fix(auth): align better-auth family on 1.7.0-rc.1 + new adapter methods

The @better-auth/oauth-provider fix (GHSA-p2fr-6hmx-4528) only ships in the
1.7 line, whose plugins import CLIENT_ASSERTION_TYPE and other symbols that
exist only in @better-auth/core 1.7.x. Pinning oauth-provider to 1.7.0-rc.1
while core/better-auth stayed on 1.6.23 made sign-in 500 at runtime
("@better-auth/core/oauth2 does not provide an export named
CLIENT_ASSERTION_TYPE"), failing the dogfood regression gate.

Pin the ENTIRE better-auth family (better-auth, @better-auth/core, and all
@better-auth/* plugins/adapters) to 1.7.0-rc.1 via pnpm-workspace overrides so
the stack is internally consistent.

better-auth 1.7 also adds two methods to its CustomAdapter contract, now
implemented in the ObjectQL adapter as find-then-write mirrors of the existing
delete/update methods (ObjectQL has no native atomic primitive):
  - consumeOne: atomic single-row consume (used for verification tokens on the
    sign-in path)
  - incrementOne: guarded field = field + delta counter mutation

Verified locally: plugin-auth builds (dts included) and all 440 unit tests
pass; frozen-lockfile is in sync; only plugin-auth consumes better-auth.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015JoYhorCUhGc8bgFYsErfE

Author: claude

.changeset/plugin-auth-better-auth-17-adapter.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(auth): align the better-auth family on 1.7.0-rc.1 and implement the new adapter methods (#2974)
+
+Remediating GHSA-p2fr-6hmx-4528 (`@better-auth/oauth-provider`) requires the
+1.7 plugin line, which imports `CLIENT_ASSERTION_TYPE` and other symbols that
+only exist in `@better-auth/core` 1.7.x — so the whole better-auth family is
+pinned to `1.7.0-rc.1` together (mixing a 1.7 plugin with 1.6.23 core 500s on
+sign-in). better-auth 1.7 also extends its `CustomAdapter` contract with two
+new methods, which the ObjectQL adapter now implements:
+
+- `consumeOne` — atomic single-row consume (find the guarded row, delete it,
+  return it), used by better-auth for single-use credential consumption
+  (e.g. verification tokens on the sign-in path).
+- `incrementOne` — guarded counter mutation (`field = field + delta` per
+  `increment` entry plus any absolute `set` values), returning the updated row
+  or `null` when the guard matches nothing.
+
+Both are find-then-write mirrors of the existing `delete` / `update` methods
+(ObjectQL exposes no native atomic primitive) and honour the same core/plugin
+field-name bridging.

packages/plugins/plugin-auth/src/objectql-adapter.ts

@@ -334,6 +334,55 @@ export function createObjectQLAdapterFactory(rawDataEngine: IDataEngine) {
         }
         return records.length;
       },
+
+      // Atomic single-row consume (better-auth 1.7+). ObjectQL has no native
+      // `DELETE ... RETURNING`, so we find the single guarded row, delete it,
+      // and return the consumed record — a find-then-write mirror of `delete`.
+      consumeOne: async <T>(
+        { model, where }: { model: string; where: CleanedWhere[] },
+      ): Promise<T | null> => {
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+
+        const record = await dataEngine.findOne(objectName, { where: filter });
+        if (!record) return null;
+        await dataEngine.delete(objectName, { where: { id: record.id } });
+        const norm = normaliseLegacyDates(model, record);
+        return (bridged ? remapKeys(norm, snakeToCamel) : norm) as T;
+      },
+
+      // Guarded counter mutation (better-auth 1.7+). ObjectQL has no native
+      // `SET n = n + $delta ... RETURNING`, so we read the guarded row, apply
+      // `field = field + delta` for each `increment` entry (negative deltas
+      // decrement) plus any absolute `set` values, and write it back. `where`
+      // is both selector and guard, so a non-matching guard returns null.
+      incrementOne: async <T>(
+        { model, where, increment, set }: {
+          model: string; where: CleanedWhere[];
+          increment: Record<string, number>; set?: Record<string, unknown>;
+        },
+      ): Promise<T | null> => {
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+
+        const record = await dataEngine.findOne(objectName, { where: filter });
+        if (!record) return null;
+
+        const patch: Record<string, any> = {};
+        for (const [field, delta] of Object.entries(increment)) {
+          const col = bridged ? camelToSnake(field) : field;
+          const current = Number((record as Record<string, any>)[col] ?? 0);
+          patch[col] = current + delta;
+        }
+        if (set) Object.assign(patch, bridged ? remapKeys(set, camelToSnake) : set);
+
+        const result = await dataEngine.update(objectName, { ...patch, id: record.id });
+        if (!result) return null;
+        const norm = normaliseLegacyDates(model, result);
+        return (bridged ? remapKeys(norm, snakeToCamel) : norm) as T;
+      },
     }),
   });
 }