better-auth 1.2.0-beta.6 → 1.2.0-beta.9

package/dist/{chunk-XKCN2VRG.cjs → chunk-45RBYQKI.cjs}

@@ -32,12 +32,18 @@ var schema = {
 };
 
 // src/plugins/username/index.ts
+function defaultUsernameValidator(username2) {
+  return /^[a-zA-Z0-9_]+$/.test(username2);
+}
 var username = (options) => {
   const ERROR_CODES = {
     INVALID_USERNAME_OR_PASSWORD: "invalid username or password",
     EMAIL_NOT_VERIFIED: "email not verified",
     UNEXPECTED_ERROR: "unexpected error",
-    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another."
+    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another.",
+    USERNAME_TOO_SHORT: "username is too short",
+    USERNAME_TOO_LONG: "username is too long",
+    INVALID_USERNAME: "username is invalid"
   };
   return {
     id: "username",
@@ -85,6 +91,36 @@ var username = (options) => {
           }
         },
         async (ctx) => {
+          if (!ctx.body.username || !ctx.body.password) {
+            ctx.context.logger.error("Username or password not found");
+            throw new betterCall.APIError("UNAUTHORIZED", {
+              message: ERROR_CODES.INVALID_USERNAME_OR_PASSWORD
+            });
+          }
+          const minUsernameLength = options?.minUsernameLength || 3;
+          const maxUsernameLength = options?.maxUsernameLength || 30;
+          if (ctx.body.username.length < minUsernameLength) {
+            ctx.context.logger.error("Username too short", {
+              username: ctx.body.username
+            });
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_SHORT
+            });
+          }
+          if (ctx.body.username.length > maxUsernameLength) {
+            ctx.context.logger.error("Username too long", {
+              username: ctx.body.username
+            });
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_LONG
+            });
+          }
+          const validator = options?.usernameValidator || defaultUsernameValidator;
+          if (!validator(ctx.body.username)) {
+            throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.INVALID_USERNAME
+            });
+          }
           const user = await ctx.context.adapter.findOne({
             model: "user",
             where: [
@@ -166,6 +202,7 @@ var username = (options) => {
               id: user.id,
               email: user.email,
               emailVerified: user.emailVerified,
+              username: user.username,
               name: user.name,
               image: user.image,
               createdAt: user.createdAt,
@@ -180,11 +217,30 @@ var username = (options) => {
       before: [
         {
           matcher(context) {
-            return context.path === "/sign-up/email";
+            return context.path === "/sign-up/email" || context.path === "/update-user";
           },
           handler: chunkN7UWN6ND_cjs.createAuthMiddleware(async (ctx) => {
             const username2 = ctx.body.username;
             if (username2) {
+              const minUsernameLength = options?.minUsernameLength || 3;
+              const maxUsernameLength = options?.maxUsernameLength || 30;
+              if (username2.length < minUsernameLength) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_SHORT
+                });
+              }
+              if (username2.length > maxUsernameLength) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_LONG
+                });
+              }
+              const validator = options?.usernameValidator || defaultUsernameValidator;
+              const valid = await validator(username2);
+              if (!valid) {
+                throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.INVALID_USERNAME
+                });
+              }
               const user = await ctx.context.adapter.findOne({
                 model: "user",
                 where: [

package/dist/{chunk-KAEQXMEV.cjs → chunk-GSEEAIRZ.cjs}

@@ -332,7 +332,7 @@ var getMetadata = (ctx, options) => {
     issuer,
     authorization_endpoint: `${baseURL}/oauth2/authorize`,
     token_endpoint: `${baseURL}/oauth2/token`,
-    userInfo_endpoint: `${baseURL}/oauth2/userinfo`,
+    userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
     jwks_uri: `${baseURL}/jwks`,
     registration_endpoint: `${baseURL}/oauth2/register`,
     scopes_supported: ["openid", "profile", "email", "offline_access"],

package/dist/{chunk-RMPI2YZ3.js → chunk-IQUHEVLH.js}

@@ -330,7 +330,7 @@ var getMetadata = (ctx, options) => {
     issuer,
     authorization_endpoint: `${baseURL}/oauth2/authorize`,
     token_endpoint: `${baseURL}/oauth2/token`,
-    userInfo_endpoint: `${baseURL}/oauth2/userinfo`,
+    userinfo_endpoint: `${baseURL}/oauth2/userinfo`,
     jwks_uri: `${baseURL}/jwks`,
     registration_endpoint: `${baseURL}/oauth2/register`,
     scopes_supported: ["openid", "profile", "email", "offline_access"],

package/dist/{chunk-5AOJMBJI.js → chunk-J6VNT2T4.js}

@@ -24,6 +24,14 @@ var admin = (options) => {
       throw new APIError("UNAUTHORIZED");
     }
     const user = session.user;
+    if (options?.adminUserIds?.includes(user.id)) {
+      return {
+        session: {
+          user,
+          session: session.session
+        }
+      };
+    }
     if (!user.role || (Array.isArray(opts.adminRole) ? !opts.adminRole.includes(user.role) : user.role !== opts.adminRole)) {
       throw new APIError("FORBIDDEN", {
         message: "Only admins can access this endpoint"

package/dist/{chunk-75SPUXMY.cjs → chunk-QNLSMTXF.cjs}

@@ -179,6 +179,9 @@ function getResponse(responses) {
     ...responses
   };
 }
+function toOpenApiPath(path) {
+  return path.split("/").map((part) => part.startsWith(":") ? `{${part.slice(1)}}` : part).join("/");
+}
 async function generator(ctx, options) {
   const baseEndpoints = chunkN7UWN6ND_cjs.getEndpoints(ctx, {
     ...options,
@@ -209,8 +212,9 @@ async function generator(ctx, options) {
   Object.entries(baseEndpoints.api).forEach(([_, value]) => {
     const options2 = value.options;
     if (options2.metadata?.SERVER_ONLY) return;
+    const path = toOpenApiPath(value.path);
     if (options2.method === "GET") {
-      paths[value.path] = {
+      paths[path] = {
         get: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -227,7 +231,7 @@ async function generator(ctx, options) {
     }
     if (options2.method === "POST") {
       const body = getRequestBody(options2);
-      paths[value.path] = {
+      paths[path] = {
         post: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -273,8 +277,9 @@ async function generator(ctx, options) {
     Object.entries(api).forEach(([key, value]) => {
       const options2 = value.options;
       if (options2.metadata?.SERVER_ONLY) return;
+      const path = toOpenApiPath(value.path);
       if (options2.method === "GET") {
-        paths[value.path] = {
+        paths[path] = {
           get: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)
@@ -292,7 +297,7 @@ async function generator(ctx, options) {
         };
       }
       if (options2.method === "POST") {
-        paths[value.path] = {
+        paths[path] = {
           post: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)

package/dist/{chunk-GWJDRQJ3.js → chunk-QQGRNAM2.js}

@@ -177,6 +177,9 @@ function getResponse(responses) {
     ...responses
   };
 }
+function toOpenApiPath(path) {
+  return path.split("/").map((part) => part.startsWith(":") ? `{${part.slice(1)}}` : part).join("/");
+}
 async function generator(ctx, options) {
   const baseEndpoints = getEndpoints(ctx, {
     ...options,
@@ -207,8 +210,9 @@ async function generator(ctx, options) {
   Object.entries(baseEndpoints.api).forEach(([_, value]) => {
     const options2 = value.options;
     if (options2.metadata?.SERVER_ONLY) return;
+    const path = toOpenApiPath(value.path);
     if (options2.method === "GET") {
-      paths[value.path] = {
+      paths[path] = {
         get: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -225,7 +229,7 @@ async function generator(ctx, options) {
     }
     if (options2.method === "POST") {
       const body = getRequestBody(options2);
-      paths[value.path] = {
+      paths[path] = {
         post: {
           tags: ["Default", ...options2.metadata?.openapi?.tags || []],
           description: options2.metadata?.openapi?.description,
@@ -271,8 +275,9 @@ async function generator(ctx, options) {
     Object.entries(api).forEach(([key, value]) => {
       const options2 = value.options;
       if (options2.metadata?.SERVER_ONLY) return;
+      const path = toOpenApiPath(value.path);
       if (options2.method === "GET") {
-        paths[value.path] = {
+        paths[path] = {
           get: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)
@@ -290,7 +295,7 @@ async function generator(ctx, options) {
         };
       }
       if (options2.method === "POST") {
-        paths[value.path] = {
+        paths[path] = {
           post: {
             tags: options2.metadata?.openapi?.tags || [
               plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)

package/dist/{chunk-OALLKKNX.cjs → chunk-SMZIOWVN.cjs}

@@ -26,6 +26,14 @@ var admin = (options) => {
       throw new chunkN7UWN6ND_cjs.APIError("UNAUTHORIZED");
     }
     const user = session.user;
+    if (options?.adminUserIds?.includes(user.id)) {
+      return {
+        session: {
+          user,
+          session: session.session
+        }
+      };
+    }
     if (!user.role || (Array.isArray(opts.adminRole) ? !opts.adminRole.includes(user.role) : user.role !== opts.adminRole)) {
       throw new chunkN7UWN6ND_cjs.APIError("FORBIDDEN", {
         message: "Only admins can access this endpoint"

package/dist/{chunk-FX2ZHENM.js → chunk-TZ34QTAV.js}

@@ -30,12 +30,18 @@ var schema = {
 };
 
 // src/plugins/username/index.ts
+function defaultUsernameValidator(username2) {
+  return /^[a-zA-Z0-9_]+$/.test(username2);
+}
 var username = (options) => {
   const ERROR_CODES = {
     INVALID_USERNAME_OR_PASSWORD: "invalid username or password",
     EMAIL_NOT_VERIFIED: "email not verified",
     UNEXPECTED_ERROR: "unexpected error",
-    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another."
+    USERNAME_IS_ALREADY_TAKEN: "username is already taken. please try another.",
+    USERNAME_TOO_SHORT: "username is too short",
+    USERNAME_TOO_LONG: "username is too long",
+    INVALID_USERNAME: "username is invalid"
   };
   return {
     id: "username",
@@ -83,6 +89,36 @@ var username = (options) => {
           }
         },
         async (ctx) => {
+          if (!ctx.body.username || !ctx.body.password) {
+            ctx.context.logger.error("Username or password not found");
+            throw new APIError("UNAUTHORIZED", {
+              message: ERROR_CODES.INVALID_USERNAME_OR_PASSWORD
+            });
+          }
+          const minUsernameLength = options?.minUsernameLength || 3;
+          const maxUsernameLength = options?.maxUsernameLength || 30;
+          if (ctx.body.username.length < minUsernameLength) {
+            ctx.context.logger.error("Username too short", {
+              username: ctx.body.username
+            });
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_SHORT
+            });
+          }
+          if (ctx.body.username.length > maxUsernameLength) {
+            ctx.context.logger.error("Username too long", {
+              username: ctx.body.username
+            });
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.USERNAME_TOO_LONG
+            });
+          }
+          const validator = options?.usernameValidator || defaultUsernameValidator;
+          if (!validator(ctx.body.username)) {
+            throw new APIError("UNPROCESSABLE_ENTITY", {
+              message: ERROR_CODES.INVALID_USERNAME
+            });
+          }
           const user = await ctx.context.adapter.findOne({
             model: "user",
             where: [
@@ -164,6 +200,7 @@ var username = (options) => {
               id: user.id,
               email: user.email,
               emailVerified: user.emailVerified,
+              username: user.username,
               name: user.name,
               image: user.image,
               createdAt: user.createdAt,
@@ -178,11 +215,30 @@ var username = (options) => {
       before: [
         {
           matcher(context) {
-            return context.path === "/sign-up/email";
+            return context.path === "/sign-up/email" || context.path === "/update-user";
           },
           handler: createAuthMiddleware(async (ctx) => {
             const username2 = ctx.body.username;
             if (username2) {
+              const minUsernameLength = options?.minUsernameLength || 3;
+              const maxUsernameLength = options?.maxUsernameLength || 30;
+              if (username2.length < minUsernameLength) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_SHORT
+                });
+              }
+              if (username2.length > maxUsernameLength) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.USERNAME_TOO_LONG
+                });
+              }
+              const validator = options?.usernameValidator || defaultUsernameValidator;
+              const valid = await validator(username2);
+              if (!valid) {
+                throw new APIError("UNPROCESSABLE_ENTITY", {
+                  message: ERROR_CODES.INVALID_USERNAME
+                });
+              }
               const user = await ctx.context.adapter.findOne({
                 model: "user",
                 where: [

package/dist/{chunk-LIGJVOZ4.cjs → chunk-WLOSPOQJ.cjs}

@@ -3,7 +3,7 @@
 var chunkN7UWN6ND_cjs = require('./chunk-N7UWN6ND.cjs');
 var chunkV6HE2MP7_cjs = require('./chunk-V6HE2MP7.cjs');
 var zod = require('zod');
-var fetch = require('@better-fetch/fetch');
+var jose = require('jose');
 
 // src/utils/boolean.ts
 function toBoolean(value) {
@@ -55,59 +55,80 @@ var oneTap = (options) => ({
       },
       async (ctx) => {
         const { idToken } = ctx.body;
-        const { data, error } = await fetch.betterFetch("https://oauth2.googleapis.com/tokeninfo?id_token=" + idToken);
-        if (error) {
-          return ctx.json({
-            error: "Invalid token"
+        let payload;
+        try {
+          const JWKS = jose.createRemoteJWKSet(
+            new URL("https://www.googleapis.com/oauth2/v3/certs")
+          );
+          const { payload: verifiedPayload } = await jose.jwtVerify(
+            idToken,
+            JWKS,
+            {
+              issuer: ["https://accounts.google.com", "accounts.google.com"],
+              audience: options?.clientId || ctx.context.options.socialProviders?.google?.clientId
+            }
+          );
+          payload = verifiedPayload;
+        } catch (error) {
+          throw new chunkN7UWN6ND_cjs.APIError("BAD_REQUEST", {
+            message: "invalid id token"
           });
         }
-        const user = await ctx.context.internalAdapter.findUserByEmail(
-          data.email
-        );
+        const { email, email_verified, name, picture, sub } = payload;
+        if (!email) {
+          return ctx.json({ error: "Email not available in token" });
+        }
+        const user = await ctx.context.internalAdapter.findUserByEmail(email);
         if (!user) {
           if (options?.disableSignup) {
             throw new chunkN7UWN6ND_cjs.APIError("BAD_GATEWAY", {
               message: "User not found"
             });
           }
-          const user2 = await ctx.context.internalAdapter.createOAuthUser(
+          const newUser = await ctx.context.internalAdapter.createOAuthUser(
             {
-              email: data.email,
-              emailVerified: toBoolean(data.email_verified),
-              name: data.name,
-              image: data.picture
+              email,
+              emailVerified: typeof email_verified === "boolean" ? email_verified : toBoolean(email_verified),
+              name,
+              image: picture
             },
             {
               providerId: "google",
-              accountId: data.sub
+              accountId: sub
             }
           );
-          if (!user2) {
+          if (!newUser) {
             throw new chunkN7UWN6ND_cjs.APIError("INTERNAL_SERVER_ERROR", {
               message: "Could not create user"
             });
           }
           const session2 = await ctx.context.internalAdapter.createSession(
-            user2?.user.id,
+            newUser.user.id,
             ctx.request
           );
           await chunkV6HE2MP7_cjs.setSessionCookie(ctx, {
-            user: user2.user,
+            user: newUser.user,
             session: session2
           });
           return ctx.json({
             token: session2.token,
             user: {
-              id: user2.user.id,
-              email: user2.user.email,
-              emailVerified: user2.user.emailVerified,
-              name: user2.user.name,
-              image: user2.user.image,
-              createdAt: user2.user.createdAt,
-              updatedAt: user2.user.updatedAt
+              id: newUser.user.id,
+              email: newUser.user.email,
+              emailVerified: newUser.user.emailVerified,
+              name: newUser.user.name,
+              image: newUser.user.image,
+              createdAt: newUser.user.createdAt,
+              updatedAt: newUser.user.updatedAt
             }
           });
         }
+        const account = await ctx.context.internalAdapter.findAccount(sub);
+        if (!account) {
+          throw new chunkN7UWN6ND_cjs.APIError("UNAUTHORIZED", {
+            message: "Google sub doesn't match"
+          });
+        }
         const session = await ctx.context.internalAdapter.createSession(
           user.user.id,
           ctx.request

package/dist/{chunk-V56HFQQX.js → chunk-YHW4KODD.js}

@@ -1,7 +1,7 @@
 import { createAuthEndpoint, APIError } from './chunk-SCXZXQTZ.js';
 import { setSessionCookie } from './chunk-QQGZ3XGI.js';
 import { z } from 'zod';
-import { betterFetch } from '@better-fetch/fetch';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
 
 // src/utils/boolean.ts
 function toBoolean(value) {
@@ -53,59 +53,80 @@ var oneTap = (options) => ({
       },
       async (ctx) => {
         const { idToken } = ctx.body;
-        const { data, error } = await betterFetch("https://oauth2.googleapis.com/tokeninfo?id_token=" + idToken);
-        if (error) {
-          return ctx.json({
-            error: "Invalid token"
+        let payload;
+        try {
+          const JWKS = createRemoteJWKSet(
+            new URL("https://www.googleapis.com/oauth2/v3/certs")
+          );
+          const { payload: verifiedPayload } = await jwtVerify(
+            idToken,
+            JWKS,
+            {
+              issuer: ["https://accounts.google.com", "accounts.google.com"],
+              audience: options?.clientId || ctx.context.options.socialProviders?.google?.clientId
+            }
+          );
+          payload = verifiedPayload;
+        } catch (error) {
+          throw new APIError("BAD_REQUEST", {
+            message: "invalid id token"
           });
         }
-        const user = await ctx.context.internalAdapter.findUserByEmail(
-          data.email
-        );
+        const { email, email_verified, name, picture, sub } = payload;
+        if (!email) {
+          return ctx.json({ error: "Email not available in token" });
+        }
+        const user = await ctx.context.internalAdapter.findUserByEmail(email);
         if (!user) {
           if (options?.disableSignup) {
             throw new APIError("BAD_GATEWAY", {
               message: "User not found"
             });
           }
-          const user2 = await ctx.context.internalAdapter.createOAuthUser(
+          const newUser = await ctx.context.internalAdapter.createOAuthUser(
             {
-              email: data.email,
-              emailVerified: toBoolean(data.email_verified),
-              name: data.name,
-              image: data.picture
+              email,
+              emailVerified: typeof email_verified === "boolean" ? email_verified : toBoolean(email_verified),
+              name,
+              image: picture
             },
             {
               providerId: "google",
-              accountId: data.sub
+              accountId: sub
             }
           );
-          if (!user2) {
+          if (!newUser) {
             throw new APIError("INTERNAL_SERVER_ERROR", {
               message: "Could not create user"
             });
           }
           const session2 = await ctx.context.internalAdapter.createSession(
-            user2?.user.id,
+            newUser.user.id,
             ctx.request
           );
           await setSessionCookie(ctx, {
-            user: user2.user,
+            user: newUser.user,
             session: session2
           });
           return ctx.json({
             token: session2.token,
             user: {
-              id: user2.user.id,
-              email: user2.user.email,
-              emailVerified: user2.user.emailVerified,
-              name: user2.user.name,
-              image: user2.user.image,
-              createdAt: user2.user.createdAt,
-              updatedAt: user2.user.updatedAt
+              id: newUser.user.id,
+              email: newUser.user.email,
+              emailVerified: newUser.user.emailVerified,
+              name: newUser.user.name,
+              image: newUser.user.image,
+              createdAt: newUser.user.createdAt,
+              updatedAt: newUser.user.updatedAt
             }
           });
         }
+        const account = await ctx.context.internalAdapter.findAccount(sub);
+        if (!account) {
+          throw new APIError("UNAUTHORIZED", {
+            message: "Google sub doesn't match"
+          });
+        }
         const session = await ctx.context.internalAdapter.createSession(
           user.user.id,
           ctx.request

package/dist/client/plugins.cjs

@@ -8,6 +8,7 @@ var chunkKIQWU6Z4_cjs = require('../chunk-KIQWU6Z4.cjs');
 require('../chunk-U4I57HJ4.cjs');
 require('../chunk-S5UORXJH.cjs');
 require('../chunk-CCKQSGIR.cjs');
+var chunkG2LZ73E2_cjs = require('../chunk-G2LZ73E2.cjs');
 require('../chunk-VXYIYABQ.cjs');
 var chunkPEZRSDZS_cjs = require('../chunk-PEZRSDZS.cjs');
 var nanostores = require('nanostores');
@@ -235,26 +236,58 @@ var oneTapClient = (options) => {
           const { autoSelect, cancelOnTapOutside, context } = opts ?? {};
           const contextValue = context ?? options.context ?? "signin";
           await loadGoogleScript();
-          await new Promise((resolve) => {
+          await new Promise((resolve, reject) => {
+            let isResolved = false;
+            const baseDelay = options.promptOptions?.baseDelay ?? 1e3;
+            const maxAttempts = options.promptOptions?.maxAttempts ?? 5;
             window.google?.accounts.id.initialize({
               client_id: options.clientId,
               callback: async (response) => {
-                await $fetch("/one-tap/callback", {
-                  method: "POST",
-                  body: { idToken: response.credential },
-                  ...opts?.fetchOptions,
-                  ...fetchOptions
-                });
-                if (!opts?.fetchOptions && !fetchOptions || opts?.callbackURL) {
-                  window.location.href = opts?.callbackURL ?? "/";
+                isResolved = true;
+                try {
+                  await $fetch("/one-tap/callback", {
+                    method: "POST",
+                    body: { idToken: response.credential },
+                    ...opts?.fetchOptions,
+                    ...fetchOptions
+                  });
+                  if (!opts?.fetchOptions && !fetchOptions || opts?.callbackURL) {
+                    window.location.href = opts?.callbackURL ?? "/";
+                  }
+                  resolve();
+                } catch (error) {
+                  console.error("Error during One Tap callback:", error);
+                  reject(error);
                 }
-                resolve();
               },
               auto_select: autoSelect,
               cancel_on_tap_outside: cancelOnTapOutside,
-              context: contextValue
+              context: contextValue,
+              nonce: chunkG2LZ73E2_cjs.generateRandomString(16),
+              ...options.additionalOptions
             });
-            window.google?.accounts.id.prompt();
+            const handlePrompt = (attempt) => {
+              if (isResolved) return;
+              window.google?.accounts.id.prompt((notification) => {
+                if (isResolved) return;
+                if (notification.isDismissedMoment && notification.isDismissedMoment()) {
+                  if (attempt < maxAttempts) {
+                    const delay = Math.pow(2, attempt) * baseDelay;
+                    setTimeout(() => handlePrompt(attempt + 1), delay);
+                  } else {
+                    opts?.onPromptNotification?.(notification);
+                  }
+                } else if (notification.isSkippedMoment && notification.isSkippedMoment()) {
+                  if (attempt < maxAttempts) {
+                    const delay = Math.pow(2, attempt) * baseDelay;
+                    setTimeout(() => handlePrompt(attempt + 1), delay);
+                  } else {
+                    opts?.onPromptNotification?.(notification);
+                  }
+                }
+              });
+            };
+            handlePrompt(0);
           });
         } catch (error) {
           console.error("Error during Google One Tap flow:", error);