better-auth 1.8.0-beta.6 → 1.8.0-beta.8

package/dist/api/index.d.mts

@@ -1,6 +1,7 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
 import "../types/index.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
 import "../index.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
@@ -11,6 +12,7 @@ import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refre
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
 import { error } from "./routes/error.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./routes/id-token-nonce.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
@@ -1664,6 +1666,38 @@ export declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awai
       url: string;
       redirect: boolean;
     }>;
+    readonly issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        provider: import("zod").ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, import("zod/v4/core").$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      nonce: {
+                        type: "string";
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      nonce: string;
+    }>;
     readonly listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
       method: "GET";
       use: Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -3678,6 +3712,38 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
       url: string;
       redirect: boolean;
     }>;
+    readonly issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        provider: import("zod").ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, import("zod/v4/core").$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      nonce: {
+                        type: "string";
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      nonce: string;
+    }>;
     readonly listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
       method: "GET";
       use: Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -4048,4 +4114,4 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
   } extends (infer T_2) ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K]; } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, consumeIssuedIdTokenNonce, consumeNonce, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -5,6 +5,8 @@ import { onRequestRateLimit } from "./rate-limiter/index.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./routes/id-token-nonce.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -134,6 +136,7 @@ function getEndpoints(ctx, options) {
 		revokeSessions,
 		revokeOtherSessions,
 		linkSocialAccount,
+		issueIdTokenNonce,
 		listUserAccounts,
 		deleteUserCallback,
 		unlinkAccount,
@@ -222,4 +225,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, consumeIssuedIdTokenNonce, consumeNonce, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/routes/account.mjs

@@ -11,6 +11,7 @@ import { toBoolean } from "../../utils/boolean.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { consumeIssuedIdTokenNonce } from "./id-token-nonce.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -168,6 +169,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);
 		}
 		const { token, nonce } = c.body.idToken;
+		await consumeIssuedIdTokenNonce(c, provider, nonce);
 		if (!await verifyProviderIdToken(provider, token, nonce, c)) {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);

package/dist/api/routes/id-token-nonce.d.mts

@@ -0,0 +1,85 @@
+import { GenericEndpointContext } from "@better-auth/core";
+import { OAuthProvider } from "@better-auth/core/oauth2";
+import * as z from "zod";
+//#region src/api/routes/id-token-nonce.d.ts
+/**
+ * Store a new single-use nonce under `scope` and return it. It expires after
+ * five minutes.
+ */
+export declare function issueNonce(ctx: GenericEndpointContext, scope: string): Promise<string>;
+/**
+ * Consume a nonce that {@link issueNonce} stored under `scope`. Throws
+ * `INVALID_ID_TOKEN_NONCE` when it is missing, malformed, unknown, expired, or
+ * already used. Call it before verifying the token, so a failed attempt burns
+ * the nonce too.
+ */
+export declare function consumeNonce(ctx: GenericEndpointContext, scope: string, nonce: string | undefined): Promise<void>;
+/** OpenAPI responses for an endpoint that returns `{ nonce }` from {@link issueNonce}. */
+export declare const issuedNonceResponses: {
+  200: {
+    description: string;
+    content: {
+      "application/json": {
+        schema: {
+          type: "object";
+          properties: {
+            nonce: {
+              type: "string";
+            };
+          };
+          required: string[];
+        };
+      };
+    };
+  };
+};
+type ProviderWithOptions = Pick<OAuthProvider, "id" | "options">;
+/**
+ * Consume the issued nonce presented with a client-submitted ID token, from
+ * `/sign-in/social` or `/link-social`. A no-op for providers without
+ * `requireIssuedIdTokenNonce`.
+ */
+export declare function consumeIssuedIdTokenNonce(ctx: GenericEndpointContext, provider: ProviderWithOptions, nonce: string | undefined): Promise<void>;
+/**
+ * ### Endpoint
+ *
+ * POST `/id-token/nonce`
+ *
+ * Issues a single-use nonce for a client to pass to the provider's SDK before
+ * submitting the resulting ID token to `/sign-in/social` or `/link-social`.
+ * Only available for providers that set `requireIssuedIdTokenNonce`.
+ */
+export declare const issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+  method: "POST";
+  body: z.ZodObject<{
+    provider: z.ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, z.core.$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+  }, z.core.$strip>;
+  metadata: {
+    noStore: boolean;
+    openapi: {
+      description: string;
+      responses: {
+        200: {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  nonce: {
+                    type: "string";
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  nonce: string;
+}>;
+//#endregion
+export {};

package/dist/api/routes/id-token-nonce.mjs

@@ -0,0 +1,80 @@
+import { generateRandomString } from "../../crypto/random.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
+import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { SocialProviderListEnum } from "@better-auth/core/social-providers";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/api/routes/id-token-nonce.ts
+const ISSUED_NONCE_EXPIRES_IN_MS = 3e5;
+const ISSUED_NONCE_LENGTH = 32;
+const ISSUED_NONCE_PATTERN = new RegExp(`^[a-zA-Z0-9]{${ISSUED_NONCE_LENGTH}}$`);
+/**
+* Store a new single-use nonce under `scope` and return it. It expires after
+* five minutes.
+*/
+async function issueNonce(ctx, scope) {
+	const nonce = generateRandomString(ISSUED_NONCE_LENGTH, "a-z", "A-Z", "0-9");
+	await ctx.context.internalAdapter.createVerificationValue({
+		identifier: `${scope}:${nonce}`,
+		value: scope,
+		expiresAt: new Date(Date.now() + ISSUED_NONCE_EXPIRES_IN_MS)
+	});
+	return nonce;
+}
+/**
+* Consume a nonce that {@link issueNonce} stored under `scope`. Throws
+* `INVALID_ID_TOKEN_NONCE` when it is missing, malformed, unknown, expired, or
+* already used. Call it before verifying the token, so a failed attempt burns
+* the nonce too.
+*/
+async function consumeNonce(ctx, scope, nonce) {
+	if (!(nonce && ISSUED_NONCE_PATTERN.test(nonce) ? await ctx.context.internalAdapter.consumeVerificationValue(`${scope}:${nonce}`) : null)) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_ID_TOKEN_NONCE);
+}
+/** OpenAPI responses for an endpoint that returns `{ nonce }` from {@link issueNonce}. */
+const issuedNonceResponses = { 200: {
+	description: "Success",
+	content: { "application/json": { schema: {
+		type: "object",
+		properties: { nonce: { type: "string" } },
+		required: ["nonce"]
+	} } }
+} };
+const idTokenNonceScope = (providerId) => `id-token-nonce:${providerId}`;
+const requiresIssuedNonce = (provider) => provider.options?.requireIssuedIdTokenNonce === true;
+/**
+* Consume the issued nonce presented with a client-submitted ID token, from
+* `/sign-in/social` or `/link-social`. A no-op for providers without
+* `requireIssuedIdTokenNonce`.
+*/
+async function consumeIssuedIdTokenNonce(ctx, provider, nonce) {
+	if (!requiresIssuedNonce(provider)) return;
+	await consumeNonce(ctx, idTokenNonceScope(provider.id), nonce);
+}
+/**
+* ### Endpoint
+*
+* POST `/id-token/nonce`
+*
+* Issues a single-use nonce for a client to pass to the provider's SDK before
+* submitting the resulting ID token to `/sign-in/social` or `/link-social`.
+* Only available for providers that set `requireIssuedIdTokenNonce`.
+*/
+const issueIdTokenNonce = createAuthEndpoint("/id-token/nonce", {
+	method: "POST",
+	body: z.object({ provider: SocialProviderListEnum }),
+	metadata: {
+		noStore: true,
+		openapi: {
+			description: "Issue a single-use nonce to bind a provider ID token to one sign-in or account-linking request",
+			responses: issuedNonceResponses
+		}
+	}
+}, async (ctx) => {
+	const provider = await getAwaitableValue(ctx.context.socialProviders, { value: ctx.body.provider });
+	if (!provider) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.PROVIDER_NOT_FOUND);
+	if (!requiresIssuedNonce(provider)) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.ID_TOKEN_NONCE_NOT_ENABLED);
+	const nonce = await issueNonce(ctx, idTokenNonceScope(provider.id));
+	return ctx.json({ nonce });
+});
+//#endregion
+export { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses };

package/dist/api/routes/index.d.mts

@@ -2,6 +2,7 @@ import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refre
 import { callbackOAuth } from "./callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./email-verification.mjs";
 import { error } from "./error.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./id-token-nonce.mjs";
 import { ok } from "./ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./password.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
@@ -10,4 +11,4 @@ import { signOut } from "./sign-out.mjs";
 import { signUpEmail } from "./sign-up.mjs";
 import { updateSession } from "./update-session.mjs";
 import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./update-user.mjs";
-export { accountInfo, callbackOAuth, changeEmail, changePassword, createEmailVerificationToken, deleteUser, deleteUserCallback, error, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { accountInfo, callbackOAuth, changeEmail, changePassword, consumeIssuedIdTokenNonce, consumeNonce, createEmailVerificationToken, deleteUser, deleteUserCallback, error, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/routes/sign-in.mjs

@@ -7,6 +7,7 @@ import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { consumeIssuedIdTokenNonce } from "./id-token-nonce.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { assertPasswordNotTooLong } from "../../utils/password.mjs";
@@ -157,6 +158,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);
 		}
 		const { token, nonce } = c.body.idToken;
+		await consumeIssuedIdTokenNonce(c, provider, nonce);
 		if (!await verifyProviderIdToken(provider, token, nonce, c)) {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);

package/dist/client/proxy.mjs

@@ -1,14 +1,7 @@
 import { isAtom } from "../utils/is-atom.mjs";
 import { toKebabCase } from "@better-auth/core/utils/string";
+import { isPayloadMethod } from "@better-fetch/fetch";
 //#region src/client/proxy.ts
-function getMethod(path, knownPathMethods, args) {
-	const method = knownPathMethods[path];
-	const { fetchOptions, query: _query, ...body } = args || {};
-	if (method) return method;
-	if (fetchOptions?.method) return fetchOptions.method;
-	if (body && Object.keys(body).length > 0) return "POST";
-	return "GET";
-}
 function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomListeners) {
 	function createProxy(path = []) {
 		return new Proxy(function() {}, {
@@ -35,13 +28,13 @@ function createDynamicPathProxy(routes, client, knownPathMethods, atoms, atomLis
 					...fetchOptions,
 					...argFetchOptions
 				};
-				const method = getMethod(routePath, knownPathMethods, arg);
+				const method = knownPathMethods[routePath] || options.method || (Object.keys(body).length > 0 ? "POST" : "GET");
 				return await client(routePath, {
 					...options,
-					body: method === "GET" ? void 0 : {
+					body: isPayloadMethod(method) ? {
 						...body,
 						...options?.body || {}
-					},
+					} : void 0,
 					query: query || options?.query,
 					method,
 					async onSuccess(context) {

package/dist/db/get-migration.mjs

@@ -1,7 +1,7 @@
 import { buildSchema } from "./get-schema.mjs";
 import { createLogger } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
-import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
+import { createKyselyAdapter, getMssqlSchema, getPostgresSchema, introspectPostgresTables, toIntrospectedTables, toPhysicalSchema } from "@better-auth/kysely-adapter";
 import { initGetFieldName, initGetModelName } from "@better-auth/core/db/adapter";
 import { diffSchema, formatSchemaFinding, getDatabaseFieldIndexName, getDatabaseIndexStringLength, getPortableDatabaseIdentifierKey, invalidateSchemaChecks } from "@better-auth/core/db/internal";
 import { sql } from "kysely";
@@ -354,9 +354,8 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		logger.error("Only kysely adapter is supported for migrations. You can use `generate` command to generate the schema, if you're using a different adapter.");
 		process.exit(1);
 	}
-	const allTableMetadata = await db.introspection.getTables();
 	let target;
-	let tableMetadata = allTableMetadata;
+	let tableMetadata;
 	switch (dbType) {
 		case "postgres": {
 			const schema = schemaName ?? await getPostgresSchema(db);
@@ -373,11 +372,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 			} catch (error) {
 				logger.debug(`Could not verify schema existence: ${error instanceof Error ? error.message : String(error)}`);
 			}
-			/**
-			* Kysely 0.28 does not expose `isForeign`, while 0.29 adds foreign table metadata.
-			* @see https://github.com/kysely-org/kysely/pull/1494
-			*/
-			tableMetadata = allTableMetadata.filter((table) => table.schema === schema && !table.isView && !("isForeign" in table && table.isForeign));
+			tableMetadata = (await introspectPostgresTables(db, [schema])).filter((table) => !table.isView && !table.isForeign);
 			logger.debug(`Found ${tableMetadata.length} table(s) in schema '${schema}': ${tableMetadata.map((table) => table.name).join(", ") || "(none)"}`);
 			break;
 		}
@@ -388,15 +383,18 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 				schema
 			};
 			logger.debug(`SQL Server migration: Using schema '${schema}' (from the current user's default schema)`);
-			tableMetadata = allTableMetadata.filter((table) => table.schema === schema);
+			tableMetadata = (await db.introspection.getTables()).filter((table) => table.schema === schema);
 			break;
 		}
 		case "mysql":
 			target = { type: "mysql" };
+			tableMetadata = await db.introspection.getTables();
 			break;
-		case "sqlite": target = { type: "sqlite" };
+		case "sqlite":
+			target = { type: "sqlite" };
+			tableMetadata = await db.introspection.getTables();
 	}
-	const databaseIndexMap = await getDatabaseIndexMap(db, target, allTableMetadata.map((table) => table.name), introspectIndexes);
+	const databaseIndexMap = await getDatabaseIndexMap(db, target, tableMetadata.map((table) => table.name), introspectIndexes);
 	const databaseColumnBounds = await getDatabaseColumnBounds(db, target);
 	const schemaProblems = diffSchema(toPhysicalSchema(db, betterAuthSchema), toIntrospectedTables(tableMetadata)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "database"));
 	const toBeCreated = [];

package/dist/db/internal-adapter.mjs

@@ -79,6 +79,16 @@ const createInternalAdapter = (adapter, ctx) => {
 		const activeSessions = await secondaryStorage.get(`active-sessions-${userId}`);
 		return activeSessions ? safeJSONParse(activeSessions) || [] : [];
 	}
+	async function setActiveSessionReferences(userId, sessionReferences, now) {
+		if (!secondaryStorage) return;
+		const sorted = [...sessionReferences].sort((a, b) => a.expiresAt - b.expiresAt);
+		const ttl = getTTLSeconds(sorted.at(-1)?.expiresAt ?? 0, now);
+		if (ttl > 0) {
+			await secondaryStorage.set(`active-sessions-${userId}`, JSON.stringify(sorted), ttl);
+			return;
+		}
+		await secondaryStorage.delete(`active-sessions-${userId}`);
+	}
 	const revokedBeforeKey = (userId) => `revoked-sessions-before-${userId}`;
 	const revokedBeforeTTL = Math.max(sessionExpiration, 86400, Number(options.plugins?.find((plugin) => plugin.id === "admin")?.options?.impersonationSessionDuration) || 0);
 	async function isRevokedSession(session, revokedBeforeByUser) {
@@ -93,17 +103,9 @@ const createInternalAdapter = (adapter, ctx) => {
 		await secondaryStorage.set(revokedBeforeKey(userId), String(Math.max(revokedAt, previousRevokedBefore || 0)), revokedBeforeTTL);
 		const deletedTokens = new Set(sessionReferences.map((session) => session.token));
 		for (const token of deletedTokens) await secondaryStorage.delete(token);
-		const activeSessionsKey = `active-sessions-${userId}`;
 		const currentSessionReferences = await getActiveSessionReferences(userId);
 		const now = Date.now();
-		const remainingSessionReferences = currentSessionReferences.filter((session) => session.expiresAt > now && !deletedTokens.has(session.token));
-		remainingSessionReferences.sort((a, b) => a.expiresAt - b.expiresAt);
-		const furthestExpiration = remainingSessionReferences.at(-1)?.expiresAt;
-		if (furthestExpiration) {
-			await secondaryStorage.set(activeSessionsKey, JSON.stringify(remainingSessionReferences), getTTLSeconds(furthestExpiration, now));
-			return;
-		}
-		await secondaryStorage.delete(activeSessionsKey);
+		await setActiveSessionReferences(userId, currentSessionReferences.filter((session) => session.expiresAt > now && !deletedTokens.has(session.token)), now);
 	}
 	async function queueCachedUserSessionDeletion(userId, sessionReferences) {
 		if (!secondaryStorage) return;
@@ -129,6 +131,20 @@ const createInternalAdapter = (adapter, ctx) => {
 			if (verificationConsumeLocks.get(key) === next) verificationConsumeLocks.delete(key);
 		}
 	}
+	async function deleteExpiredVerifications() {
+		if (options.verification?.disableCleanup) return;
+		await queueAfterTransactionHook(async () => {
+			try {
+				await deleteManyWithHooks([{
+					field: "expiresAt",
+					value: /* @__PURE__ */ new Date(),
+					operator: "lt"
+				}], "verification", void 0);
+			} catch (error) {
+				logger.error("Failed to delete expired verification values", error);
+			}
+		});
+	}
 	return {
 		createOAuthUser: async (user, account) => {
 			return runWithTransaction(adapter, async () => {
@@ -310,12 +326,10 @@ const createInternalAdapter = (adapter, ctx) => {
 					list = safeJSONParse(currentList) || [];
 					list = list.filter((session) => session.expiresAt > now && session.token !== data.token);
 				}
-				const sorted = [...list, {
+				await setActiveSessionReferences(userId, [...list, {
 					token: data.token,
 					expiresAt: data.expiresAt.getTime()
-				}].sort((a, b) => a.expiresAt - b.expiresAt);
-				const furthestSessionTTL = getTTLSeconds(sorted.at(-1)?.expiresAt ?? data.expiresAt.getTime(), now);
-				if (furthestSessionTTL > 0) await secondaryStorage.set(`active-sessions-${userId}`, JSON.stringify(sorted), furthestSessionTTL);
+				}], now);
 				const user = await (await getCurrentAdapter(adapter)).findOne({
 					model: "user",
 					where: [{
@@ -467,13 +481,11 @@ const createInternalAdapter = (adapter, ctx) => {
 						}), sessionTTL);
 						const listKey = `active-sessions-${updatedSession.userId}`;
 						const listRaw = await secondaryStorage.get(listKey);
-						const sorted = (listRaw ? safeJSONParse(listRaw) || [] : []).filter((s) => s.token !== sessionToken && s.expiresAt > now).concat([{
+						const filtered = (listRaw ? safeJSONParse(listRaw) || [] : []).filter((s) => s.token !== sessionToken && s.expiresAt > now).concat([{
 							token: sessionToken,
 							expiresAt: expiresMs
-						}]).sort((a, b) => a.expiresAt - b.expiresAt);
-						const furthestSessionExp = sorted.at(-1)?.expiresAt;
-						if (furthestSessionExp && furthestSessionExp > now) await secondaryStorage.set(listKey, JSON.stringify(sorted), getTTLSeconds(furthestSessionExp, now));
-						else await secondaryStorage.delete(listKey);
+						}]);
+						await setActiveSessionReferences(updatedSession.userId, filtered, now);
 					}
 					return updatedSession;
 				},
@@ -494,10 +506,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (currentList) {
 						const list = safeJSONParse(currentList) || [];
 						const now = Date.now();
-						const filtered = list.filter((session) => session.expiresAt > now && session.token !== token);
-						const furthestSessionExp = filtered.sort((a, b) => a.expiresAt - b.expiresAt).at(-1)?.expiresAt;
-						if (filtered.length > 0 && furthestSessionExp && furthestSessionExp > Date.now()) await secondaryStorage.set(`active-sessions-${userId}`, JSON.stringify(filtered), getTTLSeconds(furthestSessionExp, now));
-						else await secondaryStorage.delete(`active-sessions-${userId}`);
+						await setActiveSessionReferences(userId, list.filter((session) => session.expiresAt > now && session.token !== token), now);
 					} else logger.error("Active sessions list not found in secondary storage");
 				}
 				await secondaryStorage.delete(token);
@@ -800,11 +809,7 @@ const createInternalAdapter = (adapter, ctx) => {
 			}
 			let verification = await findByIdentifier(storedIdentifier);
 			if (!verification.length && storageOption && storageOption !== "plain") verification = await findByIdentifier(identifier);
-			if (!options.verification?.disableCleanup) await deleteManyWithHooks([{
-				field: "expiresAt",
-				value: /* @__PURE__ */ new Date(),
-				operator: "lt"
-			}], "verification", void 0);
+			await deleteExpiredVerifications();
 			return verification[0] || null;
 		},
 		deleteVerificationByIdentifier: async (identifier) => {
@@ -903,6 +908,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (consumed) break;
 				}
 				if (consumed && secondaryStorage) await Promise.all(identifiersToTry.map((stored) => secondaryStorage.delete(`verification:${stored}`)));
+				if (consumed) await deleteExpiredVerifications();
 			}
 			if (!consumed || consumed.expiresAt < /* @__PURE__ */ new Date()) return null;
 			return consumed;
@@ -935,7 +941,10 @@ const createInternalAdapter = (adapter, ctx) => {
 		* is best-effort there (it is intended for development and tests).
 		*/
 		reserveVerificationValue: async (data) => {
-			const reservationId = encodeDeterministicId(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), options);
+			const reservationId = encodeDeterministicId(new Uint8Array(await createHash("SHA-256").digest(new TextEncoder().encode("reserve:" + data.identifier))), options, {
+				adapter,
+				model: "verification"
+			});
 			const storageOption = getStorageOption(data.identifier, options.verification?.storeIdentifier);
 			const storedIdentifier = await processIdentifier(data.identifier, storageOption);
 			if (secondaryStorage && !options.verification?.storeInDatabase) throw new BetterAuthError("reserveVerificationValue requires database-backed verification storage. Set verification.storeInDatabase to true for flows that reserve verification values.");

package/dist/db/schema.mjs

@@ -149,16 +149,25 @@ function getSessionDefaultFields(options) {
 }
 function mergeSchema(schema, newSchema) {
 	if (!newSchema) return schema;
+	const merged = { ...schema };
 	for (const table in newSchema) {
-		const newModelName = newSchema[table]?.modelName;
-		if (newModelName) schema[table].modelName = newModelName;
-		for (const field in schema[table].fields) {
-			const newField = newSchema[table]?.fields?.[field];
-			if (!newField) continue;
-			schema[table].fields[field].fieldName = newField;
-		}
+		const base = schema[table];
+		const override = newSchema[table];
+		if (!base || !override) continue;
+		const fields = Object.fromEntries(Object.entries(base.fields).map(([key, field]) => {
+			const fieldName = override.fields?.[key];
+			return [key, fieldName ? {
+				...field,
+				fieldName
+			} : field];
+		}));
+		merged[table] = {
+			...base,
+			...override.modelName ? { modelName: override.modelName } : {},
+			fields
+		};
 	}
-	return schema;
+	return merged;
 }
 //#endregion
 export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.8.0-beta.6";
+var version = "1.8.0-beta.8";
 //#endregion
 export { version };