@better-auth/core 1.7.0-rc.1 → 1.7.0-rc.2

package/dist/social-providers/kakao.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/kakao.d.ts
 interface Partner {
   /** Partner-specific ID (consent required: kakaotalk_message) */
@@ -93,12 +94,8 @@ interface KakaoOptions extends ProviderOptions<KakaoProfile> {
 declare const kakao: (options: KakaoOptions) => {
   id: "kakao";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<KakaoProfile>) => number;
+  createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -108,10 +105,7 @@ declare const kakao: (options: KakaoOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -128,30 +122,11 @@ declare const kakao: (options: KakaoOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: KakaoProfile;
   } | {
     user: {
-      id: string;
-      name: string;
-      email: string | undefined;
-      image: string | undefined;
-      emailVerified: boolean;
-    } | {
-      id: string;
-      name: string;
-      email: string | null;
-      image: string;
-      emailVerified: boolean;
-    } | {
-      id: string;
+      id?: never;
       name: string;
       email: string | null;
       image: string;

package/dist/social-providers/kakao.mjs

@@ -8,6 +8,7 @@ const kakao = (options) => {
 	return {
 		id: "kakao",
 		name: "Kakao",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"account_email",
@@ -54,7 +55,6 @@ const kakao = (options) => {
 			const kakaoProfile = account.profile || {};
 			return {
 				user: {
-					id: String(profile.id),
 					name: kakaoProfile.nickname || account.name || "",
 					email: account.email,
 					image: kakaoProfile.profile_image_url || kakaoProfile.thumbnail_image_url,

package/dist/social-providers/kick.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/kick.d.ts
 interface KickProfile {
   /**
@@ -24,13 +25,8 @@ interface KickOptions extends ProviderOptions<KickProfile> {
 declare const kick: (options: KickOptions) => {
   id: "kick";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    codeVerifier,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<KickProfile>) => string;
+  createAuthorizationURL({ state, scopes, redirectURI, codeVerifier, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -40,11 +36,7 @@ declare const kick: (options: KickOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode({
-    code,
-    redirectURI,
-    codeVerifier
-  }: {
+  validateAuthorizationCode({ code, redirectURI, codeVerifier }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -61,15 +53,8 @@ declare const kick: (options: KickOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: KickProfile;
   } | null>;
   options: KickOptions;
 };

package/dist/social-providers/kick.mjs

@@ -7,6 +7,7 @@ const kick = (options) => {
 	return {
 		id: "kick",
 		name: "Kick",
+		accountSubject: ({ profile }) => profile.user_id,
 		createAuthorizationURL({ state, scopes, redirectURI, codeVerifier, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["user:read"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -52,7 +53,6 @@ const kick = (options) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.user_id,
 					name: profile.name,
 					email: profile.email,
 					image: profile.profile_picture,

package/dist/social-providers/line.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/line.d.ts
 interface LineIdTokenPayload {
   iss: string;
@@ -33,14 +34,9 @@ interface LineOptions extends ProviderOptions<LineUserInfo | LineIdTokenPayload>
 declare const line: (options: LineOptions) => {
   id: "line";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    loginHint,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<LineIdTokenPayload | LineUserInfo>) => string;
+  accountIssuer: string;
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -50,11 +46,7 @@ declare const line: (options: LineOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -74,36 +66,8 @@ declare const line: (options: LineOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
-  } | {
-    user: {
-      id: any;
-      name: any;
-      email: any;
-      image: any;
-      emailVerified: false;
-    } | {
-      id: any;
-      name: any;
-      email: any;
-      image: any;
-      emailVerified: boolean;
-    } | {
-      id: any;
-      name: any;
-      email: any;
-      image: any;
-      emailVerified: boolean;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: LineIdTokenPayload | LineUserInfo;
   } | null>;
   options: LineOptions;
 };

package/dist/social-providers/line.mjs

@@ -21,6 +21,8 @@ const line = (options) => {
 	return {
 		id: "line",
 		name: "LINE",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: "https://access.line.me",
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"openid",
@@ -87,15 +89,11 @@ const line = (options) => {
 			}
 			if (!profile) return null;
 			const userMap = await options.mapProfileToUser?.(profile);
-			const id = profile.sub || profile.userId;
-			const name = profile.name || profile.displayName || "";
-			const image = profile.picture || profile.pictureUrl || void 0;
 			return {
 				user: {
-					id,
-					name,
+					name: profile.name || "",
 					email: profile.email,
-					image,
+					image: profile.picture,
 					emailVerified: false,
 					...userMap
 				},

package/dist/social-providers/linear.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/linear.d.ts
 interface LinearUser {
   id: string;
@@ -20,13 +21,8 @@ interface LinearOptions extends ProviderOptions<LinearUser> {
 declare const linear: (options: LinearOptions) => {
   id: "linear";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    loginHint,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<LinearUser>) => string;
+  createAuthorizationURL({ state, scopes, loginHint, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -36,10 +32,7 @@ declare const linear: (options: LinearOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -56,15 +49,8 @@ declare const linear: (options: LinearOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: LinearUser;
   } | null>;
   options: LinearOptions;
 };

package/dist/social-providers/linear.mjs

@@ -8,6 +8,7 @@ const linear = (options) => {
 	return {
 		id: "linear",
 		name: "Linear",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({ state, scopes, loginHint, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["read"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -69,7 +70,6 @@ const linear = (options) => {
 			const userMap = await options.mapProfileToUser?.(userData);
 			return {
 				user: {
-					id: profile.data.viewer.id,
 					name: profile.data.viewer.name,
 					email: profile.data.viewer.email,
 					image: profile.data.viewer.avatarUrl,

package/dist/social-providers/linkedin.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/linkedin.d.ts
 interface LinkedInProfile {
   sub: string;
@@ -19,13 +20,8 @@ interface LinkedInOptions extends ProviderOptions<LinkedInProfile> {
 declare const linkedin: (options: LinkedInOptions) => {
   id: "linkedin";
   name: string;
-  createAuthorizationURL: ({
-    state,
-    scopes,
-    redirectURI,
-    loginHint,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<LinkedInProfile>) => string;
+  createAuthorizationURL: ({ state, scopes, redirectURI, loginHint, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -35,10 +31,7 @@ declare const linkedin: (options: LinkedInOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }) => Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -55,15 +48,8 @@ declare const linkedin: (options: LinkedInOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: LinkedInProfile;
   } | null>;
   options: LinkedInOptions;
 };

package/dist/social-providers/linkedin.mjs

@@ -9,6 +9,7 @@ const linkedin = (options) => {
 	return {
 		id: "linkedin",
 		name: "Linkedin",
+		accountSubject: ({ profile }) => profile.sub,
 		createAuthorizationURL: async ({ state, scopes, redirectURI, loginHint, additionalParams }) => {
 			const _scopes = options.disableDefaultScope ? [] : [
 				"profile",
@@ -57,7 +58,6 @@ const linkedin = (options) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.sub,
 					name: profile.name,
 					email: profile.email,
 					emailVerified: profile.email_verified ?? false,

package/dist/social-providers/microsoft-entra-id.d.mts

@@ -1,7 +1,6 @@
 import { ClientAssertionGetter } from "../oauth2/client-assertion.mjs";
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
-import * as jose from "jose";
-
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/microsoft-entra-id.d.ts
 /**
  * @see [Microsoft Identity Platform - Optional claims reference](https://learn.microsoft.com/en-us/entra/identity-platform/optional-claims-reference)
@@ -139,6 +138,8 @@ interface MicrosoftOptions extends ProviderOptions<MicrosoftEntraIDProfile> {
 declare const microsoft: (options: MicrosoftOptions) => {
   id: "microsoft";
   name: string;
+  accountSubject: ({ profile }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
+  accountIssuer: ({ profile }: OAuthAccountKeyContext<MicrosoftEntraIDProfile>) => string;
   createAuthorizationURL(data: {
     state: string;
     codeVerifier: string;
@@ -149,18 +150,14 @@ declare const microsoft: (options: MicrosoftOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode({ code, codeVerifier, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
   }): Promise<OAuth2Tokens>;
   idToken: {
-    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    jwks: (header: import("jose").JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
     audience: string | string[];
     maxTokenAge: string;
     /**
@@ -190,15 +187,8 @@ declare const microsoft: (options: MicrosoftOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: MicrosoftEntraIDProfile;
   } | null>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   options: MicrosoftOptions;

package/dist/social-providers/microsoft-entra-id.mjs

@@ -29,6 +29,8 @@ const microsoft = (options) => {
 	return {
 		id: "microsoft",
 		name: "Microsoft EntraID",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: ({ profile }) => profile.iss,
 		createAuthorizationURL(data) {
 			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("Client Id is required for Microsoft Entra ID. Make sure to provide it in the options.");
@@ -70,7 +72,21 @@ const microsoft = (options) => {
 			jwks: (header) => getMicrosoftPublicKey(header.kid, tenant, authority),
 			audience: options.clientId,
 			maxTokenAge: "1h",
+			/**
+			* Issuer varies per tenant for multi-tenant endpoints, so only validate it for
+			* specific tenants.
+			* @see https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols#endpoints
+			*/
 			issuer: tenant !== "common" && tenant !== "organizations" && tenant !== "consumers" ? `${authority}/${tenant}/v2.0` : void 0,
+			/**
+			* The multi-tenant endpoints (common/organizations/consumers) skip the
+			* issuer check above because the issuer varies per tenant, and the
+			* organizations and consumers JWKS sets overlap. Enforce the tenant
+			* binding explicitly so a token from a disallowed account class cannot
+			* pass: the issuer must name the token's own tenant, and the account
+			* class must match the configured restriction.
+			* @see https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference
+			*/
 			verifyClaims: (claims) => {
 				const tid = claims.tid;
 				if (typeof tid !== "string" || claims.iss !== `${authority}/${tid}/v2.0`) return false;
@@ -90,7 +106,8 @@ const microsoft = (options) => {
 					if (options.disableProfilePhoto || !context.response.ok) return;
 					try {
 						const pictureBuffer = await context.response.clone().arrayBuffer();
-						user.picture = `data:image/jpeg;base64, ${base64.encode(pictureBuffer)}`;
+						const pictureBase64 = base64.encode(pictureBuffer);
+						user.picture = `data:image/jpeg;base64, ${pictureBase64}`;
 					} catch (e) {
 						logger.error(e && typeof e === "object" && "name" in e ? e.name : "", e);
 					}
@@ -100,7 +117,6 @@ const microsoft = (options) => {
 			const emailVerified = user.email_verified !== void 0 ? user.email_verified : user.email && (user.verified_primary_email?.includes(user.email) || user.verified_secondary_email?.includes(user.email)) ? true : false;
 			return {
 				user: {
-					id: user.sub,
 					name: user.name,
 					email: user.email,
 					image: user.picture,

package/dist/social-providers/naver.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/naver.d.ts
 interface NaverProfile {
   /** API response result code */
@@ -6,15 +7,25 @@ interface NaverProfile {
   /** API response message */
   message: string;
   response: {
-    /** Unique Naver user identifier */id: string; /** User nickname */
-    nickname: string; /** User real name */
-    name: string; /** User email address */
-    email: string; /** Gender (F: female, M: male, U: unknown) */
-    gender: string; /** Age range */
-    age: string; /** Birthday (MM-DD format) */
-    birthday: string; /** Birth year */
-    birthyear: string; /** Profile image URL */
-    profile_image: string; /** Mobile phone number */
+    /** Unique Naver user identifier */
+    id: string;
+    /** User nickname */
+    nickname: string;
+    /** User real name */
+    name: string;
+    /** User email address */
+    email: string;
+    /** Gender (F: female, M: male, U: unknown) */
+    gender: string;
+    /** Age range */
+    age: string;
+    /** Birthday (MM-DD format) */
+    birthday: string;
+    /** Birth year */
+    birthyear: string;
+    /** Profile image URL */
+    profile_image: string;
+    /** Mobile phone number */
     mobile: string;
   };
 }
@@ -24,12 +35,8 @@ interface NaverOptions extends ProviderOptions<NaverProfile> {
 declare const naver: (options: NaverOptions) => {
   id: "naver";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<NaverProfile>) => string;
+  createAuthorizationURL({ state, scopes, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -39,10 +46,7 @@ declare const naver: (options: NaverOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -59,30 +63,11 @@ declare const naver: (options: NaverOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: NaverProfile;
   } | {
     user: {
-      id: string;
-      name: string;
-      email: string;
-      image: string;
-      emailVerified: boolean;
-    } | {
-      id: string;
-      name: string;
-      email: string | null;
-      image: string;
-      emailVerified: boolean;
-    } | {
-      id: string;
+      id?: never;
       name: string;
       email: string | null;
       image: string;

package/dist/social-providers/naver.mjs

@@ -8,6 +8,7 @@ const naver = (options) => {
 	return {
 		id: "naver",
 		name: "Naver",
+		accountSubject: ({ profile }) => profile.response.id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["profile", "email"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -49,7 +50,6 @@ const naver = (options) => {
 			const res = profile.response || {};
 			return {
 				user: {
-					id: res.id,
 					name: res.name || res.nickname || "",
 					email: res.email,
 					image: res.profile_image,

package/dist/social-providers/notion.d.mts

@@ -1,4 +1,5 @@
-import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/notion.d.ts
 interface NotionProfile {
   object: "user";
@@ -16,13 +17,8 @@ interface NotionOptions extends ProviderOptions<NotionProfile> {
 declare const notion: (options: NotionOptions) => {
   id: "notion";
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    loginHint,
-    redirectURI,
-    additionalParams
-  }: {
+  accountSubject: ({ profile }: OAuthAccountKeyContext<NotionProfile>) => string;
+  createAuthorizationURL({ state, scopes, loginHint, redirectURI, additionalParams }: {
     state: string;
     codeVerifier: string;
     scopes?: string[] | undefined;
@@ -32,10 +28,7 @@ declare const notion: (options: NotionOptions) => {
     idTokenNonce?: string | undefined;
     additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
     redirectURI: string;
     codeVerifier?: string | undefined;
@@ -52,15 +45,8 @@ declare const notion: (options: NotionOptions) => {
       email?: string;
     } | undefined;
   }): Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: NotionProfile;
   } | null>;
   options: NotionOptions;
 };