@better-auth/core 1.7.0-rc.1 → 1.7.0-rc.3

package/dist/env/logger.d.mts

@@ -1,32 +1,32 @@
 //#region src/env/logger.d.ts
 declare const TTY_COLORS: {
-  readonly reset: "\u001B[0m";
-  readonly bright: "\u001B[1m";
-  readonly dim: "\u001B[2m";
-  readonly undim: "\u001B[22m";
-  readonly underscore: "\u001B[4m";
-  readonly blink: "\u001B[5m";
-  readonly reverse: "\u001B[7m";
-  readonly hidden: "\u001B[8m";
+  readonly reset: "";
+  readonly bright: "";
+  readonly dim: "";
+  readonly undim: "";
+  readonly underscore: "";
+  readonly blink: "";
+  readonly reverse: "";
+  readonly hidden: "";
   readonly fg: {
-    readonly black: "\u001B[30m";
-    readonly red: "\u001B[31m";
-    readonly green: "\u001B[32m";
-    readonly yellow: "\u001B[33m";
-    readonly blue: "\u001B[34m";
-    readonly magenta: "\u001B[35m";
-    readonly cyan: "\u001B[36m";
-    readonly white: "\u001B[37m";
+    readonly black: "";
+    readonly red: "";
+    readonly green: "";
+    readonly yellow: "";
+    readonly blue: "";
+    readonly magenta: "";
+    readonly cyan: "";
+    readonly white: "";
   };
   readonly bg: {
-    readonly black: "\u001B[40m";
-    readonly red: "\u001B[41m";
-    readonly green: "\u001B[42m";
-    readonly yellow: "\u001B[43m";
-    readonly blue: "\u001B[44m";
-    readonly magenta: "\u001B[45m";
-    readonly cyan: "\u001B[46m";
-    readonly white: "\u001B[47m";
+    readonly black: "";
+    readonly red: "";
+    readonly green: "";
+    readonly yellow: "";
+    readonly blue: "";
+    readonly magenta: "";
+    readonly cyan: "";
+    readonly white: "";
   };
 };
 type LogLevel = "debug" | "info" | "success" | "warn" | "error";
@@ -39,7 +39,7 @@ interface Logger {
   log?: ((level: Exclude<LogLevel, "success">, message: string, ...args: any[]) => void) | undefined;
 }
 type LogHandlerParams = Parameters<NonNullable<Logger["log"]>> extends [LogLevel, ...infer Rest] ? Rest : never;
-type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void } & {
+type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void; } & {
   get level(): LogLevel;
 };
 declare const createLogger: (options?: Logger | undefined) => InternalLogger;

package/dist/error/codes.d.mts

@@ -1,5 +1,4 @@
 import { RawError } from "../utils/error-codes.mjs";
-
 //#region src/error/codes.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {

package/dist/error/index.d.mts

@@ -1,6 +1,5 @@
 import { APIErrorCode, BASE_ERROR_CODES } from "./codes.mjs";
 import { APIError as APIError$1 } from "better-call/error";
-
 //#region src/error/index.d.ts
 declare class BetterAuthError extends Error {
   constructor(message: string, options?: {

package/dist/index.d.mts

@@ -6,4 +6,4 @@ import { SecretConfig } from "./types/secret.mjs";
 import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./types/plugin-client.mjs";
 import { StandardSchemaV1 } from "./types/index.mjs";
-export { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };

package/dist/instrumentation/attributes.d.mts

@@ -1,5 +1,4 @@
 import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE } from "@opentelemetry/semantic-conventions";
-
 //#region src/instrumentation/attributes.d.ts
 /** Operation identifier (e.g. getSession, signUpWithEmailAndPassword). Uses endpoint operationId when set, otherwise the endpoint key. */
 declare const ATTR_OPERATION_ID: "better_auth.operation_id";

package/dist/instrumentation/pure.index.d.mts

@@ -1,5 +1,4 @@
 import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID } from "./attributes.mjs";
-
 //#region src/instrumentation/pure.index.d.ts
 declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => T): T;
 declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => Promise<T>): Promise<T>;

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.0-rc.1";
+const INSTRUMENTATION_VERSION = "1.7.0-rc.3";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/oauth2/authorization-params.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-
 //#region src/oauth2/authorization-params.d.ts
 /**
  * Zod schema for the `additionalParams` field on social sign-in and

package/dist/oauth2/client-assertion.d.mts

@@ -1,4 +1,5 @@
 import { Awaitable } from "../types/helper.mjs";
+import "../types/index.mjs";
 //#region src/oauth2/client-assertion.d.ts
 /** Asymmetric signing algorithms compatible with private_key_jwt (RFC 7523). */
 declare const PRIVATE_KEY_JWT_SIGNING_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"];
@@ -35,15 +36,7 @@ interface PrivateKeyJwtClientAssertionGetterOptions {
  * - jti=unique
  * - iat=now
  */
-declare function signPrivateKeyJwtClientAssertion({
-  clientId,
-  tokenEndpoint,
-  privateKeyJwk,
-  privateKeyPem,
-  kid,
-  algorithm,
-  expiresIn
-}: {
+declare function signPrivateKeyJwtClientAssertion({ clientId, tokenEndpoint, privateKeyJwk, privateKeyPem, kid, algorithm, expiresIn }: {
   clientId: string;
   tokenEndpoint: string;
   privateKeyJwk?: JsonWebKey;
@@ -64,10 +57,7 @@ declare function createPrivateKeyJwtClientAssertionGetter(options: PrivateKeyJwt
 /**
  * Resolves a client assertion getter into `client_assertion` + `client_assertion_type` params for injection into a token request body.
  */
-declare function resolveClientAssertionParams({
-  getClientAssertion,
-  context
-}: {
+declare function resolveClientAssertionParams({ getClientAssertion, context }: {
   getClientAssertion: ClientAssertionGetter;
   context: ClientAssertionContext;
 }): Promise<Record<string, string>>;

package/dist/oauth2/client-credentials-token.d.mts

@@ -1,7 +1,7 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
-
 //#region src/oauth2/client-credentials-token.d.ts
 interface ClientCredentialsTokenRequestInput {
   options: AwaitableFunction<ProviderOptions>;
@@ -15,24 +15,10 @@ interface ClientCredentialsTokenInput extends ClientCredentialsTokenRequestInput
   tokenEndpoint: string;
   scope: string;
 }
-declare function clientCredentialsTokenRequest({
-  options,
-  scope,
-  authentication,
-  tokenEndpointAuth,
-  tokenEndpoint,
-  resource
-}: ClientCredentialsTokenRequestInput): Promise<{
+declare function clientCredentialsTokenRequest({ options, scope, authentication, tokenEndpointAuth, tokenEndpoint, resource }: ClientCredentialsTokenRequestInput): Promise<{
   body: URLSearchParams;
   headers: Record<string, string>;
 }>;
-declare function clientCredentialsToken({
-  options,
-  tokenEndpoint,
-  scope,
-  authentication,
-  tokenEndpointAuth,
-  resource
-}: ClientCredentialsTokenInput): Promise<OAuth2Tokens>;
+declare function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, tokenEndpointAuth, resource }: ClientCredentialsTokenInput): Promise<OAuth2Tokens>;
 //#endregion
 export { clientCredentialsToken, clientCredentialsTokenRequest };

package/dist/oauth2/client-credentials-token.mjs

@@ -57,10 +57,7 @@ async function clientCredentialsToken({ options, tokenEndpoint, scope, authentic
 		tokenType: data.token_type,
 		scopes: data.scope?.split(" ")
 	};
-	if (data.expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
-	}
+	if (data.expires_in) tokens.accessTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.expires_in * 1e3);
 	return tokens;
 }
 //#endregion

package/dist/oauth2/create-authorization-url.d.mts

@@ -1,5 +1,7 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { ProviderOptions } from "./oauth-provider.mjs";
+import "./index.mjs";
 //#region src/oauth2/create-authorization-url.d.ts
 /**
  * Query-parameter names that are populated by the framework as part of the
@@ -9,27 +11,7 @@ import { ProviderOptions } from "./oauth-provider.mjs";
  */
 declare const RESERVED_AUTHORIZATION_PARAMS: readonly ["state", "client_id", "redirect_uri", "response_type", "code_challenge", "code_challenge_method", "nonce", "scope"];
 declare const RESERVED_AUTHORIZATION_PARAMS_SET: ReadonlySet<string>;
-declare function createAuthorizationURL({
-  id,
-  options,
-  authorizationEndpoint,
-  state,
-  codeVerifier,
-  scopes,
-  claims,
-  redirectURI,
-  duration,
-  prompt,
-  accessType,
-  responseType,
-  display,
-  loginHint,
-  nonce,
-  hd,
-  responseMode,
-  additionalParams,
-  scopeJoiner
-}: {
+declare function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, nonce, hd, responseMode, additionalParams, scopeJoiner }: {
   id: string;
   options: AwaitableFunction<ProviderOptions>;
   redirectURI: string;

package/dist/oauth2/dpop.d.mts

@@ -1,5 +1,4 @@
 import { JWK, JWTPayload } from "jose";
-
 //#region src/oauth2/dpop.d.ts
 declare const DPOP_AUTHORIZATION_SCHEME = "DPoP";
 declare const BEARER_AUTHORIZATION_SCHEME = "Bearer";
@@ -86,18 +85,7 @@ declare function deriveDpopJkt(jwk: JWK): Promise<string>;
  */
 declare function getConfirmationJkt(confirmation: unknown): string | undefined;
 declare function getDpopJktFromPayload(payload: JWTPayload): string | undefined;
-declare function verifyDpopProof({
-  proofJwt,
-  method,
-  url,
-  accessToken,
-  expectedJkt,
-  requireAth,
-  nowSeconds,
-  proofMaxAgeSeconds,
-  signingAlgorithms,
-  replayStore
-}: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
+declare function verifyDpopProof({ proofJwt, method, url, accessToken, expectedJkt, requireAth, nowSeconds, proofMaxAgeSeconds, signingAlgorithms, replayStore }: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
 type DpopBindingErrorCode = "invalid_token" | "invalid_dpop_proof";
 type DpopBindingError = Error & {
   code: DpopBindingErrorCode;
@@ -128,15 +116,6 @@ interface EnforceDpopBindingParams {
  * `invalid_token` / `invalid_dpop_proof` code into their own transport. Returns
  * normally for a valid bearer token (no `cnf.jkt`, no DPoP scheme).
  */
-declare function enforceDpopBinding({
-  payload,
-  authorization,
-  proofJwt,
-  method,
-  url,
-  replayStore,
-  proofMaxAgeSeconds,
-  signingAlgorithms
-}: EnforceDpopBindingParams): Promise<void>;
+declare function enforceDpopBinding({ payload, authorization, proofJwt, method, url, replayStore, proofMaxAgeSeconds, signingAlgorithms }: EnforceDpopBindingParams): Promise<void>;
 //#endregion
 export { AccessTokenAuthorization, AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, DpopBindingError, DpopBindingErrorCode, DpopProofError, DpopProofErrorCode, DpopReplayReservation, DpopReplayReservations, DpopReplayStore, DpopSigningAlgorithm, EnforceDpopBindingParams, VerifiedDpopProof, VerifyDpopProofOptions, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, deriveDpopAth, deriveDpopJkt, enforceDpopBinding, getConfirmationJkt, getDpopJktFromPayload, isDpopBindingError, isDpopProofError, normalizeDpopHtu, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof };

package/dist/oauth2/dpop.mjs

@@ -12,7 +12,7 @@ const DPOP_SIGNING_ALGORITHMS = [
 ];
 const DEFAULT_DPOP_PROOF_MAX_AGE_SECONDS = 300;
 const MAX_DPOP_JTI_LENGTH = 512;
-const JWK_PRIVATE_FIELDS = new Set([
+const JWK_PRIVATE_FIELDS = /* @__PURE__ */ new Set([
 	"d",
 	"p",
 	"q",

package/dist/oauth2/index.d.mts

@@ -1,7 +1,7 @@
 import { additionalAuthorizationParamsSchema } from "./authorization-params.mjs";
 import { decodeBasicCredentials, encodeBasicCredentials } from "./basic-credentials.mjs";
 import { CLIENT_ASSERTION_TYPE, ClientAssertionContext, ClientAssertionGetter, ClientAssertionGrantType, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, PrivateKeyJwtClientAssertionGetterOptions, PrivateKeyJwtSigningAlgorithm, createPrivateKeyJwtClientAssertionGetter, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion } from "./client-assertion.mjs";
-import { OAuth2Tokens, OAuth2UserInfo, OAuthIdTokenConfig, OAuthProvider, OAuthRefreshContext, ProviderOptions } from "./oauth-provider.mjs";
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, OAuthAccountSubject, OAuthIdTokenConfig, OAuthMappedUser, OAuthProvider, OAuthRefreshContext, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
 import { clientCredentialsToken, clientCredentialsTokenRequest } from "./client-credentials-token.mjs";
 import { RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, createAuthorizationURL } from "./create-authorization-url.mjs";
@@ -9,6 +9,6 @@ import { AccessTokenAuthorization, AccessTokenAuthorizationScheme, BEARER_AUTHOR
 import { refreshAccessToken, refreshAccessTokenRequest } from "./refresh-access-token.mjs";
 import { applyDefaultAccessTokenExpiry, generateCodeChallenge, getOAuth2Tokens, getPrimaryClientId, mergeScopes } from "./utils.mjs";
 import { authorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
-import { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken } from "./verify.mjs";
+import { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken } from "./verify.mjs";
 import { supportsIdTokenSignIn, verifyProviderIdToken } from "./verify-id-token.mjs";
-export { type AccessTokenAuthorization, type AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, type ClientAssertionContext, type ClientAssertionGetter, type ClientAssertionGrantType, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, type DpopBindingError, type DpopBindingErrorCode, type DpopProofError, type DpopProofErrorCode, type DpopReplayReservation, type DpopReplayReservations, type DpopReplayStore, type DpopSigningAlgorithm, type EnforceDpopBindingParams, type OAuth2Tokens, type OAuth2UserInfo, type OAuthIdTokenConfig, type OAuthProvider, type OAuthRefreshContext, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, type PrivateKeyJwtClientAssertionGetterOptions, type PrivateKeyJwtSigningAlgorithm, type ProviderOptions, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, type ResourceRequestInput, type TokenEndpointAuth, type TokenEndpointAuthMethod, type TokenEndpointSecretAuthentication, type VerifiedDpopProof, type VerifyAccessTokenOptions, type VerifyAccessTokenRequestOptions, type VerifyDpopProofOptions, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };
+export { type AccessTokenAuthorization, type AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, type ClientAssertionContext, type ClientAssertionGetter, type ClientAssertionGrantType, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, type DpopBindingError, type DpopBindingErrorCode, type DpopProofError, type DpopProofErrorCode, type DpopReplayReservation, type DpopReplayReservations, type DpopReplayStore, type DpopSigningAlgorithm, type EnforceDpopBindingParams, type OAuth2Tokens, type OAuth2UserInfo, type OAuthAccountKeyContext, type OAuthAccountSubject, type OAuthIdTokenConfig, type OAuthMappedUser, type OAuthProvider, type OAuthRefreshContext, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, type PrivateKeyJwtClientAssertionGetterOptions, type PrivateKeyJwtSigningAlgorithm, type ProviderOptions, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, type ResourceRequestInput, type TokenEndpointAuth, type TokenEndpointAuthMethod, type TokenEndpointSecretAuthentication, type VerifiedDpopProof, type VerifyAccessTokenOptions, type VerifyAccessTokenRequestOptions, type VerifyDpopProofOptions, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createInsufficientScopeError, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, isInsufficientScopeError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };

package/dist/oauth2/index.mjs

@@ -7,6 +7,6 @@ import { clientCredentialsToken, clientCredentialsTokenRequest } from "./client-
 import { BEARER_AUTHORIZATION_SCHEME, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, deriveDpopAth, deriveDpopJkt, enforceDpopBinding, getConfirmationJkt, getDpopJktFromPayload, isDpopBindingError, isDpopProofError, normalizeDpopHtu, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof } from "./dpop.mjs";
 import { refreshAccessToken, refreshAccessTokenRequest } from "./refresh-access-token.mjs";
 import { authorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
-import { getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken } from "./verify.mjs";
+import { createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken } from "./verify.mjs";
 import { supportsIdTokenSignIn, verifyProviderIdToken } from "./verify-id-token.mjs";
-export { BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };
+export { BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createInsufficientScopeError, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, isInsufficientScopeError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };

package/dist/oauth2/oauth-provider.d.mts

@@ -1,6 +1,7 @@
 import { Awaitable, LiteralString } from "../types/helper.mjs";
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { JWTVerifyGetKey } from "jose";
-
 //#region src/oauth2/oauth-provider.d.ts
 /**
  * id_token verification config for a social provider.
@@ -16,10 +17,14 @@ type OAuthIdTokenConfig = {
    * `createRemoteJWKSet` resolver or a key-resolving function
    * `(protectedHeader) => key`.
    */
-  jwks: JWTVerifyGetKey; /** Expected `iss`. Omit for providers whose issuer varies per tenant. */
-  issuer?: (string | string[]) | undefined; /** Expected `aud`, usually the client ID. */
-  audience: string | string[]; /** Permitted JWS algorithms. Defaults to the token's `alg` header. */
-  algorithms?: string[] | undefined; /** Maximum token age passed to jose (e.g. `"1h"`). */
+  jwks: JWTVerifyGetKey;
+  /** Expected `iss`. Omit for providers whose issuer varies per tenant. */
+  issuer?: (string | string[]) | undefined;
+  /** Expected `aud`, usually the client ID. */
+  audience: string | string[];
+  /** Permitted JWS algorithms. Defaults to the token's `alg` header. */
+  algorithms?: string[] | undefined;
+  /** Maximum token age passed to jose (e.g. `"1h"`). */
   maxTokenAge?: string | undefined;
   /**
    * How the `nonce` claim is compared to the expected nonce.
@@ -46,7 +51,7 @@ type OAuthIdTokenConfig = {
    * Custom verifier for providers that cannot verify against a local JWKS, such as a
    * remote verification endpoint (e.g. LINE).
    */
-  verify: (token: string, nonce?: string) => Promise<boolean>;
+  verify: (token: string, nonce?: string, ctx?: GenericEndpointContext) => Promise<boolean>;
 };
 interface OAuth2Tokens {
   tokenType?: string | undefined;
@@ -62,13 +67,46 @@ interface OAuth2Tokens {
    */
   raw?: Record<string, unknown> | undefined;
 }
+/** Mutable local-user attributes normalized from an OAuth provider profile. */
 type OAuth2UserInfo = {
-  id: string | number;
+  /** Provider identity belongs in raw profile data and `accountSubject`. */
+  id?: never;
   name?: string | undefined;
   email?: (string | null) | undefined;
   image?: string | undefined;
   emailVerified: boolean;
 };
+/**
+ * Verified provider data available when deriving a stable OAuth account key.
+ *
+ * Account-key resolvers must use the raw provider profile or verified token
+ * response. They never receive the mapped local user, so profile mapping
+ * cannot redefine provider identity.
+ */
+interface OAuthAccountKeyContext<Profile extends object = object> {
+  tokens: OAuth2Tokens;
+  profile: Profile;
+}
+/**
+ * Resolves one part of an account key from a profile returned by the same
+ * provider. The method-derived callback keeps that profile pairing intact when
+ * providers with different profile shapes share an `OAuthProvider[]`.
+ */
+type OAuthAccountKeyResolver<Profile extends object, Value> = {
+  resolve(context: OAuthAccountKeyContext<Profile>): Awaitable<Value>;
+}["resolve"];
+/** Resolves the stable provider subject used to build an OAuth account key. */
+type OAuthAccountSubject<Profile extends object = object> = OAuthAccountKeyResolver<Profile, string | number>;
+/** Mutable local-user attributes returned by `mapProfileToUser`. */
+type OAuthMappedUser = {
+  /** Provider identity is defined by `accountSubject`, not local user mapping. */
+  id?: never;
+  name?: string;
+  email?: string | null;
+  image?: string;
+  emailVerified?: boolean;
+  [key: string]: unknown;
+};
 /**
  * Request metadata available to provider refresh hooks.
  *
@@ -80,7 +118,7 @@ interface OAuthRefreshContext {
   headers?: Headers | undefined;
   request?: Request | undefined;
 }
-interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
+interface OAuthProvider<T extends object = object, O extends object = Partial<ProviderOptions>> {
   id: LiteralString;
   /**
    * Optional path under the resolved per-request `baseURL` where this
@@ -115,6 +153,15 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
     additionalParams?: Record<string, string> | undefined;
   }) => Awaitable<URL>;
   name: string;
+  /**
+   * Stable subject that identifies the provider account.
+   *
+   * Read this value from the raw, provider-verified profile. For OpenID
+   * Connect providers, use the `sub` claim. For OAuth providers, use the
+   * provider's documented immutable user identifier. Never derive this value
+   * from `mapProfileToUser`.
+   */
+  accountSubject: OAuthAccountSubject<T>;
   validateAuthorizationCode: (data: {
     code: string;
     redirectURI: string;
@@ -152,6 +199,15 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    */
   refreshAccessToken?: ((refreshToken: string, ctx?: OAuthRefreshContext) => Promise<OAuth2Tokens>) | undefined;
   revokeToken?: ((token: string) => Promise<void>) | undefined;
+  /**
+   * Builds an OpenID Connect RP-Initiated Logout URL for this provider.
+   * Returns `null` when provider logout is unavailable or disabled.
+   */
+  createEndSessionURL?: ((data: {
+    idToken?: string | null | undefined;
+    postLogoutRedirectURI?: string | undefined;
+    state?: string | undefined;
+  }) => Awaitable<URL | null>) | undefined;
   /**
    * Declarative id_token verification config consumed by the shared
    * `verifyProviderIdToken` verifier. Providers set this instead of implementing a boolean
@@ -164,6 +220,16 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    * against this value to prevent authorization server mix-up attacks.
    */
   issuer?: string | undefined;
+  /**
+   * Stable issuer used with the provider subject to recognize an account.
+   *
+   * Use the validated OpenID Connect issuer for OIDC providers. A resolver is
+   * supported for tenant-specific issuers and receives only provider-verified
+   * data. OAuth providers without an issuer omit this property and are scoped
+   * to the synthetic `local:oauth:<encoded providerId>` issuer, where the
+   * provider ID segment is percent-encoded.
+   */
+  accountIssuer?: string | OAuthAccountKeyResolver<T, string> | undefined;
   /**
    * Require shared OAuth redirect routes to bind ID-token verification to an
    * authorization request nonce. When true, routes generate `idTokenNonce`,
@@ -196,7 +262,14 @@ interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O e
    */
   options?: O | undefined;
 }
-type ProviderOptions<Profile extends Record<string, any> = any> = {
+/**
+ * Maps a provider-specific profile while remaining compatible with the erased
+ * profile type used by shared OAuth helpers.
+ */
+type OAuthProfileMapper<Profile extends object> = {
+  map(profile: Profile): Awaitable<OAuthMappedUser>;
+}["map"];
+type ProviderOptions<Profile extends object = object> = {
   /**
    * The client ID of your application.
    *
@@ -240,22 +313,21 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
    */
   disableIdTokenSignIn?: boolean | undefined;
   /**
-   * verifyIdToken function to verify the id token
+   * verifyIdToken function to verify the id token.
+   *
+   * The optional endpoint context exposes request metadata to custom
+   * verifiers without coupling built-in provider verification to a runtime.
    */
-  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  verifyIdToken?: ((token: string, nonce?: string, ctx?: GenericEndpointContext) => Promise<boolean>) | undefined;
   /**
    * Custom function to get user info from the provider
+   *
+   * `data` must preserve the declared raw profile shape because account-key
+   * resolvers consume it after this hook returns.
    */
   getUserInfo?: ((token: OAuth2Tokens) => Promise<{
-    user: {
-      id: string;
-      name?: string;
-      email?: string | null;
-      image?: string;
-      emailVerified: boolean;
-      [key: string]: any;
-    };
-    data: any;
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: Profile;
   } | null>) | undefined;
   /**
    * Custom function to refresh a token
@@ -265,21 +337,7 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
    * Custom function to map the provider profile to a
    * user.
    */
-  mapProfileToUser?: ((profile: Profile) => {
-    id?: string;
-    name?: string;
-    email?: string | null;
-    image?: string;
-    emailVerified?: boolean;
-    [key: string]: any;
-  } | Promise<{
-    id?: string;
-    name?: string;
-    email?: string | null;
-    image?: string;
-    emailVerified?: boolean;
-    [key: string]: any;
-  }>) | undefined;
+  mapProfileToUser?: OAuthProfileMapper<Profile> | undefined;
   /**
    * Disable implicit sign up for new users. When set to true for the provider,
    * sign-in need to be called with with requestSignUp as true to create new users.
@@ -329,4 +387,4 @@ type ProviderOptions<Profile extends Record<string, any> = any> = {
   requireEmailVerification?: boolean | undefined;
 };
 //#endregion
-export { OAuth2Tokens, OAuth2UserInfo, OAuthIdTokenConfig, OAuthProvider, OAuthRefreshContext, ProviderOptions };
+export { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, OAuthAccountSubject, OAuthIdTokenConfig, OAuthMappedUser, OAuthProvider, OAuthRefreshContext, ProviderOptions };

package/dist/oauth2/refresh-access-token.d.mts

@@ -1,7 +1,7 @@
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
-
 //#region src/oauth2/refresh-access-token.d.ts
 interface RefreshAccessTokenRequestInput {
   refreshToken: string;
@@ -16,26 +16,10 @@ interface RefreshAccessTokenInput extends RefreshAccessTokenRequestInput {
   options: Partial<ProviderOptions>;
   tokenEndpoint: string;
 }
-declare function refreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  tokenEndpointAuth,
-  tokenEndpoint,
-  extraParams,
-  resource
-}: RefreshAccessTokenRequestInput): Promise<{
+declare function refreshAccessTokenRequest({ refreshToken, options, authentication, tokenEndpointAuth, tokenEndpoint, extraParams, resource }: RefreshAccessTokenRequestInput): Promise<{
   body: URLSearchParams;
   headers: Record<string, string>;
 }>;
-declare function refreshAccessToken({
-  refreshToken,
-  options,
-  tokenEndpoint,
-  authentication,
-  tokenEndpointAuth,
-  extraParams,
-  resource
-}: RefreshAccessTokenInput): Promise<OAuth2Tokens>;
+declare function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, tokenEndpointAuth, extraParams, resource }: RefreshAccessTokenInput): Promise<OAuth2Tokens>;
 //#endregion
 export { refreshAccessToken, refreshAccessTokenRequest };

package/dist/oauth2/refresh-access-token.mjs

@@ -2,7 +2,7 @@ import { parseScopeField } from "./utils.mjs";
 import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
 //#region src/oauth2/refresh-access-token.ts
-const BLOCKED_REFRESH_TOKEN_PARAMS_SET = new Set([
+const BLOCKED_REFRESH_TOKEN_PARAMS_SET = /* @__PURE__ */ new Set([
 	"grant_type",
 	"refresh_token",
 	"__proto__",
@@ -74,14 +74,8 @@ async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authen
 		scopes: parseScopeField(data.scope),
 		idToken: data.id_token
 	};
-	if (data.expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
-	}
-	if (data.refresh_token_expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.refreshTokenExpiresAt = new Date(now.getTime() + data.refresh_token_expires_in * 1e3);
-	}
+	if (data.expires_in) tokens.accessTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.expires_in * 1e3);
+	if (data.refresh_token_expires_in) tokens.refreshTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.refresh_token_expires_in * 1e3);
 	return tokens;
 }
 //#endregion

package/dist/oauth2/reject-redirects.mjs

@@ -1,7 +1,7 @@
 import { BetterAuthError } from "../error/index.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/reject-redirects.ts
-const httpRedirectStatuses = new Set([
+const httpRedirectStatuses = /* @__PURE__ */ new Set([
 	301,
 	302,
 	303,

package/dist/oauth2/token-endpoint-auth.d.mts

@@ -1,5 +1,4 @@
 import { ClientAssertionGetter } from "./client-assertion.mjs";
-
 //#region src/oauth2/token-endpoint-auth.d.ts
 type TokenEndpointAuth = {
   method: "none";

package/dist/oauth2/utils.d.mts

@@ -1,5 +1,4 @@
 import { OAuth2Tokens } from "./oauth-provider.mjs";
-
 //#region src/oauth2/utils.d.ts
 declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
 /**