@better-auth/core 1.7.0-rc.0 → 1.7.0-rc.2

package/dist/oauth2/validate-authorization-code.d.mts

@@ -1,8 +1,8 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
-import * as jose from "jose";
-
+import "./index.mjs";
 //#region src/oauth2/validate-authorization-code.d.ts
 interface AuthorizationCodeRequestInput {
   code: string;
@@ -20,38 +20,14 @@ interface AuthorizationCodeRequestInput {
 interface ValidateAuthorizationCodeInput extends AuthorizationCodeRequestInput {
   tokenEndpoint: string;
 }
-declare function authorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  tokenEndpointAuth,
-  tokenEndpoint,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: AuthorizationCodeRequestInput): Promise<{
+declare function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, tokenEndpointAuth, tokenEndpoint, deviceId, headers, additionalParams, resource }: AuthorizationCodeRequestInput): Promise<{
   body: URLSearchParams;
   headers: Record<string, string>;
 }>;
-declare function validateAuthorizationCode({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  tokenEndpoint,
-  authentication,
-  tokenEndpointAuth,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: ValidateAuthorizationCodeInput): Promise<OAuth2Tokens>;
+declare function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, tokenEndpointAuth, deviceId, headers, additionalParams, resource }: ValidateAuthorizationCodeInput): Promise<OAuth2Tokens>;
 declare function validateToken(token: string, jwksEndpoint: string, options?: {
   audience?: string | string[];
   issuer?: string | string[];
-}): Promise<jose.JWTVerifyResult<jose.JWTPayload> & jose.ResolvedKey>;
+}): Promise<import("jose").JWTVerifyResult<import("jose").JWTPayload> & import("jose").ResolvedKey>;
 //#endregion
 export { authorizationCodeRequest, validateAuthorizationCode, validateToken };

package/dist/oauth2/verify-id-token.d.mts

@@ -1,5 +1,6 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuthProvider } from "./oauth-provider.mjs";
-
 //#region src/oauth2/verify-id-token.d.ts
 type ProviderWithIdTokenConfig = Pick<OAuthProvider, "idToken" | "options">;
 /**
@@ -22,6 +23,6 @@ declare function supportsIdTokenSignIn(provider: ProviderWithIdTokenConfig): boo
  *
  * @returns `true` only when the token is authentic for the provider.
  */
-declare function verifyProviderIdToken(provider: ProviderWithIdTokenConfig, token: string, nonce?: string): Promise<boolean>;
+declare function verifyProviderIdToken(provider: ProviderWithIdTokenConfig, token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
 //#endregion
 export { supportsIdTokenSignIn, verifyProviderIdToken };

package/dist/oauth2/verify-id-token.mjs

@@ -35,14 +35,14 @@ function supportsIdTokenSignIn(provider) {
 *
 * @returns `true` only when the token is authentic for the provider.
 */
-async function verifyProviderIdToken(provider, token, nonce) {
+async function verifyProviderIdToken(provider, token, nonce, ctx) {
 	const options = provider.options ?? {};
 	if (options.disableIdTokenSignIn) return false;
 	try {
-		if (options.verifyIdToken) return await options.verifyIdToken(token, nonce);
+		if (options.verifyIdToken) return await options.verifyIdToken(token, nonce, ctx);
 		const config = provider.idToken;
 		if (!config) return false;
-		if ("verify" in config) return await config.verify(token, nonce);
+		if ("verify" in config) return await config.verify(token, nonce, ctx);
 		if (token.split(".").length !== 3) return config.allowOpaqueToken === true;
 		const { alg } = decodeProtectedHeader(token);
 		const { payload } = await jwtVerify(token, config.jwks, {

package/dist/oauth2/verify.d.mts

@@ -1,9 +1,9 @@
 import { DpopReplayStore } from "./dpop.mjs";
 import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
-
 //#region src/oauth2/verify.d.ts
 type JwksFetchOptions = {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
+  /** Jwks url or promise of a Jwks */
+  jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
   /**
    * Stable object to cache the result of a function `jwksFetch` under,
    * with the same TTL and kid-miss refetch rules as string sources.
@@ -11,9 +11,6 @@ type JwksFetchOptions = {
    */
   jwksCacheKey?: object;
 };
-/**
- * @internal
- */
 interface VerifyAccessTokenRemote {
   /** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
   introspectUrl: string;
@@ -87,7 +84,8 @@ declare function requestToResourceInput(request: Request): ResourceRequestInput;
  * Can also be configured for remote verification.
  */
 declare function verifyJwsAccessToken(token: string, opts: JwksFetchOptions & {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Verify options */
+  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
 }): Promise<JWTPayload>;
 declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWebKeySet>;
 /**
@@ -112,4 +110,4 @@ declare function verifyBearerToken(token: string, opts: VerifyAccessTokenOptions
  */
 declare function verifyAccessTokenRequest(request: ResourceRequestInput, opts: VerifyAccessTokenRequestOptions): Promise<JWTPayload>;
 //#endregion
-export { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };
+export { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRemote, VerifyAccessTokenRequestOptions, getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };

package/dist/oauth2/verify.mjs

@@ -4,7 +4,7 @@ import { createInMemoryDpopReplayStore, enforceDpopBinding, getDpopJktFromPayloa
 import { APIError } from "better-call";
 import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/oauth2/verify.ts
-const joseInfrastructureErrorCodes = new Set([
+const joseInfrastructureErrorCodes = /* @__PURE__ */ new Set([
 	errors.JWKSTimeout.code,
 	errors.JWKSInvalid.code,
 	errors.JWKSMultipleMatchingKeys.code
@@ -267,4 +267,4 @@ async function verifyAccessTokenRequest(request, opts) {
 	return payload;
 }
 //#endregion
-export { getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };
+export { getJwks, jwksCache, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };

package/dist/social-providers/apple.d.mts

@@ -1,6 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
-import * as jose from "jose";
-
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/apple.d.ts
 interface AppleProfile {
   /**
@@ -69,12 +68,9 @@ interface AppleOptions extends ProviderOptions<AppleProfile> {
 declare const apple: (options: AppleOptions) => {
   id: "apple";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<AppleProfile>) => string;
+  accountIssuer: string;
+  createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -84,18 +80,14 @@ declare const apple: (options: AppleOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
   idToken: {
-    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    jwks: (header: import("jose").JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
     issuer: string;
     audience: string | string[];
     maxTokenAge: string;
@@ -112,15 +104,8 @@ declare const apple: (options: AppleOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: AppleProfile;
   } | null>;
   options: AppleOptions;
 };

package/dist/social-providers/apple.mjs

@@ -12,6 +12,8 @@ const apple = (options) => {
 	return {
 		id: "apple",
 		name: "Apple",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: "https://appleid.apple.com",
 		async createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client ID and client secret are required for Apple. Make sure to provide them in the options.");
@@ -71,7 +73,6 @@ const apple = (options) => {
 			const userMap = await options.mapProfileToUser?.(enrichedProfile);
 			return {
 				user: {
-					id: profile.sub,
 					name: enrichedProfile.name,
 					emailVerified,
 					email: profile.email,

package/dist/social-providers/atlassian.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/atlassian.d.ts
 interface AtlassianProfile {
   account_type?: string | undefined;
@@ -21,13 +22,8 @@ interface AtlassianOptions extends ProviderOptions<AtlassianProfile> {
 declare const atlassian: (options: AtlassianOptions) => {
   id: "atlassian";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<AtlassianProfile>) => string;
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -37,11 +33,7 @@ declare const atlassian: (options: AtlassianOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -58,15 +50,22 @@ declare const atlassian: (options: AtlassianOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: AtlassianProfile;
+  } | {
     user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
+      id?: never;
+      name: string;
+      email: string | null;
+      image: string;
       emailVerified: boolean;
-      [key: string]: any;
     };
-    data: any;
+    data: {
+      account_id: string;
+      name: string;
+      email?: string | undefined;
+      picture?: string | undefined;
+    };
   } | null>;
   options: AtlassianOptions;
 };

package/dist/social-providers/atlassian.mjs

@@ -10,6 +10,7 @@ const atlassian = (options) => {
 	return {
 		id: "atlassian",
 		name: "Atlassian",
+		accountSubject: ({ profile }) => profile.account_id,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!options.clientId || !options.clientSecret) {
 				logger.error("Client Id and Secret are required for Atlassian");
@@ -62,7 +63,6 @@ const atlassian = (options) => {
 				const userMap = await options.mapProfileToUser?.(profile);
 				return {
 					user: {
-						id: profile.account_id,
 						name: profile.name,
 						email: profile.email,
 						image: profile.picture,

package/dist/social-providers/cognito.d.mts

@@ -1,6 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
-import * as jose from "jose";
-
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/cognito.d.ts
 interface CognitoProfile {
   sub: string;
@@ -49,13 +48,9 @@ interface CognitoOptions extends ProviderOptions<CognitoProfile> {
 declare const cognito: (options: CognitoOptions) => {
   id: "cognito";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<CognitoProfile>) => string;
+  accountIssuer: string;
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -65,11 +60,7 @@ declare const cognito: (options: CognitoOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -77,7 +68,7 @@ declare const cognito: (options: CognitoOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   idToken: {
-    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    jwks: (header: import("jose").JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
     issuer: string;
     audience: string | string[];
     maxTokenAge: string;
@@ -92,15 +83,35 @@ declare const cognito: (options: CognitoOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: CognitoProfile;
+  } | {
     user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
+      id?: never;
+      name: string;
+      email: string | null;
+      image: string;
       emailVerified: boolean;
-      [key: string]: any;
     };
-    data: any;
+    data: {
+      name: string;
+      sub: string;
+      email: string;
+      email_verified: boolean;
+      given_name?: string | undefined;
+      family_name?: string | undefined;
+      picture?: string | undefined;
+      username?: string | undefined;
+      locale?: string | undefined;
+      phone_number?: string | undefined;
+      phone_number_verified?: boolean | undefined;
+      aud: string | (string & string[]);
+      iss: string;
+      exp: number;
+      iat: number;
+      jti?: string;
+      nbf?: number;
+    };
   } | null>;
   options: CognitoOptions;
 };

package/dist/social-providers/cognito.mjs

@@ -19,6 +19,8 @@ const cognito = (options) => {
 	return {
 		id: "cognito",
 		name: "Cognito",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: `https://cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("ClientId is required for Amazon Cognito. Make sure to provide them in the options.");
@@ -98,7 +100,6 @@ const cognito = (options) => {
 				const userMap = await options.mapProfileToUser?.(enrichedProfile);
 				return {
 					user: {
-						id: profile.sub,
 						name: enrichedProfile.name,
 						email: profile.email,
 						image: profile.picture,
@@ -116,7 +117,6 @@ const cognito = (options) => {
 					const userMap = await options.mapProfileToUser?.(userInfo);
 					return {
 						user: {
-							id: userInfo.sub,
 							name: userInfo.name || userInfo.given_name || userInfo.username || "",
 							email: userInfo.email,
 							image: userInfo.picture,

package/dist/social-providers/discord.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/discord.d.ts
 interface DiscordProfile extends Record<string, any> {
   /** the user's id (i.e. the numerical snowflake) */
@@ -77,12 +78,8 @@ interface DiscordOptions extends ProviderOptions<DiscordProfile> {
 declare const discord: (options: DiscordOptions) => {
   id: "discord";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<DiscordProfile>) => string;
+  createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -92,10 +89,7 @@ declare const discord: (options: DiscordOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -112,15 +106,8 @@ declare const discord: (options: DiscordOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: DiscordProfile;
   } | null>;
   options: DiscordOptions;
 };

package/dist/social-providers/discord.mjs

@@ -8,6 +8,7 @@ const discord = (options) => {
 	return {
 		id: "discord",
 		name: "Discord",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["identify", "email"];
 			if (scopes) _scopes.push(...scopes);
@@ -58,7 +59,6 @@ const discord = (options) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.id,
 					name: profile.global_name || profile.username || "",
 					email: profile.email,
 					emailVerified: profile.verified,

package/dist/social-providers/dropbox.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/dropbox.d.ts
 interface DropboxProfile {
   account_id: string;
@@ -20,13 +21,8 @@ interface DropboxOptions extends ProviderOptions<DropboxProfile> {
 declare const dropbox: (options: DropboxOptions) => {
   id: "dropbox";
   name: string;
-  createAuthorizationURL: ({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<DropboxProfile>) => string;
+  createAuthorizationURL: ({ state, scopes, codeVerifier, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -36,11 +32,7 @@ declare const dropbox: (options: DropboxOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }) => Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -57,15 +49,8 @@ declare const dropbox: (options: DropboxOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: DropboxProfile;
   } | null>;
   options: DropboxOptions;
 };

package/dist/social-providers/dropbox.mjs

@@ -8,6 +8,7 @@ const dropbox = (options) => {
 	return {
 		id: "dropbox",
 		name: "Dropbox",
+		accountSubject: ({ profile }) => profile.account_id,
 		createAuthorizationURL: async ({ state, scopes, codeVerifier, redirectURI, additionalParams }) => {
 			const _scopes = options.disableDefaultScope ? [] : ["account_info.read"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -56,7 +57,6 @@ const dropbox = (options) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.account_id,
 					name: profile.name?.display_name,
 					email: profile.email,
 					emailVerified: profile.email_verified || false,

package/dist/social-providers/facebook.d.mts

@@ -1,8 +1,7 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
-import * as jose from "jose";
-
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/facebook.d.ts
-interface FacebookProfile {
+interface FacebookGraphProfile {
   id: string;
   name: string;
   email?: string;
@@ -16,6 +15,13 @@ interface FacebookProfile {
     };
   };
 }
+interface FacebookLimitedLoginProfile {
+  sub: string;
+  email: string;
+  name: string;
+  picture: string;
+}
+type FacebookProfile = FacebookGraphProfile | FacebookLimitedLoginProfile;
 interface FacebookOptions extends ProviderOptions<FacebookProfile> {
   clientId: string | string[];
   /**
@@ -32,13 +38,9 @@ interface FacebookOptions extends ProviderOptions<FacebookProfile> {
 declare const facebook: (options: FacebookOptions) => {
   id: "facebook";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    loginHint,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<FacebookProfile>) => string;
+  accountIssuer: string;
+  createAuthorizationURL({ state, scopes, redirectURI, loginHint, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -48,10 +50,7 @@ declare const facebook: (options: FacebookOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -59,12 +58,12 @@ declare const facebook: (options: FacebookOptions) => {
   }) => Promise<OAuth2Tokens>;
   idToken: {
     jwks: {
-      (protectedHeader?: jose.JWSHeaderParameters, token?: jose.FlattenedJWSInput): Promise<jose.CryptoKey>;
+      (protectedHeader?: import("jose").JWSHeaderParameters, token?: import("jose").FlattenedJWSInput): Promise<import("jose").CryptoKey>;
       coolingDown: boolean;
       fresh: boolean;
       reloading: boolean;
       reload: () => Promise<void>;
-      jwks: () => jose.JSONWebKeySet | undefined;
+      jwks: () => import("jose").JSONWebKeySet | undefined;
     };
     issuer: string;
     audience: string | string[];
@@ -82,17 +81,10 @@ declare const facebook: (options: FacebookOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: FacebookProfile;
   } | null>;
   options: FacebookOptions;
 };
 //#endregion
-export { FacebookOptions, FacebookProfile, facebook };
+export { FacebookGraphProfile, FacebookLimitedLoginProfile, FacebookOptions, FacebookProfile, facebook };