better-auth 1.8.0-beta.7 → 1.8.0-beta.9

package/dist/_virtual/_rolldown/runtime.mjs

@@ -1,4 +1,4 @@
-//#region \0rolldown/runtime.js
+// \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -23,5 +23,4 @@ var __copyProps = (to, from, except, desc) => {
 	return to;
 };
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
-//#endregion
 export { __exportAll, __reExport };

package/dist/adapters/index.d.mts

@@ -1,6 +1,5 @@
 import { AdapterFactory, AdapterFactoryConfig, AdapterFactoryCustomizeAdapterCreator, AdapterFactoryOptions, AdapterTestDebugLogs, CustomAdapter, createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName } from "@better-auth/core/db/adapter";
 export * from "@better-auth/core/db/adapter";
-//#region src/adapters/index.d.ts
 /**
  * @deprecated Use `createAdapterFactory` instead.
  */
@@ -17,5 +16,4 @@ export type AdapterConfig = AdapterFactoryConfig;
  * @deprecated Use `AdapterFactoryCustomizeAdapterCreator` instead.
  */
 export type CreateCustomAdapter = AdapterFactoryCustomizeAdapterCreator;
-//#endregion
 export { type AdapterFactory, type AdapterFactoryConfig, type AdapterFactoryCustomizeAdapterCreator, type AdapterFactoryOptions, type AdapterTestDebugLogs, type CustomAdapter, createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName };

package/dist/adapters/index.mjs

@@ -1,9 +1,8 @@
 import { createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName } from "@better-auth/core/db/adapter";
 export * from "@better-auth/core/db/adapter";
-//#region src/adapters/index.ts
+// src/adapters/index.ts
 /**
 * @deprecated Use `createAdapterFactory` instead.
 */
 const createAdapter = createAdapterFactory;
-//#endregion
 export { createAdapter, createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName };

package/dist/api/dispatch.d.mts

@@ -1,7 +1,6 @@
 import { AuthContext } from "@better-auth/core";
 import { Endpoint, EndpointContext, InputContext } from "better-call";
 import "@better-auth/core/api";
-//#region src/api/dispatch.d.ts
 /**
  * Input accepted by {@link dispatchAuthEndpoint}. `context` must already be a
  * resolved `AuthContext`; the caller owns `baseURL` resolution. A fresh
@@ -29,5 +28,4 @@ export type DispatchContext = Partial<InputContext<string, any> & EndpointContex
  * @param endpoint The endpoint to dispatch.
  * @param input Input context whose `context` is an already-resolved `AuthContext`.
  */
-export declare function dispatchAuthEndpoint(endpoint: Endpoint, input: DispatchContext): Promise<unknown>;
-//#endregion
+export declare function dispatchAuthEndpoint(endpoint: Endpoint, input: DispatchContext): Promise<unknown>;

package/dist/api/dispatch.mjs

@@ -7,7 +7,7 @@ import { createDefu } from "defu";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, createWithSpan } from "@better-auth/core/instrumentation";
 import { kAPIErrorHeaderSymbol, toResponse } from "better-call";
 import { getInternalAuthCompletion } from "@better-auth/core/utils/auth-completion";
-//#region src/api/dispatch.ts
+// src/api/dispatch.ts
 const defuReplaceArrays = createDefu((obj, key, value) => {
 	if (Array.isArray(obj[key]) && Array.isArray(value)) {
 		obj[key] = value;
@@ -296,5 +296,4 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		} : result.response;
 	}));
 }
-//#endregion
 export { asSignInGate, dispatchAuthEndpoint, getOperationId };

package/dist/api/index.d.mts

@@ -1,7 +1,8 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
-import "../types/index.mjs";
 import "../index.mjs";
+import "../types/index.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
@@ -11,6 +12,7 @@ import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refre
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
 import { error } from "./routes/error.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./routes/id-token-nonce.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
@@ -28,7 +30,6 @@ import { APIError } from "@better-auth/core/error";
 import { getIP } from "@better-auth/core/utils/ip";
 import { Middleware } from "better-call";
 import { AuthEndpoint, AuthMiddleware, NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
-//#region src/api/index.d.ts
 export declare function checkEndpointConflicts(options: BetterAuthOptions, logger: InternalLogger): void;
 export declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<AuthContext>, options: Option): {
   api: OverrideMerge<{
@@ -241,6 +242,7 @@ export declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awai
         disableRefresh: import("zod").ZodOptional<import("zod").ZodCoercedBoolean<unknown>>;
       }, import("zod/v4/core").$strip>>;
       requireHeaders: true;
+      disableBody: true;
       metadata: {
         openapi: {
           operationId: string;
@@ -1664,6 +1666,38 @@ export declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awai
       url: string;
       redirect: boolean;
     }>;
+    readonly issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        provider: import("zod").ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, import("zod/v4/core").$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      nonce: {
+                        type: "string";
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      nonce: string;
+    }>;
     readonly listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
       method: "GET";
       use: Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -2255,6 +2289,7 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
         disableRefresh: import("zod").ZodOptional<import("zod").ZodCoercedBoolean<unknown>>;
       }, import("zod/v4/core").$strip>>;
       requireHeaders: true;
+      disableBody: true;
       metadata: {
         openapi: {
           operationId: string;
@@ -3678,6 +3713,38 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
       url: string;
       redirect: boolean;
     }>;
+    readonly issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+      method: "POST";
+      body: import("zod").ZodObject<{
+        provider: import("zod").ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, import("zod/v4/core").$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      nonce: {
+                        type: "string";
+                      };
+                    };
+                    required: string[];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    }, {
+      nonce: string;
+    }>;
     readonly listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
       method: "GET";
       use: Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -4047,5 +4114,4 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
     }>;
   } extends (infer T_2) ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K]; } : never) & T_1> : never : never : never;
 };
-//#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, consumeIssuedIdTokenNonce, consumeNonce, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -2,22 +2,24 @@ import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
-import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
-import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
-import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
-import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
+import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
 import { error } from "./routes/error.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { consumeIssuedIdTokenNonce, consumeNonce, issueIdTokenNonce, issueNonce, issuedNonceResponses } from "./routes/id-token-nonce.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
+import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
 import { signInEmail, signInSocial } from "./routes/sign-in.mjs";
 import { signOut } from "./routes/sign-out.mjs";
 import { signUpEmail } from "./routes/sign-up.mjs";
 import { updateSession } from "./routes/update-session.mjs";
-import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
-import { dispatchAuthEndpoint } from "./dispatch.mjs";
 import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
+import { generateGenericState, parseGenericState } from "../state.mjs";
+import { dispatchAuthEndpoint } from "./dispatch.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
+import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import { getIP } from "@better-auth/core/utils/ip";
@@ -25,7 +27,7 @@ import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createRouter } from "better-call";
 import { NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
-//#region src/api/index.ts
+// src/api/index.ts
 function checkEndpointConflicts(options, logger) {
 	const endpointRegistry = /* @__PURE__ */ new Map();
 	options.plugins?.forEach((plugin) => {
@@ -134,6 +136,7 @@ function getEndpoints(ctx, options) {
 		revokeSessions,
 		revokeOtherSessions,
 		linkSocialAccount,
+		issueIdTokenNonce,
 		listUserAccounts,
 		deleteUserCallback,
 		unlinkAccount,
@@ -221,5 +224,4 @@ const router = (ctx, options) => {
 		}
 	});
 };
-//#endregion
-export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, consumeIssuedIdTokenNonce, consumeNonce, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, generateGenericState, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, issueIdTokenNonce, issueNonce, issuedNonceResponses, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, parseGenericState, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/middlewares/authorization.d.mts

@@ -1,4 +1,3 @@
-//#region src/api/middlewares/authorization.d.ts
 /**
  * Middleware that verifies the authenticated user owns a resource.
  * Must be used after sessionMiddleware in the `use` array.
@@ -68,5 +67,4 @@ export declare function requireOrgRole(config: {
   allowedRoles?: string[];
 }): import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
   verifiedMember: {};
-}>>;
-//#endregion
+}>>;

package/dist/api/middlewares/authorization.mjs

@@ -1,6 +1,6 @@
 import { APIError } from "@better-auth/core/error";
 import { createAuthMiddleware } from "@better-auth/core/api";
-//#region src/api/middlewares/authorization.ts
+// src/api/middlewares/authorization.ts
 /**
 * Middleware that verifies the authenticated user owns a resource.
 * Must be used after sessionMiddleware in the `use` array.
@@ -75,5 +75,4 @@ function requireOrgRole(config) {
 		return { verifiedMember: member };
 	});
 }
-//#endregion
 export { requireOrgRole, requireResourceOwnership };

package/dist/api/middlewares/origin-check.d.mts

@@ -1,5 +1,4 @@
 import { GenericEndpointContext } from "@better-auth/core";
-//#region src/api/middlewares/origin-check.d.ts
 /**
  * A middleware to validate callbackURL and origin against trustedOrigins.
  * Also handles CSRF protection using Fetch Metadata for first-login scenarios.
@@ -10,5 +9,4 @@ export declare const originCheck: (getValue: (ctx: GenericEndpointContext) => st
  * Middleware for CSRF protection using Fetch Metadata headers.
  * This prevents cross-site navigation login attacks while supporting progressive enhancement.
  */
-export declare const formCsrfMiddleware: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
-//#endregion
+export declare const formCsrfMiddleware: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;

package/dist/api/middlewares/origin-check.mjs

@@ -1,10 +1,10 @@
-import { getBaseURL, getOrigin } from "../../utils/url.mjs";
 import { matchesOriginPattern } from "../../auth/trusted-origins.mjs";
+import { getBaseURL, getOrigin } from "../../utils/url.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { deprecate } from "@better-auth/core/utils/deprecate";
-//#region src/api/middlewares/origin-check.ts
+// src/api/middlewares/origin-check.ts
 /**
 * Checks if CSRF should be skipped for backward compatibility.
 * Previously, disableOriginCheck also disabled CSRF checks.
@@ -151,5 +151,4 @@ async function validateFormCsrf(ctx) {
 	}
 	if (headers.get("origin") || headers.get("referer")) return await validateOrigin(ctx, true);
 }
-//#endregion
 export { formCsrfMiddleware, originCheck, originCheckMiddleware };

package/dist/api/rate-limiter/index.mjs

@@ -2,7 +2,7 @@ import { wildcardMatch } from "../../utils/wildcard.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { createRateLimitKey, getIP } from "@better-auth/core/utils/ip";
 import { normalizePathname } from "@better-auth/core/utils/url";
-//#region src/api/rate-limiter/index.ts
+// src/api/rate-limiter/index.ts
 const memory = /* @__PURE__ */ new Map();
 const MEMORY_STORE_MAX_ENTRIES = 1e5;
 function pruneMemoryStore() {
@@ -317,5 +317,4 @@ function getDefaultSpecialRules() {
 		max: 3
 	}];
 }
-//#endregion
 export { onRequestRateLimit };

package/dist/api/routes/account.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-//#region src/api/routes/account.d.ts
 export declare const listUserAccounts: import("better-call").StrictEndpoint<"/list-accounts", {
   method: "GET";
   use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -405,5 +404,4 @@ export declare const accountInfo: import("better-call").StrictEndpoint<"/account
   };
   user: import("@better-auth/core/oauth2").OAuth2UserInfo;
   data: object;
-}>;
-//#endregion
+}>;

package/dist/api/routes/account.mjs

@@ -1,22 +1,22 @@
+import { getAwaitableValue } from "../../context/helpers.mjs";
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
-import { parseAccountOutput } from "../../db/schema.mjs";
-import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
-import { getAwaitableValue } from "../../context/helpers.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { derivePurposeKey } from "../../crypto/purpose.mjs";
+import { parseAccountOutput } from "../../db/schema.mjs";
 import { resolveOAuthAccountKeyForAPI } from "../../oauth2/account-key.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
-import { toBoolean } from "../../utils/boolean.mjs";
-import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
+import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
+import { consumeIssuedIdTokenNonce } from "./id-token-nonce.mjs";
+import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
-import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { additionalAuthorizationParamsSchema, parseStringBoolean, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-//#region src/api/routes/account.ts
+// src/api/routes/account.ts
 function parseStoredScopes(scope) {
 	if (!scope) return [];
 	return scope.split(",").map((s) => s.trim()).filter(Boolean);
@@ -168,6 +168,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.ID_TOKEN_NOT_SUPPORTED);
 		}
 		const { token, nonce } = c.body.idToken;
+		await consumeIssuedIdTokenNonce(c, provider, nonce);
 		if (!await verifyProviderIdToken(provider, token, nonce, c)) {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);
@@ -208,7 +209,9 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			});
 		}
 		if (linkedAccount) throw APIError.from("CONFLICT", BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED);
-		if (!c.context.trustedProviders.includes(provider.id) && !toBoolean(linkingUserInfo.user.emailVerified) || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
+		const isTrustedProvider = c.context.trustedProviders.includes(provider.id);
+		const emailVerified = parseStringBoolean(linkingUserInfo.user.emailVerified) ?? false;
+		if (!isTrustedProvider && !emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
 			message: "Account not linked - linking not allowed",
 			code: "LINKING_NOT_ALLOWED"
 		});
@@ -626,5 +629,4 @@ const accountInfo = createAuthEndpoint("/account-info", {
 		}
 	});
 });
-//#endregion
 export { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount };

package/dist/api/routes/callback.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-//#region src/api/routes/callback.d.ts
 export declare const callbackOAuth: import("better-call").StrictEndpoint<"/callback/:id", {
   method: ("GET" | "POST")[];
   operationId: string;
@@ -25,5 +24,4 @@ export declare const callbackOAuth: import("better-call").StrictEndpoint<"/callb
     allowedMediaTypes: string[];
     scope: "server";
   };
-}, void>;
-//#endregion
+}, void>;

package/dist/api/routes/callback.mjs

@@ -1,16 +1,16 @@
-import { isAPIError } from "../../utils/is-api-error.mjs";
-import { setSessionCookie } from "../../cookies/index.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/state.mjs";
-import { exchangeOAuthCallback } from "../../oauth2/callback.mjs";
+import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import { isAPIError } from "../../utils/is-api-error.mjs";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-//#region src/api/routes/callback.ts
+// src/api/routes/callback.ts
 const schema = z.object({
 	code: z.string().optional(),
 	error: z.string().optional(),
@@ -170,5 +170,4 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 	}
 	throw c.redirect(toRedirectTo);
 });
-//#endregion
 export { callbackOAuth };

package/dist/api/routes/email-verification.d.mts

@@ -2,7 +2,6 @@ import { User } from "../../types/models.mjs";
 import "../../types/index.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
 import * as z from "zod";
-//#region src/api/routes/email-verification.d.ts
 export declare function createEmailVerificationToken(secret: string, email: string,
 /**
  * The email to update from
@@ -151,5 +150,4 @@ export declare const verifyEmail: import("better-call").StrictEndpoint<"/verify-
   };
 }, void | {
   status: boolean;
-}>;
-//#endregion
+}>;

package/dist/api/routes/email-verification.mjs

@@ -1,16 +1,16 @@
-import { originCheck } from "../middlewares/origin-check.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
 import { signJWT } from "../../crypto/jwt.mjs";
 import { parseUserOutput } from "../../db/schema.mjs";
-import { setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "./session.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
+import { originCheck } from "../middlewares/origin-check.mjs";
+import { getSessionFromCtx } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 import { jwtVerify } from "jose";
 import { JWTExpired } from "jose/errors";
-//#region src/api/routes/email-verification.ts
+// src/api/routes/email-verification.ts
 async function createEmailVerificationToken(secret, email, updateTo, expiresIn = 3600, extraPayload) {
 	return await signJWT({
 		email: email.toLowerCase(),
@@ -312,5 +312,4 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 		user: null
 	});
 });
-//#endregion
 export { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail };

package/dist/api/routes/error.d.mts

@@ -1,4 +1,3 @@
-//#region src/api/routes/error.d.ts
 export declare const error: import("better-call").StrictEndpoint<"/error", {
   method: "GET";
   metadata: {
@@ -20,5 +19,4 @@ export declare const error: import("better-call").StrictEndpoint<"/error", {
     };
     scope: "server";
   };
-}, Response>;
-//#endregion
+}, Response>;

package/dist/api/routes/error.mjs

@@ -2,7 +2,7 @@ import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { isProduction } from "@better-auth/core/env";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
-//#region src/api/routes/error.ts
+// src/api/routes/error.ts
 function sanitize(input) {
 	return input.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/&(?!amp;|lt;|gt;|quot;|#39;|#x[0-9a-fA-F]+;|#[0-9]+;)/g, "&amp;");
 }
@@ -383,5 +383,4 @@ const error = createAuthEndpoint("/error", {
 	});
 	return new Response(html(c.context.options, safeCode, safeDescription), { headers: { "Content-Type": "text/html" } });
 });
-//#endregion
 export { error };

package/dist/api/routes/id-token-nonce.d.mts

@@ -0,0 +1,83 @@
+import { GenericEndpointContext } from "@better-auth/core";
+import { OAuthProvider } from "@better-auth/core/oauth2";
+import * as z from "zod";
+/**
+ * Store a new single-use nonce under `scope` and return it. It expires after
+ * five minutes.
+ */
+export declare function issueNonce(ctx: GenericEndpointContext, scope: string): Promise<string>;
+/**
+ * Consume a nonce that {@link issueNonce} stored under `scope`. Throws
+ * `INVALID_ID_TOKEN_NONCE` when it is missing, malformed, unknown, expired, or
+ * already used. Call it before verifying the token, so a failed attempt burns
+ * the nonce too.
+ */
+export declare function consumeNonce(ctx: GenericEndpointContext, scope: string, nonce: string | undefined): Promise<void>;
+/** OpenAPI responses for an endpoint that returns `{ nonce }` from {@link issueNonce}. */
+export declare const issuedNonceResponses: {
+  200: {
+    description: string;
+    content: {
+      "application/json": {
+        schema: {
+          type: "object";
+          properties: {
+            nonce: {
+              type: "string";
+            };
+          };
+          required: string[];
+        };
+      };
+    };
+  };
+};
+type ProviderWithOptions = Pick<OAuthProvider, "id" | "options">;
+/**
+ * Consume the issued nonce presented with a client-submitted ID token, from
+ * `/sign-in/social` or `/link-social`. A no-op for providers without
+ * `requireIssuedIdTokenNonce`.
+ */
+export declare function consumeIssuedIdTokenNonce(ctx: GenericEndpointContext, provider: ProviderWithOptions, nonce: string | undefined): Promise<void>;
+/**
+ * ### Endpoint
+ *
+ * POST `/id-token/nonce`
+ *
+ * Issues a single-use nonce for a client to pass to the provider's SDK before
+ * submitting the resulting ID token to `/sign-in/social` or `/link-social`.
+ * Only available for providers that set `requireIssuedIdTokenNonce`.
+ */
+export declare const issueIdTokenNonce: import("better-call").StrictEndpoint<"/id-token/nonce", {
+  method: "POST";
+  body: z.ZodObject<{
+    provider: z.ZodType<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown, z.core.$ZodTypeInternals<(string & {}) | "github" | "apple" | "atlassian" | "cloudflare" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "huggingface" | "slack" | "spotify" | "twitch" | "twitter" | "dropbox" | "kick" | "linear" | "linkedin" | "gitlab" | "tiktok" | "reddit" | "roblox" | "salesforce" | "vk" | "zoom" | "notion" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat", unknown>>;
+  }, z.core.$strip>;
+  metadata: {
+    noStore: boolean;
+    openapi: {
+      description: string;
+      responses: {
+        200: {
+          description: string;
+          content: {
+            "application/json": {
+              schema: {
+                type: "object";
+                properties: {
+                  nonce: {
+                    type: "string";
+                  };
+                };
+                required: string[];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}, {
+  nonce: string;
+}>;
+export {};