@better-auth/core 1.7.0-rc.5 → 1.7.0-rc.6

package/dist/db/type.d.mts

@@ -1,15 +1,15 @@
 import { Awaitable, LiteralString, UnionToIntersection } from "../types/helper.mjs";
 import { BetterAuthOptions } from "../types/init-options.mjs";
-import "../types/index.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
+
 //#region src/db/type.d.ts
 type BaseModelNames = "user" | "account" | "session" | "verification";
 type ModelNames<T extends string = LiteralString> = BaseModelNames | T | "rate-limit";
 type InferDBValueType<T extends DBFieldType> = T extends "string" ? string : T extends "number" ? number : T extends "boolean" ? boolean : T extends "date" ? Date : T extends "json" ? Record<string, any> : T extends `${infer U}[]` ? U extends "string" ? string[] : number[] : T extends Array<any> ? T[number] : never;
 type InferDBFieldOutput<T extends DBFieldAttribute> = T["returned"] extends false ? never : T["required"] extends false ? InferDBValueType<T["type"]> | undefined | null : InferDBValueType<T["type"]>;
 type InferDBFieldInput<T extends DBFieldAttribute> = InferDBValueType<T["type"]>;
-type InferDBFieldsInput<Field> = Field extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Field[key]["required"] extends false ? never : Field[key]["defaultValue"] extends string | number | boolean | Date ? never : Field[key]["input"] extends false ? never : key]: InferDBFieldInput<Field[key]>; } & { [key in Key as Field[key]["input"] extends false ? never : key]?: InferDBFieldInput<Field[key]> | undefined | null; } : {};
-type InferDBFieldsOutput<Fields extends Record<string, DBFieldAttribute>> = Fields extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? key : never : key]: InferDBFieldOutput<Fields[key]>; } & { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? never : key : never]?: InferDBFieldOutput<Fields[key]> | null; } : never;
+type InferDBFieldsInput<Field> = Field extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Field[key]["required"] extends false ? never : Field[key]["defaultValue"] extends string | number | boolean | Date ? never : Field[key]["input"] extends false ? never : key]: InferDBFieldInput<Field[key]> } & { [key in Key as Field[key]["input"] extends false ? never : key]?: InferDBFieldInput<Field[key]> | undefined | null } : {};
+type InferDBFieldsOutput<Fields extends Record<string, DBFieldAttribute>> = Fields extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? key : never : key]: InferDBFieldOutput<Fields[key]> } & { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? never : key : never]?: InferDBFieldOutput<Fields[key]> | null } : never;
 type InferDBFieldsFromOptionsInput<DBOptions extends BetterAuthOptions["session"] | BetterAuthOptions["user"] | BetterAuthOptions["verification"] | BetterAuthOptions["account"] | BetterAuthOptions["rateLimit"]> = DBOptions extends {
   additionalFields: Record<string, DBFieldAttribute>;
 } ? InferDBFieldsInput<DBOptions["additionalFields"]> : {};
@@ -19,12 +19,12 @@ type InferDBFieldsFromOptions<DBOptions extends BetterAuthOptions["session"] | B
 type InferDBFieldsFromPluginsInput<ModelName extends string, Plugins extends unknown[] | undefined> = Plugins extends [] ? {} : Plugins extends [infer P, ...infer Rest] ? P extends {
   schema: { [key in ModelName]: {
     fields: infer Fields;
-  }; };
+  } };
 } ? Fields extends Record<string, DBFieldAttribute> ? UnionToIntersection<InferDBFieldsInput<Fields> & InferDBFieldsFromPluginsInput<ModelName, Rest>> : InferDBFieldsFromPluginsInput<ModelName, Rest> : InferDBFieldsFromPluginsInput<ModelName, Rest> : {};
 type InferDBFieldsFromPlugins<ModelName extends string, Plugins extends unknown[] | undefined> = Plugins extends [] ? {} : Plugins extends [infer P, ...infer Rest] ? P extends {
   schema: { [key in ModelName]: {
     fields: infer Fields;
-  }; };
+  } };
 } ? Fields extends Record<string, DBFieldAttribute> ? UnionToIntersection<InferDBFieldsOutput<Fields> & InferDBFieldsFromPlugins<ModelName, Rest>> : InferDBFieldsFromPlugins<ModelName, Rest> : InferDBFieldsFromPlugins<ModelName, Rest> : {};
 type DBFieldType = "string" | "number" | "boolean" | "date" | "json" | `${"string" | "number"}[]` | Array<LiteralString>;
 type DBPrimitive = string | number | boolean | Date | null | undefined | string[] | number[] | (Record<string, unknown> | unknown[]);
@@ -89,7 +89,8 @@ type DBFieldAttributeConfig = {
    */
   bigint?: boolean | undefined;
   /**
-   * A zod schema to validate the value.
+   * A Standard Schema to validate the value. Works with any Standard Schema
+   * library, such as Zod, Valibot or ArkType.
    */
   validator?: {
     input?: StandardSchemaV1;
@@ -132,8 +133,7 @@ type BetterAuthDBSchema = Record<string, {
   /**
    * The fields of the table
    */
-  fields: Record<string, DBFieldAttribute>;
-  /** Table-level indexes, including compound indexes. */
+  fields: Record<string, DBFieldAttribute>; /** Table-level indexes, including compound indexes. */
   indexes?: readonly DBTableIndex[] | undefined;
   /**
    * Whether to disable migrations for this table
@@ -173,14 +173,17 @@ interface SecondaryStorage {
   /**
    * Key to store
    */
+
   key: string,
   /**
    * Value to store
    */
+
   value: string,
   /**
    * Time to live in seconds
    */
+
   ttl?: number | undefined) => Awaitable<void | null | unknown>;
   /**
    *

package/dist/env/logger.d.mts

@@ -1,32 +1,32 @@
 //#region src/env/logger.d.ts
 declare const TTY_COLORS: {
-  readonly reset: "";
-  readonly bright: "";
-  readonly dim: "";
-  readonly undim: "";
-  readonly underscore: "";
-  readonly blink: "";
-  readonly reverse: "";
-  readonly hidden: "";
+  readonly reset: "\u001B[0m";
+  readonly bright: "\u001B[1m";
+  readonly dim: "\u001B[2m";
+  readonly undim: "\u001B[22m";
+  readonly underscore: "\u001B[4m";
+  readonly blink: "\u001B[5m";
+  readonly reverse: "\u001B[7m";
+  readonly hidden: "\u001B[8m";
   readonly fg: {
-    readonly black: "";
-    readonly red: "";
-    readonly green: "";
-    readonly yellow: "";
-    readonly blue: "";
-    readonly magenta: "";
-    readonly cyan: "";
-    readonly white: "";
+    readonly black: "\u001B[30m";
+    readonly red: "\u001B[31m";
+    readonly green: "\u001B[32m";
+    readonly yellow: "\u001B[33m";
+    readonly blue: "\u001B[34m";
+    readonly magenta: "\u001B[35m";
+    readonly cyan: "\u001B[36m";
+    readonly white: "\u001B[37m";
   };
   readonly bg: {
-    readonly black: "";
-    readonly red: "";
-    readonly green: "";
-    readonly yellow: "";
-    readonly blue: "";
-    readonly magenta: "";
-    readonly cyan: "";
-    readonly white: "";
+    readonly black: "\u001B[40m";
+    readonly red: "\u001B[41m";
+    readonly green: "\u001B[42m";
+    readonly yellow: "\u001B[43m";
+    readonly blue: "\u001B[44m";
+    readonly magenta: "\u001B[45m";
+    readonly cyan: "\u001B[46m";
+    readonly white: "\u001B[47m";
   };
 };
 type LogLevel = "debug" | "info" | "success" | "warn" | "error";
@@ -39,7 +39,7 @@ interface Logger {
   log?: ((level: Exclude<LogLevel, "success">, message: string, ...args: any[]) => void) | undefined;
 }
 type LogHandlerParams = Parameters<NonNullable<Logger["log"]>> extends [LogLevel, ...infer Rest] ? Rest : never;
-type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void; } & {
+type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void } & {
   get level(): LogLevel;
 };
 declare const createLogger: (options?: Logger | undefined) => InternalLogger;

package/dist/error/codes.d.mts

@@ -1,4 +1,5 @@
 import { RawError } from "../utils/error-codes.mjs";
+
 //#region src/error/codes.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {

package/dist/error/index.d.mts

@@ -1,5 +1,6 @@
 import { APIErrorCode, BASE_ERROR_CODES } from "./codes.mjs";
 import { APIError as APIError$1 } from "better-call/error";
+
 //#region src/error/index.d.ts
 declare class BetterAuthError extends Error {
   constructor(message: string, options?: {

package/dist/index.d.mts

@@ -6,4 +6,4 @@ import { SecretConfig } from "./types/secret.mjs";
 import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, CookieCacheSigner, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
 import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./types/plugin-client.mjs";
 import { StandardSchemaV1 } from "./types/index.mjs";
-export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, CookieCachePayload, CookieCacheSigner, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };
+export { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, CookieCachePayload, CookieCacheSigner, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource };

package/dist/instrumentation/attributes.d.mts

@@ -1,4 +1,5 @@
 import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE } from "@opentelemetry/semantic-conventions";
+
 //#region src/instrumentation/attributes.d.ts
 /** Operation identifier (e.g. getSession, signUpWithEmailAndPassword). Uses endpoint operationId when set, otherwise the endpoint key. */
 declare const ATTR_OPERATION_ID: "better_auth.operation_id";

package/dist/instrumentation/pure.index.d.mts

@@ -1,4 +1,5 @@
 import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID } from "./attributes.mjs";
+
 //#region src/instrumentation/pure.index.d.ts
 declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => T): T;
 declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => Promise<T>): Promise<T>;

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.0-rc.5";
+const INSTRUMENTATION_VERSION = "1.7.0-rc.6";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/oauth2/authorization-params.d.mts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+
 //#region src/oauth2/authorization-params.d.ts
 /**
  * Zod schema for the `additionalParams` field on social sign-in and

package/dist/oauth2/client-assertion.d.mts

@@ -1,5 +1,4 @@
 import { Awaitable } from "../types/helper.mjs";
-import "../types/index.mjs";
 //#region src/oauth2/client-assertion.d.ts
 /** Asymmetric signing algorithms compatible with private_key_jwt (RFC 7523). */
 declare const PRIVATE_KEY_JWT_SIGNING_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512", "EdDSA"];
@@ -36,7 +35,15 @@ interface PrivateKeyJwtClientAssertionGetterOptions {
  * - jti=unique
  * - iat=now
  */
-declare function signPrivateKeyJwtClientAssertion({ clientId, tokenEndpoint, privateKeyJwk, privateKeyPem, kid, algorithm, expiresIn }: {
+declare function signPrivateKeyJwtClientAssertion({
+  clientId,
+  tokenEndpoint,
+  privateKeyJwk,
+  privateKeyPem,
+  kid,
+  algorithm,
+  expiresIn
+}: {
   clientId: string;
   tokenEndpoint: string;
   privateKeyJwk?: JsonWebKey;
@@ -57,7 +64,10 @@ declare function createPrivateKeyJwtClientAssertionGetter(options: PrivateKeyJwt
 /**
  * Resolves a client assertion getter into `client_assertion` + `client_assertion_type` params for injection into a token request body.
  */
-declare function resolveClientAssertionParams({ getClientAssertion, context }: {
+declare function resolveClientAssertionParams({
+  getClientAssertion,
+  context
+}: {
   getClientAssertion: ClientAssertionGetter;
   context: ClientAssertionContext;
 }): Promise<Record<string, string>>;

package/dist/oauth2/client-credentials-token.d.mts

@@ -1,7 +1,7 @@
 import { AwaitableFunction } from "../types/helper.mjs";
-import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
+
 //#region src/oauth2/client-credentials-token.d.ts
 interface ClientCredentialsTokenRequestInput {
   options: AwaitableFunction<ProviderOptions>;
@@ -15,10 +15,24 @@ interface ClientCredentialsTokenInput extends ClientCredentialsTokenRequestInput
   tokenEndpoint: string;
   scope: string;
 }
-declare function clientCredentialsTokenRequest({ options, scope, authentication, tokenEndpointAuth, tokenEndpoint, resource }: ClientCredentialsTokenRequestInput): Promise<{
+declare function clientCredentialsTokenRequest({
+  options,
+  scope,
+  authentication,
+  tokenEndpointAuth,
+  tokenEndpoint,
+  resource
+}: ClientCredentialsTokenRequestInput): Promise<{
   body: URLSearchParams;
   headers: Record<string, string>;
 }>;
-declare function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, tokenEndpointAuth, resource }: ClientCredentialsTokenInput): Promise<OAuth2Tokens>;
+declare function clientCredentialsToken({
+  options,
+  tokenEndpoint,
+  scope,
+  authentication,
+  tokenEndpointAuth,
+  resource
+}: ClientCredentialsTokenInput): Promise<OAuth2Tokens>;
 //#endregion
 export { clientCredentialsToken, clientCredentialsTokenRequest };

package/dist/oauth2/create-authorization-url.d.mts

@@ -1,7 +1,5 @@
 import { AwaitableFunction } from "../types/helper.mjs";
-import "../types/index.mjs";
 import { ProviderOptions } from "./oauth-provider.mjs";
-import "./index.mjs";
 //#region src/oauth2/create-authorization-url.d.ts
 /**
  * Query-parameter names that are populated by the framework as part of the
@@ -11,7 +9,27 @@ import "./index.mjs";
  */
 declare const RESERVED_AUTHORIZATION_PARAMS: readonly ["state", "client_id", "redirect_uri", "response_type", "code_challenge", "code_challenge_method", "nonce", "scope"];
 declare const RESERVED_AUTHORIZATION_PARAMS_SET: ReadonlySet<string>;
-declare function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, nonce, hd, responseMode, additionalParams, scopeJoiner }: {
+declare function createAuthorizationURL({
+  id,
+  options,
+  authorizationEndpoint,
+  state,
+  codeVerifier,
+  scopes,
+  claims,
+  redirectURI,
+  duration,
+  prompt,
+  accessType,
+  responseType,
+  display,
+  loginHint,
+  nonce,
+  hd,
+  responseMode,
+  additionalParams,
+  scopeJoiner
+}: {
   id: string;
   options: AwaitableFunction<ProviderOptions>;
   redirectURI: string;

package/dist/oauth2/dpop.d.mts

@@ -1,4 +1,5 @@
 import { JWK, JWTPayload } from "jose";
+
 //#region src/oauth2/dpop.d.ts
 declare const DPOP_AUTHORIZATION_SCHEME = "DPoP";
 declare const BEARER_AUTHORIZATION_SCHEME = "Bearer";
@@ -85,7 +86,18 @@ declare function deriveDpopJkt(jwk: JWK): Promise<string>;
  */
 declare function getConfirmationJkt(confirmation: unknown): string | undefined;
 declare function getDpopJktFromPayload(payload: JWTPayload): string | undefined;
-declare function verifyDpopProof({ proofJwt, method, url, accessToken, expectedJkt, requireAth, nowSeconds, proofMaxAgeSeconds, signingAlgorithms, replayStore }: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
+declare function verifyDpopProof({
+  proofJwt,
+  method,
+  url,
+  accessToken,
+  expectedJkt,
+  requireAth,
+  nowSeconds,
+  proofMaxAgeSeconds,
+  signingAlgorithms,
+  replayStore
+}: VerifyDpopProofOptions): Promise<VerifiedDpopProof>;
 type DpopBindingErrorCode = "invalid_token" | "invalid_dpop_proof";
 type DpopBindingError = Error & {
   code: DpopBindingErrorCode;
@@ -116,6 +128,15 @@ interface EnforceDpopBindingParams {
  * `invalid_token` / `invalid_dpop_proof` code into their own transport. Returns
  * normally for a valid bearer token (no `cnf.jkt`, no DPoP scheme).
  */
-declare function enforceDpopBinding({ payload, authorization, proofJwt, method, url, replayStore, proofMaxAgeSeconds, signingAlgorithms }: EnforceDpopBindingParams): Promise<void>;
+declare function enforceDpopBinding({
+  payload,
+  authorization,
+  proofJwt,
+  method,
+  url,
+  replayStore,
+  proofMaxAgeSeconds,
+  signingAlgorithms
+}: EnforceDpopBindingParams): Promise<void>;
 //#endregion
 export { AccessTokenAuthorization, AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, DpopBindingError, DpopBindingErrorCode, DpopProofError, DpopProofErrorCode, DpopReplayReservation, DpopReplayReservations, DpopReplayStore, DpopSigningAlgorithm, EnforceDpopBindingParams, VerifiedDpopProof, VerifyDpopProofOptions, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, deriveDpopAth, deriveDpopJkt, enforceDpopBinding, getConfirmationJkt, getDpopJktFromPayload, isDpopBindingError, isDpopProofError, normalizeDpopHtu, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof };

package/dist/oauth2/dpop.mjs

@@ -12,7 +12,7 @@ const DPOP_SIGNING_ALGORITHMS = [
 ];
 const DEFAULT_DPOP_PROOF_MAX_AGE_SECONDS = 300;
 const MAX_DPOP_JTI_LENGTH = 512;
-const JWK_PRIVATE_FIELDS = /* @__PURE__ */ new Set([
+const JWK_PRIVATE_FIELDS = new Set([
 	"d",
 	"p",
 	"q",

package/dist/oauth2/oauth-provider.d.mts

@@ -1,7 +1,7 @@
 import { Awaitable, LiteralString } from "../types/helper.mjs";
 import { GenericEndpointContext } from "../types/context.mjs";
-import "../types/index.mjs";
 import { JWTVerifyGetKey } from "jose";
+
 //#region src/oauth2/oauth-provider.d.ts
 /**
  * id_token verification config for a social provider.
@@ -17,14 +17,10 @@ type OAuthIdTokenConfig = {
    * `createRemoteJWKSet` resolver or a key-resolving function
    * `(protectedHeader) => key`.
    */
-  jwks: JWTVerifyGetKey;
-  /** Expected `iss`. Omit for providers whose issuer varies per tenant. */
-  issuer?: (string | string[]) | undefined;
-  /** Expected `aud`, usually the client ID. */
-  audience: string | string[];
-  /** Permitted JWS algorithms. Defaults to the token's `alg` header. */
-  algorithms?: string[] | undefined;
-  /** Maximum token age passed to jose (e.g. `"1h"`). */
+  jwks: JWTVerifyGetKey; /** Expected `iss`. Omit for providers whose issuer varies per tenant. */
+  issuer?: (string | string[]) | undefined; /** Expected `aud`, usually the client ID. */
+  audience: string | string[]; /** Permitted JWS algorithms. Defaults to the token's `alg` header. */
+  algorithms?: string[] | undefined; /** Maximum token age passed to jose (e.g. `"1h"`). */
   maxTokenAge?: string | undefined;
   /**
    * How the `nonce` claim is compared to the expected nonce.
@@ -69,8 +65,7 @@ interface OAuth2Tokens {
 }
 /** Mutable local-user attributes normalized from an OAuth provider profile. */
 type OAuth2UserInfo = {
-  /** Provider identity belongs in raw profile data and `accountSubject`. */
-  id?: never;
+  /** Provider identity belongs in raw profile data and `accountSubject`. */id?: never;
   name?: string | undefined;
   email?: (string | null) | undefined;
   image?: string | undefined;
@@ -99,8 +94,7 @@ type OAuthAccountKeyResolver<Profile extends object, Value> = {
 type OAuthAccountSubject<Profile extends object = object> = OAuthAccountKeyResolver<Profile, string | number>;
 /** Mutable local-user attributes returned by `mapProfileToUser`. */
 type OAuthMappedUser = {
-  /** Provider identity is defined by `accountSubject`, not local user mapping. */
-  id?: never;
+  /** Provider identity is defined by `accountSubject`, not local user mapping. */id?: never;
   name?: string;
   email?: string | null;
   image?: string;

package/dist/oauth2/refresh-access-token.d.mts

@@ -1,7 +1,7 @@
 import { AwaitableFunction } from "../types/helper.mjs";
-import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
+
 //#region src/oauth2/refresh-access-token.d.ts
 interface RefreshAccessTokenRequestInput {
   refreshToken: string;
@@ -16,10 +16,26 @@ interface RefreshAccessTokenInput extends RefreshAccessTokenRequestInput {
   options: Partial<ProviderOptions>;
   tokenEndpoint: string;
 }
-declare function refreshAccessTokenRequest({ refreshToken, options, authentication, tokenEndpointAuth, tokenEndpoint, extraParams, resource }: RefreshAccessTokenRequestInput): Promise<{
+declare function refreshAccessTokenRequest({
+  refreshToken,
+  options,
+  authentication,
+  tokenEndpointAuth,
+  tokenEndpoint,
+  extraParams,
+  resource
+}: RefreshAccessTokenRequestInput): Promise<{
   body: URLSearchParams;
   headers: Record<string, string>;
 }>;
-declare function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, tokenEndpointAuth, extraParams, resource }: RefreshAccessTokenInput): Promise<OAuth2Tokens>;
+declare function refreshAccessToken({
+  refreshToken,
+  options,
+  tokenEndpoint,
+  authentication,
+  tokenEndpointAuth,
+  extraParams,
+  resource
+}: RefreshAccessTokenInput): Promise<OAuth2Tokens>;
 //#endregion
 export { refreshAccessToken, refreshAccessTokenRequest };

package/dist/oauth2/refresh-access-token.mjs

@@ -2,7 +2,7 @@ import { parseScopeField } from "./utils.mjs";
 import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
 //#region src/oauth2/refresh-access-token.ts
-const BLOCKED_REFRESH_TOKEN_PARAMS_SET = /* @__PURE__ */ new Set([
+const BLOCKED_REFRESH_TOKEN_PARAMS_SET = new Set([
 	"grant_type",
 	"refresh_token",
 	"__proto__",

package/dist/oauth2/reject-redirects.mjs

@@ -1,7 +1,7 @@
 import { BetterAuthError } from "../error/index.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/reject-redirects.ts
-const httpRedirectStatuses = /* @__PURE__ */ new Set([
+const httpRedirectStatuses = new Set([
 	301,
 	302,
 	303,

package/dist/oauth2/token-endpoint-auth.d.mts

@@ -1,4 +1,5 @@
 import { ClientAssertionGetter } from "./client-assertion.mjs";
+
 //#region src/oauth2/token-endpoint-auth.d.ts
 type TokenEndpointAuth = {
   method: "none";

package/dist/oauth2/utils.d.mts

@@ -1,4 +1,5 @@
 import { OAuth2Tokens } from "./oauth-provider.mjs";
+
 //#region src/oauth2/utils.d.ts
 declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
 /**

package/dist/oauth2/utils.mjs

@@ -47,7 +47,7 @@ function applyDefaultAccessTokenExpiry(tokens, accessTokenExpiresIn) {
 function mergeScopes(stored, incoming) {
 	const existing = stored ? stored.split(",").map((scope) => scope.trim()).filter(Boolean) : [];
 	const next = (incoming ?? []).map((scope) => scope.trim()).filter(Boolean);
-	return [.../* @__PURE__ */ new Set([...existing, ...next])].join(",");
+	return [...new Set([...existing, ...next])].join(",");
 }
 /**
 * Return the provider's primary Client ID: the single string, or the entry at

package/dist/oauth2/validate-authorization-code.d.mts

@@ -1,8 +1,8 @@
 import { AwaitableFunction } from "../types/helper.mjs";
-import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
 import { TokenEndpointAuth, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
-import "./index.mjs";
+import * as _$jose from "jose";
+
 //#region src/oauth2/validate-authorization-code.d.ts
 interface AuthorizationCodeRequestInput {
   code: string;
@@ -20,14 +20,38 @@ interface AuthorizationCodeRequestInput {
 interface ValidateAuthorizationCodeInput extends AuthorizationCodeRequestInput {
   tokenEndpoint: string;
 }
-declare function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, tokenEndpointAuth, tokenEndpoint, deviceId, headers, additionalParams, resource }: AuthorizationCodeRequestInput): Promise<{
+declare function authorizationCodeRequest({
+  code,
+  codeVerifier,
+  redirectURI,
+  options,
+  authentication,
+  tokenEndpointAuth,
+  tokenEndpoint,
+  deviceId,
+  headers,
+  additionalParams,
+  resource
+}: AuthorizationCodeRequestInput): Promise<{
   body: URLSearchParams;
   headers: Record<string, string>;
 }>;
-declare function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, tokenEndpointAuth, deviceId, headers, additionalParams, resource }: ValidateAuthorizationCodeInput): Promise<OAuth2Tokens>;
+declare function validateAuthorizationCode({
+  code,
+  codeVerifier,
+  redirectURI,
+  options,
+  tokenEndpoint,
+  authentication,
+  tokenEndpointAuth,
+  deviceId,
+  headers,
+  additionalParams,
+  resource
+}: ValidateAuthorizationCodeInput): Promise<OAuth2Tokens>;
 declare function validateToken(token: string, jwksEndpoint: string, options?: {
   audience?: string | string[];
   issuer?: string | string[];
-}): Promise<import("jose").JWTVerifyResult<import("jose").JWTPayload> & import("jose").ResolvedKey>;
+}): Promise<_$jose.JWTVerifyResult<_$jose.JWTPayload> & _$jose.ResolvedKey>;
 //#endregion
 export { authorizationCodeRequest, validateAuthorizationCode, validateToken };

package/dist/oauth2/verify-id-token.d.mts

@@ -1,6 +1,6 @@
 import { GenericEndpointContext } from "../types/context.mjs";
-import "../types/index.mjs";
 import { OAuthProvider } from "./oauth-provider.mjs";
+
 //#region src/oauth2/verify-id-token.d.ts
 type ProviderWithIdTokenConfig = Pick<OAuthProvider, "idToken" | "options">;
 /**

package/dist/oauth2/verify.d.mts

@@ -1,10 +1,10 @@
 import { DpopReplayStore } from "./dpop.mjs";
 import { APIError } from "better-call";
 import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
+
 //#region src/oauth2/verify.d.ts
 type JwksFetchOptions = {
-  /** Jwks url or promise of a Jwks */
-  jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
+  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
   /**
    * Stable object to cache the result of a function `jwksFetch` under,
    * with the same TTL and kid-miss refetch rules as string sources.
@@ -12,6 +12,9 @@ type JwksFetchOptions = {
    */
   jwksCacheKey?: object;
 };
+/**
+ * @internal
+ */
 interface VerifyAccessTokenRemote {
   /** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
   introspectUrl: string;
@@ -90,8 +93,7 @@ declare function requestToResourceInput(request: Request): ResourceRequestInput;
  * Can also be configured for remote verification.
  */
 declare function verifyJwsAccessToken(token: string, opts: JwksFetchOptions & {
-  /** Verify options */
-  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
 }): Promise<JWTPayload>;
 declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWebKeySet>;
 declare function createInsufficientScopeError(requiredScopes: readonly string[], description?: string): APIError;
@@ -121,4 +123,4 @@ declare function verifyBearerToken(token: string, opts: VerifyAccessTokenOptions
  */
 declare function verifyAccessTokenRequest(request: ResourceRequestInput, opts: VerifyAccessTokenRequestOptions): Promise<JWTPayload>;
 //#endregion
-export { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRemote, VerifyAccessTokenRequestOptions, createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };
+export { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };

package/dist/oauth2/verify.mjs

@@ -4,7 +4,7 @@ import { createInMemoryDpopReplayStore, enforceDpopBinding, getDpopJktFromPayloa
 import { APIError } from "better-call";
 import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/oauth2/verify.ts
-const joseInfrastructureErrorCodes = /* @__PURE__ */ new Set([
+const joseInfrastructureErrorCodes = new Set([
 	errors.JWKSTimeout.code,
 	errors.JWKSInvalid.code,
 	errors.JWKSMultipleMatchingKeys.code
@@ -330,4 +330,4 @@ async function verifyAccessTokenRequest(request, opts) {
 	return payload;
 }
 //#endregion
-export { createInsufficientScopeError, getJwks, isInsufficientScopeError, jwksCache, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };
+export { createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };