@better-auth/core 1.6.23 → 1.6.24

package/dist/db/schema/user.d.mts

@@ -1,8 +1,8 @@
 import { InferDBFieldsFromOptions, InferDBFieldsFromPlugins } from "../type.mjs";
 import { Prettify } from "../../types/helper.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 import * as z from "zod";
-
 //#region src/db/schema/user.d.ts
 declare const userSchema: z.ZodObject<{
   id: z.ZodString;

package/dist/db/schema/verification.d.mts

@@ -1,8 +1,8 @@
 import { InferDBFieldsFromOptions, InferDBFieldsFromPlugins } from "../type.mjs";
 import { Prettify } from "../../types/helper.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 import * as z from "zod";
-
 //#region src/db/schema/verification.d.ts
 declare const verificationSchema: z.ZodObject<{
   id: z.ZodString;

package/dist/db/type.d.mts

@@ -1,15 +1,15 @@
 import { Awaitable, LiteralString, UnionToIntersection } from "../types/helper.mjs";
 import { BetterAuthOptions } from "../types/init-options.mjs";
+import "../types/index.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
-
 //#region src/db/type.d.ts
 type BaseModelNames = "user" | "account" | "session" | "verification";
 type ModelNames<T extends string = LiteralString> = BaseModelNames | T | "rate-limit";
 type InferDBValueType<T extends DBFieldType> = T extends "string" ? string : T extends "number" ? number : T extends "boolean" ? boolean : T extends "date" ? Date : T extends "json" ? Record<string, any> : T extends `${infer U}[]` ? U extends "string" ? string[] : number[] : T extends Array<any> ? T[number] : never;
 type InferDBFieldOutput<T extends DBFieldAttribute> = T["returned"] extends false ? never : T["required"] extends false ? InferDBValueType<T["type"]> | undefined | null : InferDBValueType<T["type"]>;
 type InferDBFieldInput<T extends DBFieldAttribute> = InferDBValueType<T["type"]>;
-type InferDBFieldsInput<Field> = Field extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Field[key]["required"] extends false ? never : Field[key]["defaultValue"] extends string | number | boolean | Date ? never : Field[key]["input"] extends false ? never : key]: InferDBFieldInput<Field[key]> } & { [key in Key as Field[key]["input"] extends false ? never : key]?: InferDBFieldInput<Field[key]> | undefined | null } : {};
-type InferDBFieldsOutput<Fields extends Record<string, DBFieldAttribute>> = Fields extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? key : never : key]: InferDBFieldOutput<Fields[key]> } & { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? never : key : never]?: InferDBFieldOutput<Fields[key]> | null } : never;
+type InferDBFieldsInput<Field> = Field extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Field[key]["required"] extends false ? never : Field[key]["defaultValue"] extends string | number | boolean | Date ? never : Field[key]["input"] extends false ? never : key]: InferDBFieldInput<Field[key]>; } & { [key in Key as Field[key]["input"] extends false ? never : key]?: InferDBFieldInput<Field[key]> | undefined | null; } : {};
+type InferDBFieldsOutput<Fields extends Record<string, DBFieldAttribute>> = Fields extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? key : never : key]: InferDBFieldOutput<Fields[key]>; } & { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? never : key : never]?: InferDBFieldOutput<Fields[key]> | null; } : never;
 type InferDBFieldsFromOptionsInput<DBOptions extends BetterAuthOptions["session"] | BetterAuthOptions["user"] | BetterAuthOptions["verification"] | BetterAuthOptions["account"] | BetterAuthOptions["rateLimit"]> = DBOptions extends {
   additionalFields: Record<string, DBFieldAttribute>;
 } ? InferDBFieldsInput<DBOptions["additionalFields"]> : {};
@@ -19,12 +19,12 @@ type InferDBFieldsFromOptions<DBOptions extends BetterAuthOptions["session"] | B
 type InferDBFieldsFromPluginsInput<ModelName extends string, Plugins extends unknown[] | undefined> = Plugins extends [] ? {} : Plugins extends [infer P, ...infer Rest] ? P extends {
   schema: { [key in ModelName]: {
     fields: infer Fields;
-  } };
+  }; };
 } ? Fields extends Record<string, DBFieldAttribute> ? UnionToIntersection<InferDBFieldsInput<Fields> & InferDBFieldsFromPluginsInput<ModelName, Rest>> : InferDBFieldsFromPluginsInput<ModelName, Rest> : InferDBFieldsFromPluginsInput<ModelName, Rest> : {};
 type InferDBFieldsFromPlugins<ModelName extends string, Plugins extends unknown[] | undefined> = Plugins extends [] ? {} : Plugins extends [infer P, ...infer Rest] ? P extends {
   schema: { [key in ModelName]: {
     fields: infer Fields;
-  } };
+  }; };
 } ? Fields extends Record<string, DBFieldAttribute> ? UnionToIntersection<InferDBFieldsOutput<Fields> & InferDBFieldsFromPlugins<ModelName, Rest>> : InferDBFieldsFromPlugins<ModelName, Rest> : InferDBFieldsFromPlugins<ModelName, Rest> : {};
 type DBFieldType = "string" | "number" | "boolean" | "date" | "json" | `${"string" | "number"}[]` | Array<LiteralString>;
 type DBPrimitive = string | number | boolean | Date | null | undefined | string[] | number[] | (Record<string, unknown> | unknown[]);
@@ -172,17 +172,14 @@ interface SecondaryStorage {
   /**
    * Key to store
    */
-
   key: string,
   /**
    * Value to store
    */
-
   value: string,
   /**
    * Time to live in seconds
    */
-
   ttl?: number | undefined) => Awaitable<void | null | unknown>;
   /**
    *

package/dist/env/logger.d.mts

@@ -1,32 +1,32 @@
 //#region src/env/logger.d.ts
 declare const TTY_COLORS: {
-  readonly reset: "\u001B[0m";
-  readonly bright: "\u001B[1m";
-  readonly dim: "\u001B[2m";
-  readonly undim: "\u001B[22m";
-  readonly underscore: "\u001B[4m";
-  readonly blink: "\u001B[5m";
-  readonly reverse: "\u001B[7m";
-  readonly hidden: "\u001B[8m";
+  readonly reset: "";
+  readonly bright: "";
+  readonly dim: "";
+  readonly undim: "";
+  readonly underscore: "";
+  readonly blink: "";
+  readonly reverse: "";
+  readonly hidden: "";
   readonly fg: {
-    readonly black: "\u001B[30m";
-    readonly red: "\u001B[31m";
-    readonly green: "\u001B[32m";
-    readonly yellow: "\u001B[33m";
-    readonly blue: "\u001B[34m";
-    readonly magenta: "\u001B[35m";
-    readonly cyan: "\u001B[36m";
-    readonly white: "\u001B[37m";
+    readonly black: "";
+    readonly red: "";
+    readonly green: "";
+    readonly yellow: "";
+    readonly blue: "";
+    readonly magenta: "";
+    readonly cyan: "";
+    readonly white: "";
   };
   readonly bg: {
-    readonly black: "\u001B[40m";
-    readonly red: "\u001B[41m";
-    readonly green: "\u001B[42m";
-    readonly yellow: "\u001B[43m";
-    readonly blue: "\u001B[44m";
-    readonly magenta: "\u001B[45m";
-    readonly cyan: "\u001B[46m";
-    readonly white: "\u001B[47m";
+    readonly black: "";
+    readonly red: "";
+    readonly green: "";
+    readonly yellow: "";
+    readonly blue: "";
+    readonly magenta: "";
+    readonly cyan: "";
+    readonly white: "";
   };
 };
 type LogLevel = "debug" | "info" | "success" | "warn" | "error";
@@ -39,7 +39,7 @@ interface Logger {
   log?: ((level: Exclude<LogLevel, "success">, message: string, ...args: any[]) => void) | undefined;
 }
 type LogHandlerParams = Parameters<NonNullable<Logger["log"]>> extends [LogLevel, ...infer Rest] ? Rest : never;
-type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void } & {
+type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void; } & {
   get level(): LogLevel;
 };
 declare const createLogger: (options?: Logger | undefined) => InternalLogger;

package/dist/error/codes.d.mts

@@ -1,5 +1,4 @@
 import { RawError } from "../utils/error-codes.mjs";
-
 //#region src/error/codes.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {

package/dist/error/index.d.mts

@@ -1,6 +1,5 @@
 import { APIErrorCode, BASE_ERROR_CODES } from "./codes.mjs";
 import { APIError as APIError$1 } from "better-call/error";
-
 //#region src/error/index.d.ts
 declare class BetterAuthError extends Error {
   constructor(message: string, options?: {

package/dist/index.d.mts

@@ -6,4 +6,4 @@ import { SecretConfig } from "./types/secret.mjs";
 import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./types/plugin-client.mjs";
 import { StandardSchemaV1 } from "./types/index.mjs";
-export { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };

package/dist/instrumentation/attributes.d.mts

@@ -1,5 +1,4 @@
 import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE } from "@opentelemetry/semantic-conventions";
-
 //#region src/instrumentation/attributes.d.ts
 /** Operation identifier (e.g. getSession, signUpWithEmailAndPassword). Uses endpoint operationId when set, otherwise the endpoint key. */
 declare const ATTR_OPERATION_ID: "better_auth.operation_id";

package/dist/instrumentation/pure.index.d.mts

@@ -1,5 +1,4 @@
 import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID } from "./attributes.mjs";
-
 //#region src/instrumentation/pure.index.d.ts
 declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => T): T;
 declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => Promise<T>): Promise<T>;

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.6.23";
+const INSTRUMENTATION_VERSION = "1.6.24";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/oauth2/client-credentials-token.d.mts

@@ -1,13 +1,8 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-
 //#region src/oauth2/client-credentials-token.d.ts
-declare function clientCredentialsTokenRequest({
-  options,
-  scope,
-  authentication,
-  resource
-}: {
+declare function clientCredentialsTokenRequest({ options, scope, authentication, resource }: {
   options: AwaitableFunction<ProviderOptions & {
     clientSecret: string;
   }>;
@@ -21,12 +16,7 @@ declare function clientCredentialsTokenRequest({
 /**
  * @deprecated use async'd clientCredentialsTokenRequest instead
  */
-declare function createClientCredentialsTokenRequest({
-  options,
-  scope,
-  authentication,
-  resource
-}: {
+declare function createClientCredentialsTokenRequest({ options, scope, authentication, resource }: {
   options: ProviderOptions & {
     clientSecret: string;
   };
@@ -37,13 +27,7 @@ declare function createClientCredentialsTokenRequest({
   body: URLSearchParams;
   headers: Record<string, any>;
 };
-declare function clientCredentialsToken({
-  options,
-  tokenEndpoint,
-  scope,
-  authentication,
-  resource
-}: {
+declare function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, resource }: {
   options: AwaitableFunction<ProviderOptions & {
     clientSecret: string;
   }>;

package/dist/oauth2/client-credentials-token.mjs

@@ -54,10 +54,7 @@ async function clientCredentialsToken({ options, tokenEndpoint, scope, authentic
 		tokenType: data.token_type,
 		scopes: data.scope?.split(" ")
 	};
-	if (data.expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
-	}
+	if (data.expires_in) tokens.accessTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.expires_in * 1e3);
 	return tokens;
 }
 //#endregion

package/dist/oauth2/create-authorization-url.d.mts

@@ -1,26 +1,9 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { ProviderOptions } from "./oauth-provider.mjs";
+import "./index.mjs";
 //#region src/oauth2/create-authorization-url.d.ts
-declare function createAuthorizationURL({
-  id,
-  options,
-  authorizationEndpoint,
-  state,
-  codeVerifier,
-  scopes,
-  claims,
-  redirectURI,
-  duration,
-  prompt,
-  accessType,
-  responseType,
-  display,
-  loginHint,
-  hd,
-  responseMode,
-  additionalParams,
-  scopeJoiner
-}: {
+declare function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, hd, responseMode, additionalParams, scopeJoiner }: {
   id: string;
   options: AwaitableFunction<ProviderOptions>;
   redirectURI: string;

package/dist/oauth2/oauth-provider.d.mts

@@ -1,4 +1,6 @@
 import { Awaitable, LiteralString } from "../types/helper.mjs";
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 //#region src/oauth2/oauth-provider.d.ts
 interface OAuth2Tokens {
   tokenType?: string | undefined;
@@ -63,9 +65,10 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    * Verify the id token
    * @param token - The id token
    * @param nonce - The nonce
+   * @param ctx - Request endpoint context (headers via `ctx.headers`)
    * @returns True if the id token is valid, false otherwise
    */
-  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  verifyIdToken?: ((token: string, nonce?: string, ctx?: GenericEndpointContext) => Promise<boolean>) | undefined;
   /**
    * Disable implicit sign up for new users. When set to true for the provider,
    * sign-in need to be called with with requestSignUp as true to create new users.
@@ -123,9 +126,12 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
    */
   disableIdTokenSignIn?: boolean | undefined;
   /**
-   * verifyIdToken function to verify the id token
+   * Custom function to verify the id token.
+   * @param token - The id token
+   * @param nonce - The nonce
+   * @param ctx - Request endpoint context (headers via `ctx.headers`)
    */
-  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  verifyIdToken?: ((token: string, nonce?: string, ctx?: GenericEndpointContext) => Promise<boolean>) | undefined;
   /**
    * Custom function to get user info from the provider
    */

package/dist/oauth2/refresh-access-token.d.mts

@@ -1,14 +1,8 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-
 //#region src/oauth2/refresh-access-token.d.ts
-declare function refreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  extraParams,
-  resource
-}: {
+declare function refreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }: {
   refreshToken: string;
   options: AwaitableFunction<Partial<ProviderOptions>>;
   authentication?: ("basic" | "post") | undefined;
@@ -21,13 +15,7 @@ declare function refreshAccessTokenRequest({
 /**
  * @deprecated use async'd refreshAccessTokenRequest instead
  */
-declare function createRefreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  extraParams,
-  resource
-}: {
+declare function createRefreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }: {
   refreshToken: string;
   options: ProviderOptions;
   authentication?: ("basic" | "post") | undefined;
@@ -37,13 +25,7 @@ declare function createRefreshAccessTokenRequest({
   body: URLSearchParams;
   headers: Record<string, any>;
 };
-declare function refreshAccessToken({
-  refreshToken,
-  options,
-  tokenEndpoint,
-  authentication,
-  extraParams
-}: {
+declare function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, extraParams }: {
   refreshToken: string;
   options: Partial<ProviderOptions>;
   tokenEndpoint: string;

package/dist/oauth2/refresh-access-token.mjs

@@ -59,14 +59,8 @@ async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authen
 		scopes: data.scope?.split(" "),
 		idToken: data.id_token
 	};
-	if (data.expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
-	}
-	if (data.refresh_token_expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.refreshTokenExpiresAt = new Date(now.getTime() + data.refresh_token_expires_in * 1e3);
-	}
+	if (data.expires_in) tokens.accessTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.expires_in * 1e3);
+	if (data.refresh_token_expires_in) tokens.refreshTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.refresh_token_expires_in * 1e3);
 	return tokens;
 }
 //#endregion

package/dist/oauth2/reject-redirects.mjs

@@ -1,7 +1,7 @@
 import { BetterAuthError } from "../error/index.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/reject-redirects.ts
-const HTTP_REDIRECT_STATUSES = new Set([
+const HTTP_REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	301,
 	302,
 	303,

package/dist/oauth2/utils.d.mts

@@ -1,5 +1,4 @@
 import { OAuth2Tokens } from "./oauth-provider.mjs";
-
 //#region src/oauth2/utils.d.ts
 declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
 /**

package/dist/oauth2/utils.mjs

@@ -2,8 +2,7 @@ import { base64Url } from "@better-auth/utils/base64";
 //#region src/oauth2/utils.ts
 function getOAuth2Tokens(data) {
 	const getDate = (seconds) => {
-		const now = /* @__PURE__ */ new Date();
-		return new Date(now.getTime() + seconds * 1e3);
+		return new Date((/* @__PURE__ */ new Date()).getTime() + seconds * 1e3);
 	};
 	return {
 		tokenType: data.token_type,

package/dist/oauth2/validate-authorization-code.d.mts

@@ -1,19 +1,9 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-import * as jose from "jose";
-
+import "./index.mjs";
 //#region src/oauth2/validate-authorization-code.d.ts
-declare function authorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
+declare function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams, resource }: {
   code: string;
   redirectURI: string;
   options: AwaitableFunction<Partial<ProviderOptions>>;
@@ -30,17 +20,7 @@ declare function authorizationCodeRequest({
 /**
  * @deprecated use async'd authorizationCodeRequest instead
  */
-declare function createAuthorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
+declare function createAuthorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams, resource }: {
   code: string;
   redirectURI: string;
   options: Partial<ProviderOptions>;
@@ -54,18 +34,7 @@ declare function createAuthorizationCodeRequest({
   body: URLSearchParams;
   headers: Record<string, any>;
 };
-declare function validateAuthorizationCode({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  tokenEndpoint,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
+declare function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, deviceId, headers, additionalParams, resource }: {
   code: string;
   redirectURI: string;
   options: AwaitableFunction<Partial<ProviderOptions>>;
@@ -80,6 +49,6 @@ declare function validateAuthorizationCode({
 declare function validateToken(token: string, jwksEndpoint: string, options?: {
   audience?: string | string[];
   issuer?: string | string[];
-}): Promise<jose.JWTVerifyResult<jose.JWTPayload> & jose.ResolvedKey>;
+}): Promise<import("jose").JWTVerifyResult<import("jose").JWTPayload> & import("jose").ResolvedKey>;
 //#endregion
 export { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken };

package/dist/oauth2/verify.d.mts

@@ -1,8 +1,8 @@
 import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
-
 //#region src/oauth2/verify.d.ts
 type JwksFetchOptions = {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
+  /** Jwks url or promise of a Jwks */
+  jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
   /**
    * Stable object to cache the result of a function `jwksFetch` under,
    * with the same TTL and kid-miss refetch rules as string sources.
@@ -10,9 +10,6 @@ type JwksFetchOptions = {
    */
   jwksCacheKey?: object;
 };
-/**
- * @internal
- */
 interface VerifyAccessTokenRemote {
   /** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
   introspectUrl: string;
@@ -47,7 +44,8 @@ interface VerifyAccessTokenRemote {
  * Can also be configured for remote verification.
  */
 declare function verifyJwsAccessToken(token: string, opts: JwksFetchOptions & {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Verify options */
+  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
 }): Promise<JWTPayload>;
 declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWebKeySet>;
 /**
@@ -56,10 +54,14 @@ declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWeb
  * Can also be configured for remote verification.
  */
 declare function verifyAccessToken(token: string, opts: {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>; /** Scopes to additionally verify. Token must include all but not exact. */
-  scopes?: string[]; /** Required to verify access token locally */
-  jwksUrl?: string; /** If provided, can verify a token remotely */
+  /** Verify options */
+  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Scopes to additionally verify. Token must include all but not exact. */
+  scopes?: string[];
+  /** Required to verify access token locally */
+  jwksUrl?: string;
+  /** If provided, can verify a token remotely */
   remoteVerify?: VerifyAccessTokenRemote;
 }): Promise<JWTPayload>;
 //#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };
+export { VerifyAccessTokenRemote, getJwks, verifyAccessToken, verifyJwsAccessToken };

package/dist/oauth2/verify.mjs

@@ -3,7 +3,7 @@ import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { APIError } from "better-call";
 import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/oauth2/verify.ts
-const joseInfrastructureErrorCodes = new Set([
+const joseInfrastructureErrorCodes = /* @__PURE__ */ new Set([
 	errors.JWKSTimeout.code,
 	errors.JWKSInvalid.code,
 	errors.JWKSMultipleMatchingKeys.code
@@ -199,4 +199,4 @@ async function verifyAccessToken(token, opts) {
 	return payload;
 }
 //#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };
+export { getJwks, jwksCache, verifyAccessToken, verifyJwsAccessToken };

package/dist/social-providers/apple.d.mts

@@ -1,4 +1,7 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/apple.d.ts
 interface AppleProfile {
   /**
@@ -67,11 +70,7 @@ interface AppleOptions extends ProviderOptions<AppleProfile> {
 declare const apple: (options: AppleOptions) => {
   id: "apple";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -79,37 +78,17 @@ declare const apple: (options: AppleOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
     user?: {
-      name /**
-            * An Integer value that indicates whether the user appears to be a real
-            * person. Use the value of this claim to mitigate fraud. The possible
-            * values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal). For
-            * more information, see ASUserDetectionStatus. This claim is present only
-            * in iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14
-            * and later. The claim isn’t present or supported for web-based apps.
-            */?
-      /**
-      * An Integer value that indicates whether the user appears to be a real
-      * person. Use the value of this claim to mitigate fraud. The possible
-      * values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal). For
-      * more information, see ASUserDetectionStatus. This claim is present only
-      * in iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14
-      * and later. The claim isn’t present or supported for web-based apps.
-      */
-      : {
+      name?: {
         firstName?: string;
         lastName?: string;
       };

package/dist/social-providers/apple.mjs

@@ -50,9 +50,9 @@ const apple = (options) => {
 				tokenEndpoint
 			});
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			try {
 				const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
 				if (!kid || !jwtAlg) return false;

package/dist/social-providers/atlassian.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/atlassian.d.ts
 interface AtlassianProfile {
   account_type?: string | undefined;
@@ -21,12 +22,7 @@ interface AtlassianOptions extends ProviderOptions<AtlassianProfile> {
 declare const atlassian: (options: AtlassianOptions) => {
   id: "atlassian";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -34,11 +30,7 @@ declare const atlassian: (options: AtlassianOptions) => {
     display?: string | undefined;
     loginHint?: string | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;