @@ const oauthProvider = (options) => {
 		accessTokenExpiresIn: 3600,
 		m2mAccessTokenExpiresIn: 3600,
 		refreshTokenExpiresIn: 2592e3,
+		refreshTokenReuseInterval: 0,
 		allowUnauthenticatedClientRegistration: false,
 		allowDynamicClientRegistration: false,
 		disableJwtPlugin: false,

package/dist/{introspect-Bzbar3iY.mjs → introspect-DvHp2a64.mjs}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
 import { A as collectExtensionUserInfoClaims, C as toAudienceClaim, F as getSupportedGrantTypes, I as hasUserInfoClaimExtension, N as getExtensionGrantHandler, O as collectExtensionAccessTokenClaims, S as storeToken, T as validateClientCredentials, a as getClient, c as getStoredToken, f as normalizeTimestampValue, i as extractClientCredentials, k as collectExtensionIdTokenClaims, l as isPKCERequired, m as parseClientMetadata, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, v as resolveSessionAuthTime, w as toResourceList, y as resolveSubjectIdentifier } from "./utils-DO8lmoDw.mjs";
 import { APIError } from "better-auth/api";
-import { generateRandomString } from "better-auth/crypto";
+import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
 import { logger } from "@better-auth/core/env";
 import * as z from "zod";
@@ -1524,6 +1524,13 @@ async function createRefreshToken(ctx, opts, user, referenceId, authorizationCod
 		})).id,
 		token: await encodeRefreshToken(opts, token, sessionId)
 	};
+	const rotatedAt = /* @__PURE__ */ new Date(iat * 1e3);
+	const rotationUpdate = {
+		revoked: rotatedAt,
+		rotatedAt
+	};
+	const reuseInterval = opts.refreshTokenReuseInterval ?? 0;
+	if (reuseInterval > 0) rotationUpdate.rotationReplayExpiresAt = /* @__PURE__ */ new Date((iat + reuseInterval) * 1e3);
 	if (!await ctx.context.adapter.incrementOne({
 		model: "oauthRefreshToken",
 		where: [{
@@ -1535,7 +1542,7 @@ async function createRefreshToken(ctx, opts, user, referenceId, authorizationCod
 			value: null
 		}],
 		increment: {},
-		set: { revoked: /* @__PURE__ */ new Date(iat * 1e3) }
+		set: rotationUpdate
 	})) throw new APIError("BAD_REQUEST", {
 		error_description: "invalid refresh token",
 		error: "invalid_grant"
@@ -1604,6 +1611,126 @@ async function resolveDpopTokenBinding(ctx, opts, params) {
 		throw error;
 	}
 }
+function normalizeReplayValues(values) {
+	return values ? [...new Set(values)].sort() : void 0;
+}
+function sameReplayValues(left, right) {
+	const normalizedLeft = normalizeReplayValues(left);
+	const normalizedRight = normalizeReplayValues(right);
+	if (normalizedLeft === void 0 || normalizedRight === void 0) return normalizedLeft === normalizedRight;
+	if (normalizedLeft.length !== normalizedRight.length) return false;
+	return normalizedLeft.every((value, index) => value === normalizedRight[index]);
+}
+function confirmationReplayKey(confirmation) {
+	if (!confirmation) return;
+	if ("jkt" in confirmation) return `jkt:${confirmation.jkt}`;
+	return `x5t#S256:${confirmation["x5t#S256"]}`;
+}
+function sameConfirmation(left, right) {
+	return confirmationReplayKey(left) === confirmationReplayKey(right);
+}
+function isConfirmation(value) {
+	if (!value || typeof value !== "object") return false;
+	const confirmation = value;
+	return typeof confirmation.jkt === "string" && confirmation["x5t#S256"] === void 0 || typeof confirmation["x5t#S256"] === "string" && confirmation.jkt === void 0;
+}
+function isTokenType(value) {
+	return value === "Bearer" || value === "DPoP";
+}
+function isOAuthTokenResponse(value) {
+	if (!value || typeof value !== "object") return false;
+	const response = value;
+	return typeof response.access_token === "string" && typeof response.expires_in === "number" && typeof response.expires_at === "number" && isTokenType(response.token_type) && typeof response.scope === "string" && (response.refresh_token === void 0 || typeof response.refresh_token === "string") && (response.id_token === void 0 || typeof response.id_token === "string");
+}
+function isRefreshTokenRotationReplay(value) {
+	if (!value || typeof value !== "object") return false;
+	const replay = value;
+	const request = replay.request;
+	return !!request && Array.isArray(request.effectiveScopes) && request.effectiveScopes.every((scope) => typeof scope === "string") && (request.requestedResources === void 0 || Array.isArray(request.requestedResources) && request.requestedResources.every((resource) => typeof resource === "string")) && (request.confirmation === void 0 || isConfirmation(request.confirmation)) && isOAuthTokenResponse(replay.response);
+}
+function buildRefreshTokenRotationReplayRequest(params) {
+	const requestedResources = normalizeReplayValues(params.requestedResources);
+	return {
+		effectiveScopes: normalizeReplayValues(params.effectiveScopes) ?? [],
+		...requestedResources ? { requestedResources } : {},
+		...params.confirmation ? { confirmation: params.confirmation } : {}
+	};
+}
+function sameRefreshTokenRotationReplayRequest(left, right) {
+	return sameReplayValues(left.effectiveScopes, right.effectiveScopes) && sameReplayValues(left.requestedResources, right.requestedResources) && sameConfirmation(left.confirmation, right.confirmation);
+}
+async function encryptRefreshTokenRotationReplay(ctx, replay) {
+	return symmetricEncrypt({
+		key: ctx.context.secretConfig,
+		data: JSON.stringify(replay)
+	});
+}
+async function decryptRefreshTokenRotationReplay(ctx, value) {
+	const decrypted = await symmetricDecrypt({
+		key: ctx.context.secretConfig,
+		data: value
+	});
+	const parsed = JSON.parse(decrypted);
+	if (!isRefreshTokenRotationReplay(parsed)) return;
+	return parsed;
+}
+function isWithinRefreshTokenReuseInterval(refreshToken) {
+	return !!refreshToken.rotatedAt && !!refreshToken.rotationReplayExpiresAt && refreshToken.rotationReplayExpiresAt >= /* @__PURE__ */ new Date();
+}
+async function storeRefreshTokenRotationReplay(ctx, opts, refreshToken, request, response) {
+	if ((opts.refreshTokenReuseInterval ?? 0) <= 0) return;
+	await ctx.context.adapter.update({
+		model: "oauthRefreshToken",
+		where: [{
+			field: "id",
+			value: refreshToken.id
+		}],
+		update: { rotationReplayResponse: await encryptRefreshTokenRotationReplay(ctx, {
+			request,
+			response
+		}) }
+	});
+}
+async function getRefreshTokenRotationReplay(ctx, refreshToken, request) {
+	if (!isWithinRefreshTokenReuseInterval(refreshToken)) return;
+	if (!refreshToken.rotationReplayResponse) return;
+	try {
+		const replay = await decryptRefreshTokenRotationReplay(ctx, refreshToken.rotationReplayResponse);
+		if (!replay || !sameRefreshTokenRotationReplayRequest(replay.request, request)) return;
+		return replay.response;
+	} catch (error) {
+		ctx.context.logger.error("refresh token rotation replay failed", error);
+		return;
+	}
+}
+async function resolveRefreshTokenRotationReplayRequest(ctx, opts, params) {
+	const iat = Math.floor(Date.now() / 1e3);
+	const grantIssuance = await resolveResourceGrantIssuance(ctx, opts, {
+		clientId: params.client.clientId,
+		requestedScopes: params.scopes,
+		resources: params.resources,
+		refreshToken: params.refreshToken,
+		iat,
+		scopeExpiresAtSeconds: iat + (opts.accessTokenExpiresIn ?? 3600)
+	});
+	const confirmation = await resolveDpopTokenBinding(ctx, opts, {
+		client: params.client,
+		grantIssuance,
+		refreshToken: params.refreshToken
+	});
+	return buildRefreshTokenRotationReplayRequest({
+		effectiveScopes: grantIssuance.effectiveScopes,
+		requestedResources: params.resources,
+		confirmation
+	});
+}
+function replayRefreshTokenRotationResponse(ctx, response) {
+	const now = Math.floor(Date.now() / 1e3);
+	return ctx.json({
+		...response,
+		expires_in: Math.max(0, response.expires_at - now)
+	});
+}
 async function createUserTokens(ctx, opts, params) {
 	const { client, scopes, user, grantType, referenceId, sessionId, nonce, refreshToken: existingRefreshToken, authTime, verificationValue } = params;
 	const iat = Math.floor(Date.now() / 1e3);
@@ -1695,7 +1822,7 @@ async function createUserTokens(ctx, opts, params) {
 		sid: sessionId
 	}, existingRefreshToken, authTime, refreshResources, confirmation, requestedUserInfoClaims) : void 0]);
 	const idToken = isIdToken ? await createIdToken(ctx, opts, user, client, effectiveScopes, nonce, sessionId, authTime, accessToken, additionalIdTokenClaims) : void 0;
-	return ctx.json({
+	const responseBody = {
 		...customFields,
 		...params.tokenResponse ?? {},
 		access_token: accessToken,
@@ -1705,7 +1832,17 @@ async function createUserTokens(ctx, opts, params) {
 		refresh_token: refreshToken?.token,
 		scope: effectiveScopes.join(" "),
 		id_token: idToken
-	});
+	};
+	if (existingRefreshToken?.id && refreshToken?.id) try {
+		await storeRefreshTokenRotationReplay(ctx, opts, existingRefreshToken, buildRefreshTokenRotationReplayRequest({
+			effectiveScopes,
+			requestedResources: params.resources,
+			confirmation
+		}), responseBody);
+	} catch (error) {
+		ctx.context.logger.error("failed to store refresh token rotation replay", error);
+	}
+	return ctx.json(responseBody);
 }
 /** Checks verification value */
 async function checkVerificationValue(ctx, opts, code, client_id, redirect_uri, resource) {
@@ -1948,13 +2085,6 @@ async function handleRefreshTokenGrant(ctx, opts) {
 		error_description: "invalid refresh token",
 		error: "invalid_grant"
 	});
-	if (refreshToken.revoked) {
-		await invalidateRefreshFamily(ctx, client_id, refreshToken.userId);
-		throw new APIError("BAD_REQUEST", {
-			error_description: "invalid refresh token",
-			error: "invalid_grant"
-		});
-	}
 	if (resources && refreshToken.resources && !resources.every((v) => refreshToken.resources?.includes(v))) throw new APIError("BAD_REQUEST", {
 		error_description: "requested resource invalid",
 		error: "invalid_target"
@@ -1969,6 +2099,26 @@ async function handleRefreshTokenGrant(ctx, opts) {
 		});
 	}
 	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, requestedScopes ?? scopes, preVerified, "refresh_token", authMethod);
+	if (refreshToken.revoked) {
+		if (isWithinRefreshTokenReuseInterval(refreshToken)) {
+			const replay = await getRefreshTokenRotationReplay(ctx, refreshToken, await resolveRefreshTokenRotationReplayRequest(ctx, opts, {
+				client,
+				refreshToken,
+				scopes: requestedScopes ?? scopes,
+				resources: resources ?? refreshToken.resources
+			}));
+			if (replay) return replayRefreshTokenRotationResponse(ctx, replay);
+			throw new APIError("BAD_REQUEST", {
+				error_description: "invalid refresh token",
+				error: "invalid_grant"
+			});
+		}
+		await invalidateRefreshFamily(ctx, client_id, refreshToken.userId);
+		throw new APIError("BAD_REQUEST", {
+			error_description: "invalid refresh token",
+			error: "invalid_grant"
+		});
+	}
 	const user = await ctx.context.internalAdapter.findUserById(refreshToken.userId);
 	if (!user) throw new APIError("BAD_REQUEST", {
 		error_description: "user not found",

package/dist/{oauth-C7baUP-L.d.mts → oauth-BrNRbP2A.d.mts}

@@ -1,4 +1,4 @@
-import { C as OAuthConsent, F as OAuthTokenResponse, L as Prompt, M as OAuthResource, O as OAuthOptions, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, z as Scope } from "./oauth-Di-k6QeJ.mjs";
+import { C as OAuthConsent, L as Prompt, M as OAuthResource, O as OAuthOptions, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, z as Scope } from "./oauth-ScTJEcFV.mjs";
 import * as better_call0 from "better-call";
 import * as z from "zod";
 import * as jose from "jose";
@@ -561,7 +561,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, OAuthTokenResponse>;
+    }, {
+      expires_in: number;
+      access_token: string;
+      expires_at: number;
+      token_type: TokenType;
+      refresh_token: string | undefined;
+      scope: string;
+      id_token: string | undefined;
+    }>;
     oauth2Introspect: better_call0.StrictEndpoint<"/oauth2/introspect", {
       method: "POST";
       body: z.ZodObject<{
@@ -2301,6 +2309,18 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "date";
           required: false;
         };
+        rotatedAt: {
+          type: "date";
+          required: false;
+        };
+        rotationReplayResponse: {
+          type: "string";
+          required: false;
+        };
+        rotationReplayExpiresAt: {
+          type: "date";
+          required: false;
+        };
         authTime: {
           type: "date";
           required: false;

package/dist/{oauth-Di-k6QeJ.d.mts → oauth-ScTJEcFV.d.mts}

@@ -358,6 +358,18 @@ declare const schema: {
         type: "date";
         required: false;
       };
+      rotatedAt: {
+        type: "date";
+        required: false;
+      };
+      rotationReplayResponse: {
+        type: "string";
+        required: false;
+      };
+      rotationReplayExpiresAt: {
+        type: "date";
+        required: false;
+      };
       authTime: {
         type: "date";
         required: false;
@@ -1118,6 +1130,18 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @default 2592000 (30 days)
    */
   refreshTokenExpiresIn?: number;
+  /**
+   * Seconds that a rotated refresh token can be reused to receive the same
+   * token response for the same effective scopes, requested resources, and
+   * sender constraint.
+   *
+   * Matching reuse inside this interval is treated as refresh-response replay,
+   * not refresh-token replay. Set to `0` to treat any rotated refresh token
+   * reuse as replay.
+   *
+   * @default 0
+   */
+  refreshTokenReuseInterval?: number;
   /**
    * The amount of time in seconds that the authorization code is valid for.
    *
@@ -2323,9 +2347,25 @@ interface OAuthRefreshToken<Scopes extends readonly Scope[] = InternallySupporte
   expiresAt: Date;
   createdAt: Date;
   /**
-   * When token was revoked. If set, token is considered a replay attack.
+   * When this token stopped being active.
+   *
+   * A token can be revoked by /oauth2/revoke or consumed by rotation. Use
+   * `rotatedAt` to distinguish rotation from explicit revocation.
    */
   revoked?: Date;
+  /**
+   * When this refresh token was consumed by rotation.
+   */
+  rotatedAt?: Date;
+  /**
+   * Encrypted token endpoint response and request fingerprint to replay during
+   * the configured refresh-token reuse interval.
+   */
+  rotationReplayResponse?: string;
+  /**
+   * When the cached rotation response stops being replayable.
+   */
+  rotationReplayExpiresAt?: Date;
   /**
    * The time the user originally authenticated.
    * Persisted so refreshed ID tokens can include a correct `auth_time` claim.

package/dist/{version-M87fotrf.mjs → version--aseHtsu.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.0-beta.9";
+const PACKAGE_VERSION = "1.7.0-rc.1";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.0-beta.9",
+  "version": "1.7.0-rc.1",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -57,21 +57,21 @@
     }
   },
   "dependencies": {
-    "jose": "^6.1.3",
+    "jose": "^6.2.3",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-beta.9",
-    "better-auth": "1.7.0-beta.9"
+    "@better-auth/core": "1.7.0-rc.1",
+    "better-auth": "1.7.0-rc.1"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.6",
-    "@better-auth/core": "^1.7.0-beta.9",
-    "better-auth": "^1.7.0-beta.9"
+    "better-call": "1.3.7",
+    "@better-auth/core": "^1.7.0-rc.1",
+    "better-auth": "^1.7.0-rc.1"
   },
   "scripts": {
     "build": "tsdown",