@better-auth-ui/core 1.6.30 → 1.6.32

package/dist/{create-auth-plugin-DcxR23rZ.js → create-auth-plugin-D4wsYnHD.js}

@@ -143,6 +143,7 @@ function o(e, t) {
 //#region src/lib/view-paths.ts
 var s = {
 	auth: {
+		redirect: "redirect",
 		signIn: "sign-in",
 		signUp: "sign-up",
 		forgotPassword: "forgot-password",

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export * from './config';
 export * from './lib/auth-mutation-keys';
 export * from './lib/auth-plugin';
 export * from './lib/auth-query-keys';
+export * from './lib/auth-redirect';
 export * from './lib/base-paths';
 export * from './lib/create-auth-plugin';
 export * from './lib/deep-partial';

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as e, c as t, i as n, l as r, n as i, o as a, r as o, s, t as c } from "./create-auth-plugin-DcxR23rZ.js";
+import { a as e, c as t, i as n, l as r, n as i, o as a, r as o, s, t as c } from "./create-auth-plugin-D4wsYnHD.js";
 //#region src/config/additional-fields-config.ts
 function l(e, t) {
 	if (e.type === "boolean") return t === "on" || t === "true";
@@ -59,7 +59,38 @@ var d = {
 	revokeSession: ["auth", "revokeSession"],
 	unlinkAccount: ["auth", "unlinkAccount"],
 	updateUser: ["auth", "updateUser"]
-}, f = {
+}, f = /^https?:\/\//i;
+function p(e) {
+	for (let t of e) {
+		let e = t.codePointAt(0);
+		if (t === "\\" || e === void 0 || e <= 31 || e === 127) return !0;
+	}
+	return !1;
+}
+function m(e, t) {
+	if (!e || p(e)) return "/";
+	let n = e.trim();
+	if (!n || n.startsWith("//") || !n.startsWith("/") && !f.test(n)) return "/";
+	try {
+		let e = new URL(t), r = new URL(n, e);
+		return r.origin !== e.origin || r.username || r.password ? "/" : `${r.pathname}${r.search}${r.hash}`;
+	} catch {
+		return "/";
+	}
+}
+function h(e, t, n) {
+	let r = m(e.searchParams.get("redirectTo"), e.origin), i = new URL(r, e.origin).pathname === e.pathname ? "/" : r;
+	if (t) return {
+		type: "redirect",
+		to: i
+	};
+	let a = new URL(n, e.origin);
+	return a.searchParams.set("redirectTo", `${e.pathname}${e.search}${e.hash}`), {
+		type: "signIn",
+		to: `${a.pathname}${a.search}${a.hash}`
+	};
+}
+var g = {
 	version: "2.0",
 	providers: [
 		{
@@ -1476,26 +1507,26 @@ var d = {
 		domains: 223,
 		generated: "2025-12-09T10:38:50.000Z"
 	}
-}, p;
-function m() {
-	if (p) return p;
-	p = /* @__PURE__ */ new Map();
-	let { providers: e } = f;
-	for (let t of e) if (t.loginUrl) for (let e of t.domains ?? []) p.set(e.toLowerCase(), {
+}, _;
+function v() {
+	if (_) return _;
+	_ = /* @__PURE__ */ new Map();
+	let { providers: e } = g;
+	for (let t of e) if (t.loginUrl) for (let e of t.domains ?? []) _.set(e.toLowerCase(), {
 		companyProvider: t.companyProvider,
 		loginUrl: t.loginUrl
 	});
-	return p;
+	return _;
 }
-function h(e) {
+function y(e) {
 	let t = e.lastIndexOf("@");
 	if (t === -1) return null;
 	let n = e.slice(t + 1).trim().toLowerCase();
-	return n ? m().get(n) ?? null : null;
+	return n ? v().get(n) ?? null : null;
 }
 //#endregion
 //#region src/lib/provider-names.ts
-var g = {
+var b = {
 	apple: "Apple",
 	atlassian: "Atlassian",
 	cognito: "Cognito",
@@ -1532,8 +1563,8 @@ var g = {
 	wechat: "WeChat",
 	zoom: "Zoom"
 };
-function _(e) {
-	return g[e] || e.charAt(0).toUpperCase() + e.slice(1);
+function x(e) {
+	return b[e] || e.charAt(0).toUpperCase() + e.slice(1);
 }
 //#endregion
-export { d as authMutationKeys, i as authQueryKeys, r as basePaths, c as createAuthPlugin, e as deepmerge, o as defaultAuthConfig, a as fileToBase64, h as getEmailProviderLink, _ as getProviderName, t as localization, l as parseAdditionalFieldValue, g as providerNames, s as resizeAvatar, u as resolveInputType, n as viewPaths };
+export { d as authMutationKeys, i as authQueryKeys, r as basePaths, c as createAuthPlugin, e as deepmerge, o as defaultAuthConfig, a as fileToBase64, h as getAuthRedirectAction, y as getEmailProviderLink, x as getProviderName, m as getSafeRedirectTo, t as localization, l as parseAdditionalFieldValue, b as providerNames, s as resizeAvatar, u as resolveInputType, n as viewPaths };

package/dist/lib/auth-mutation-keys.d.ts

@@ -19,10 +19,11 @@
  * package the mutation options factory came from.
  *
  * Plugin-specific mutation keys live alongside their plugin (e.g.
- * `apiKeyMutationKeys`, `organizationMutationKeys`, `passkeyMutationKeys`,
- * `magicLinkMutationKeys`, `multiSessionMutationKeys`, `usernameMutationKeys`,
- * `deleteUserMutationKeys`). Plugin-contributed sign-in strategies stay
- * under the shared `["auth", "signIn", ...]` namespace so
+ * `apiKeyMutationKeys`, `deviceAuthorizationMutationKeys`,
+ * `organizationMutationKeys`, `passkeyMutationKeys`, `magicLinkMutationKeys`,
+ * `multiSessionMutationKeys`, `usernameMutationKeys`, `deleteUserMutationKeys`).
+ * Plugin-contributed sign-in strategies stay under the shared
+ * `["auth", "signIn", ...]` namespace so
  * `useIsMutating({ mutationKey: authMutationKeys.signIn.all })` still
  * matches them.
  *

package/dist/lib/auth-redirect.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Normalize a redirect target to a same-origin path.
+ *
+ * Root-relative paths and same-origin HTTP(S) URLs are accepted. Invalid,
+ * cross-origin, protocol-relative, and non-HTTP targets fall back to `/`.
+ *
+ * @param redirectTo - Requested redirect target
+ * @param origin - Origin used to validate and normalize the target
+ * @returns A same-origin path including its query string and hash
+ */
+export declare function getSafeRedirectTo(redirectTo: string | null | undefined, origin: string): string;
+export type AuthRedirectAction = {
+    type: "redirect";
+    to: string;
+} | {
+    type: "signIn";
+    to: string;
+};
+/**
+ * Resolve the next action for the authenticated redirect view.
+ *
+ * Signed-in users continue to the validated target. Signed-out users are sent
+ * to sign in with the current redirect-view URL preserved, allowing the view
+ * to perform a full-page redirect after authentication.
+ *
+ * @param currentURL - Current redirect-view URL
+ * @param authenticated - Whether the current user has a session
+ * @param signInPath - Same-origin path to the sign-in view
+ * @returns The redirect or sign-in action to perform
+ */
+export declare function getAuthRedirectAction(currentURL: URL, authenticated: boolean, signInPath: string): AuthRedirectAction;

package/dist/lib/view-paths.d.ts

@@ -2,6 +2,11 @@
  * View path segments for authentication routes.
  */
 export interface AuthViewPaths {
+    /**
+     * Path segment for the authenticated redirect view
+     * @default "redirect"
+     */
+    redirect: string;
     /**
      * Path segment for the sign-in view
      * @default "sign-in"

package/dist/plugins/admin/admin-localization.d.ts

@@ -0,0 +1,5 @@
+export declare const adminLocalization: {
+    /** @remarks `"Stop impersonating"` */
+    stopImpersonating: string;
+};
+export type AdminLocalization = typeof adminLocalization;

package/dist/plugins/admin/admin-mutation-keys.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Mutation keys contributed by the admin plugin.
+ */
+export declare const adminMutationKeys: {
+    /** Root key for every admin mutation. */
+    readonly all: readonly ["auth", "admin"];
+    /** Key for `admin.stopImpersonating`. */
+    readonly stopImpersonating: readonly ["auth", "admin", "stopImpersonating"];
+};

package/dist/plugins/admin/admin-plugin.d.ts

@@ -0,0 +1,32 @@
+import { AdminLocalization } from './admin-localization';
+export type AdminPluginOptions = {
+    /**
+     * Override the plugin's default localization strings.
+     * @remarks `AdminLocalization`
+     */
+    localization?: Partial<AdminLocalization>;
+};
+export type ImpersonatingSession = {
+    session: {
+        impersonatedBy: string;
+    };
+};
+/**
+ * Check whether a Better Auth session belongs to an impersonated user.
+ */
+export declare function isImpersonatingSession(session: unknown): session is ImpersonatingSession;
+/**
+ * Adds UI integrations for Better Auth's admin plugin.
+ *
+ * Pair this UI plugin with Better Auth's `admin()` server plugin and
+ * `adminClient()` client plugin.
+ */
+export declare const adminPlugin: ((options?: AdminPluginOptions | undefined) => {
+    localization: {
+        stopImpersonating: string;
+    };
+} & {
+    id: "admin";
+}) & {
+    id: "admin";
+};

package/dist/plugins/device-authorization/device-authorization-localization.d.ts

@@ -0,0 +1,33 @@
+export declare const deviceAuthorizationLocalization: {
+    /** @remarks `"Device Authorization"` */
+    deviceAuthorization: string;
+    /** @remarks `"Enter the code displayed on your device."` */
+    deviceAuthorizationDescription: string;
+    /** @remarks `"Device code"` */
+    deviceCode: string;
+    /** @remarks `"The code is invalid or has expired."` */
+    invalidDeviceCode: string;
+    /** @remarks `"Continue"` */
+    continue: string;
+    /** @remarks `"Approve Device"` */
+    approveDevice: string;
+    /** @remarks `"A device is requesting access to your account."` */
+    approveDeviceDescription: string;
+    /** @remarks `"Signed in as"` */
+    signedInAs: string;
+    /** @remarks `"Approve"` */
+    approve: string;
+    /** @remarks `"Deny"` */
+    deny: string;
+    /** @remarks `"Device Approved"` */
+    deviceApproved: string;
+    /** @remarks `"The device can now access your account. You can return to it and continue."` */
+    deviceApprovedDescription: string;
+    /** @remarks `"Device Denied"` */
+    deviceDenied: string;
+    /** @remarks `"The device was not granted access to your account."` */
+    deviceDeniedDescription: string;
+    /** @remarks `"Return to application"` */
+    returnToApplication: string;
+};
+export type DeviceAuthorizationLocalization = typeof deviceAuthorizationLocalization;

package/dist/plugins/device-authorization/device-authorization-mutation-keys.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Mutation keys contributed by the device-authorization plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export declare const deviceAuthorizationMutationKeys: {
+    /** Prefix matching every device-authorization mutation. */
+    readonly all: readonly ["auth", "deviceAuthorization"];
+    /** Key for verifying and claiming a user code. */
+    readonly verify: readonly ["auth", "deviceAuthorization", "verify"];
+    /** Key for approving a pending device request. */
+    readonly approve: readonly ["auth", "deviceAuthorization", "approve"];
+    /** Key for denying a pending device request. */
+    readonly deny: readonly ["auth", "deviceAuthorization", "deny"];
+};

package/dist/plugins/device-authorization/device-authorization-plugin.d.ts

@@ -0,0 +1,59 @@
+import { DeviceAuthorizationLocalization } from './device-authorization-localization';
+declare module "../../lib/view-paths" {
+    /** Widens `AuthViewPaths` with the device-authorization path when this plugin is imported. */
+    interface AuthViewPaths {
+        /** @default "device" */
+        deviceAuthorization?: string;
+    }
+}
+export type DeviceAuthorizationPluginOptions = {
+    /**
+     * Override the plugin's default localization strings.
+     * @remarks `DeviceAuthorizationLocalization`
+     */
+    localization?: Partial<DeviceAuthorizationLocalization>;
+    /**
+     * URL segment for the device-authorization view.
+     * @remarks `string`
+     * @default "device"
+     */
+    path?: string;
+    /**
+     * Number of characters rendered by the device-code input.
+     *
+     * Keep this in sync with Better Auth's `deviceAuthorization({ userCodeLength })`
+     * server option.
+     *
+     * @default 8
+     */
+    userCodeLength?: number;
+};
+export declare const deviceAuthorizationPlugin: ((options?: DeviceAuthorizationPluginOptions | undefined) => {
+    localization: {
+        deviceAuthorization: string;
+        deviceAuthorizationDescription: string;
+        deviceCode: string;
+        invalidDeviceCode: string;
+        continue: string;
+        approveDevice: string;
+        approveDeviceDescription: string;
+        signedInAs: string;
+        approve: string;
+        deny: string;
+        deviceApproved: string;
+        deviceApprovedDescription: string;
+        deviceDenied: string;
+        deviceDeniedDescription: string;
+        returnToApplication: string;
+    };
+    userCodeLength: number;
+    viewPaths: {
+        auth: {
+            deviceAuthorization: string;
+        };
+    };
+} & {
+    id: "deviceAuthorization";
+}) & {
+    id: "deviceAuthorization";
+};

package/dist/plugins/oauth-provider/oauth-provider-localization.d.ts

@@ -0,0 +1,25 @@
+export declare const oauthProviderLocalization: {
+    /** @remarks `"Authorize {{client}}"` */
+    authorize: string;
+    /** @remarks `"{{client}} wants to access your account."` */
+    authorizationDescription: string;
+    /** @remarks `"This will allow {{client}} to:"` */
+    requestedPermissions: string;
+    /** @remarks `"Signed in as"` */
+    signedInAs: string;
+    /** @remarks `"Allow"` */
+    allow: string;
+    /** @remarks `"Cancel"` */
+    cancel: string;
+    /** @remarks `"Privacy policy"` */
+    privacyPolicy: string;
+    /** @remarks `"Terms of service"` */
+    termsOfService: string;
+    /** @remarks `"Invalid authorization request"` */
+    invalidRequest: string;
+    /** @remarks `"This authorization request is missing required information or is no longer valid."` */
+    invalidRequestDescription: string;
+    /** @remarks `"Application"` */
+    application: string;
+};
+export type OAuthProviderLocalization = typeof oauthProviderLocalization;

package/dist/plugins/oauth-provider/oauth-provider-mutation-keys.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Mutation keys contributed by the OAuth provider plugin.
+ *
+ * All keys live under the shared `["auth"]` namespace so global auth
+ * mutation observers handle errors consistently.
+ */
+export declare const oauthProviderMutationKeys: {
+    /** Prefix matching every OAuth provider mutation. */
+    readonly all: readonly ["auth", "oauthProvider"];
+    /** Key for accepting or denying an OAuth authorization request. */
+    readonly consent: readonly ["auth", "oauthProvider", "consent"];
+};

package/dist/plugins/oauth-provider/oauth-provider-plugin.d.ts

@@ -0,0 +1,78 @@
+import { OAuthProviderLocalization } from './oauth-provider-localization';
+declare module "../../lib/view-paths" {
+    /** Widens `AuthViewPaths` with the OAuth consent path when this plugin is imported. */
+    interface AuthViewPaths {
+        /** @default "consent" */
+        oauthConsent?: string;
+    }
+}
+export type OAuthScopeMetadata = {
+    /** Short permission label displayed to the user. */
+    label: string;
+    /** Optional explanation of the data or access represented by the scope. */
+    description?: string;
+};
+export type OAuthScopeMetadataMap = Record<string, OAuthScopeMetadata>;
+export declare const oauthProviderScopeMetadata: OAuthScopeMetadataMap;
+export type OAuthAuthorizationRequest = {
+    clientId?: string;
+    scopes: string[];
+};
+/**
+ * Keep client-controlled links and images on browser-safe web protocols.
+ */
+export declare function sanitizeOAuthClientUrl(value: string | null | undefined): string | undefined;
+/**
+ * Read the display-safe parts of Better Auth's signed authorization query.
+ *
+ * The complete query string must remain in the browser URL so
+ * `oauthProviderClient()` can forward and verify it during consent.
+ */
+export declare function parseOAuthAuthorizationRequest(search: string): OAuthAuthorizationRequest;
+export type OAuthProviderPluginOptions = {
+    /**
+     * Override the plugin's default localization strings.
+     * @remarks `OAuthProviderLocalization`
+     */
+    localization?: Partial<OAuthProviderLocalization>;
+    /**
+     * URL segment for the OAuth consent view.
+     * @remarks `string`
+     * @default "consent"
+     */
+    path?: string;
+    /**
+     * Labels and descriptions for custom OAuth scopes.
+     *
+     * Entries override the built-in metadata for `openid`, `profile`, `email`,
+     * and `offline_access`. Unknown scopes remain visible using their raw value.
+     */
+    scopeMetadata?: OAuthScopeMetadataMap;
+};
+export declare const oauthProviderPlugin: ((options?: OAuthProviderPluginOptions | undefined) => {
+    localization: {
+        authorize: string;
+        authorizationDescription: string;
+        requestedPermissions: string;
+        signedInAs: string;
+        allow: string;
+        cancel: string;
+        privacyPolicy: string;
+        termsOfService: string;
+        invalidRequest: string;
+        invalidRequestDescription: string;
+        application: string;
+    };
+    scopeMetadata: {
+        [x: string]: OAuthScopeMetadata;
+    };
+    viewPaths: {
+        auth: {
+            oauthConsent: string;
+        };
+    };
+} & {
+    id: "oauthProvider";
+}) & {
+    id: "oauthProvider";
+};

package/dist/plugins/oauth-provider/oauth-provider-query-keys.d.ts

@@ -0,0 +1,9 @@
+/** Query keys contributed by the OAuth provider plugin. */
+export declare const oauthProviderQueryKeys: {
+    /** Prefix matching every OAuth provider query. */
+    readonly all: readonly ["auth", "oauthProvider"];
+    /** Prefix for public OAuth client metadata queries. */
+    readonly publicClients: readonly ["auth", "oauthProvider", "publicClient"];
+    /** Key for the public metadata of a specific OAuth client. */
+    readonly publicClient: (clientId: string | undefined) => readonly ["auth", "oauthProvider", "publicClient", string | null];
+};

package/dist/plugins.d.ts

@@ -1,3 +1,6 @@
+export * from './plugins/admin/admin-localization';
+export * from './plugins/admin/admin-mutation-keys';
+export * from './plugins/admin/admin-plugin';
 export * from './plugins/api-key/api-key-localization';
 export * from './plugins/api-key/api-key-mutation-keys';
 export * from './plugins/api-key/api-key-plugin';
@@ -5,6 +8,9 @@ export * from './plugins/api-key/api-key-query-keys';
 export * from './plugins/delete-user/delete-user-localization';
 export * from './plugins/delete-user/delete-user-mutation-keys';
 export * from './plugins/delete-user/delete-user-plugin';
+export * from './plugins/device-authorization/device-authorization-localization';
+export * from './plugins/device-authorization/device-authorization-mutation-keys';
+export * from './plugins/device-authorization/device-authorization-plugin';
 export * from './plugins/last-login-method/last-login-method-localization';
 export * from './plugins/last-login-method/last-login-method-plugin';
 export * from './plugins/magic-link/magic-link-localization';
@@ -14,6 +20,10 @@ export * from './plugins/multi-session/multi-session-localization';
 export * from './plugins/multi-session/multi-session-mutation-keys';
 export * from './plugins/multi-session/multi-session-plugin';
 export * from './plugins/multi-session/multi-session-query-keys';
+export * from './plugins/oauth-provider/oauth-provider-localization';
+export * from './plugins/oauth-provider/oauth-provider-mutation-keys';
+export * from './plugins/oauth-provider/oauth-provider-plugin';
+export * from './plugins/oauth-provider/oauth-provider-query-keys';
 export * from './plugins/organization/organization-localization';
 export * from './plugins/organization/organization-mutation-keys';
 export * from './plugins/organization/organization-plugin';