@better-auth/core 1.7.1 → 1.7.3

package/dist/db/schema-check.mjs

@@ -0,0 +1,80 @@
+import { SchemaMismatchError } from "./schema-diff.mjs";
+//#region src/db/schema-check.ts
+/**
+* Whether the adapter validates its schema. Enabled in every environment
+* unless explicitly disabled.
+*/
+function checksSchema(options) {
+	return options.advanced?.database?.validateSchema !== false;
+}
+const schemaChecks = /* @__PURE__ */ new WeakMap();
+const schemaRevisions = /* @__PURE__ */ new WeakMap();
+/** Invalidates cached checks after Better Auth changes this database's schema. */
+function invalidateSchemaChecks(database) {
+	const revision = schemaRevisions.get(database);
+	if (revision) revision.value++;
+}
+/**
+* Attaches a check to the adapter it verifies. The adapter object itself is
+* left untouched, so this works for adapters Better Auth does not own.
+*/
+function registerSchemaCheck(adapter, check) {
+	schemaChecks.set(adapter, check);
+}
+/**
+* The check registered for an adapter, if its store is checked at all.
+*/
+function schemaCheckFor(adapter) {
+	return schemaChecks.get(adapter);
+}
+/**
+* Turns a schema comparison into a check shared by one adapter instance.
+*
+* The first call runs `find` and every concurrent call shares that promise. A
+* clean result is cached until invalidation. A mismatch is kept as one
+* {@link SchemaMismatchError} and rethrown on every later call without asking
+* the store again, until a migration invalidates it. When a database identity is supplied,
+* checks for that identity share its schema revision. Pending callers follow
+* the new check if their revision is invalidated. A failure to reach
+* the store is not kept, so the next call asks again.
+*
+* @example
+* ```ts
+* const checkSchema = createSchemaCheck(
+*   () => findSchemaProblems(db, "postgres", expected),
+*   "database",
+* );
+* const pending = checkSchema();
+* if (pending) await pending;
+* ```
+*/
+function createSchemaCheck(find, source, database) {
+	let revision = database ? schemaRevisions.get(database) : void 0;
+	if (database && !revision) {
+		revision = { value: 0 };
+		schemaRevisions.set(database, revision);
+	}
+	let checkedRevision = revision?.value;
+	let clean = false;
+	let verdict;
+	return function checkSchema() {
+		const currentRevision = revision?.value;
+		if (checkedRevision !== currentRevision) {
+			checkedRevision = currentRevision;
+			clean = false;
+			verdict = void 0;
+		}
+		if (clean) return;
+		return verdict ??= Promise.resolve().then(find).then((findings) => {
+			if (revision?.value !== currentRevision) return checkSchema();
+			if (findings.length) throw new SchemaMismatchError(findings, source);
+			if (checkedRevision === currentRevision) clean = true;
+		}, (error) => {
+			if (revision?.value !== currentRevision) return checkSchema();
+			if (checkedRevision === currentRevision) verdict = void 0;
+			throw error;
+		});
+	};
+}
+//#endregion
+export { checksSchema, createSchemaCheck, invalidateSchemaChecks, registerSchemaCheck, schemaCheckFor };

package/dist/db/schema-diff.d.mts

@@ -0,0 +1,104 @@
+import { DBFieldAttribute } from "./type.mjs";
+import { BetterAuthOptions } from "../types/init-options.mjs";
+import { BetterAuthError } from "../error/index.mjs";
+//#region src/db/schema-diff.d.ts
+/**
+ * A column as the database, or an ORM schema definition, reports it.
+ */
+interface IntrospectedColumn {
+  name: string;
+  nullable: boolean;
+  /**
+   * The store fills the column when an insert omits it.
+   */
+  hasDefault: boolean;
+}
+/**
+ * A table as the database, or an ORM schema definition, reports it.
+ */
+interface IntrospectedTable {
+  name: string;
+  /**
+   * The schema the table lives in, when the store has schemas.
+   */
+  schema?: string | undefined;
+  columns: IntrospectedColumn[];
+}
+/**
+ * The tables Better Auth writes, keyed the way the store addresses them:
+ * physical table name, then physical column name. A table that manages its
+ * own storage is excluded from migrations and from this comparison.
+ */
+type ExpectedSchema = Record<string, {
+  fields: Record<string, DBFieldAttribute>;
+  idColumn?: string | undefined;
+  disableMigrations?: boolean | undefined;
+  /**
+   * The schema the table is addressed in. Unset when the store has no
+   * schemas or the table is found by name alone.
+   */
+  schema?: string | undefined;
+}>;
+/**
+ * The tables this configuration writes, keyed the way the adapter addresses
+ * them. Tables that share a physical name are merged into one entry.
+ */
+declare function getExpectedSchema(options: BetterAuthOptions, {
+  usePlural
+}?: {
+  usePlural?: boolean | undefined;
+}): ExpectedSchema;
+type SchemaFinding = {
+  kind: "missing-table";
+  table: string;
+} | {
+  kind: "missing-column";
+  table: string;
+  column: string;
+} | {
+  kind: "unexpected-required-column";
+  table: string;
+  column: string;
+};
+/**
+ * How the schema reaches the store, which decides the fix each finding names.
+ */
+type SchemaSource = "database" | "drizzle" | "prisma";
+/**
+ * Compares the tables Better Auth writes with what the store holds.
+ *
+ * A table or column Better Auth writes must exist. A column Better Auth does
+ * not write must accept an insert that omits it, so it is nullable or carries
+ * a default. Otherwise every insert into that table fails with a constraint
+ * error that says nothing about why the schema drifted.
+ */
+declare function diffSchema(expected: ExpectedSchema, actual: readonly IntrospectedTable[]): SchemaFinding[];
+/**
+ * One finding as a sentence that names the change resolving it.
+ */
+declare function formatSchemaFinding(finding: SchemaFinding, source: SchemaSource): string;
+/**
+ * The store cannot hold what this configuration writes.
+ *
+ * `findings` carries every problem as data; `message` lists each one with the
+ * change that resolves it. Reported during initialization and thrown when
+ * requests await validation, in every environment. Also thrown by
+ * `auth migrate` before it changes anything.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   await auth.api.getSession({ headers });
+ * } catch (error) {
+ *   if (error instanceof SchemaMismatchError) console.error(error.findings);
+ * }
+ * ```
+ */
+declare class SchemaMismatchError extends BetterAuthError {
+  readonly findings: readonly SchemaFinding[];
+  readonly source: SchemaSource;
+  readonly code = "SCHEMA_MISMATCH";
+  constructor(findings: readonly SchemaFinding[], source: SchemaSource);
+}
+//#endregion
+export { ExpectedSchema, IntrospectedColumn, IntrospectedTable, SchemaFinding, SchemaMismatchError, SchemaSource, diffSchema, formatSchemaFinding, getExpectedSchema };

package/dist/db/schema-diff.mjs

@@ -0,0 +1,154 @@
+import { BetterAuthError } from "../error/index.mjs";
+import { getAuthTables } from "./get-tables.mjs";
+//#region src/db/schema-diff.ts
+/**
+* The tables this configuration writes, keyed the way the adapter addresses
+* them. Tables that share a physical name are merged into one entry.
+*/
+function getExpectedSchema(options, { usePlural = false } = {}) {
+	const expected = {};
+	for (const table of Object.values(getAuthTables(options))) {
+		const name = usePlural ? `${table.modelName}s` : table.modelName;
+		const entry = expected[name] ??= {
+			fields: {},
+			disableMigrations: true
+		};
+		for (const [key, field] of Object.entries(table.fields)) entry.fields[field.fieldName || key] = field;
+		entry.disableMigrations = entry.disableMigrations && !!table.disableMigrations;
+	}
+	return expected;
+}
+/**
+* Compares the tables Better Auth writes with what the store holds.
+*
+* A table or column Better Auth writes must exist. A column Better Auth does
+* not write must accept an insert that omits it, so it is nullable or carries
+* a default. Otherwise every insert into that table fails with a constraint
+* error that says nothing about why the schema drifted.
+*/
+function diffSchema(expected, actual) {
+	const findings = [];
+	for (const [tableName, table] of Object.entries(expected)) {
+		if (table.disableMigrations) continue;
+		const actualTable = actual.find((candidate) => candidate.name === tableName && (table.schema === void 0 || candidate.schema === table.schema));
+		if (!actualTable) {
+			findings.push({
+				kind: "missing-table",
+				table: tableName
+			});
+			continue;
+		}
+		const written = new Set([table.idColumn ?? "id", ...Object.keys(table.fields)]);
+		for (const column of written) if (!actualTable.columns.some((candidate) => candidate.name === column)) findings.push({
+			kind: "missing-column",
+			table: tableName,
+			column
+		});
+		for (const column of actualTable.columns) {
+			if (written.has(column.name) || column.nullable || column.hasDefault) continue;
+			findings.push({
+				kind: "unexpected-required-column",
+				table: tableName,
+				column: column.name
+			});
+		}
+	}
+	return findings;
+}
+const applyHint = {
+	database: "Run `npx auth migrate` to add it.",
+	drizzle: "Run `npx auth generate` to refresh the Drizzle schema, then apply it with your migration tool.",
+	prisma: "Run `npx auth generate` to refresh the Prisma schema, then run `prisma migrate`."
+};
+const relaxHint = {
+	database: "Drop the column, make it nullable, or give it a database default.",
+	drizzle: "Remove it from the Drizzle schema, make it nullable, or give it a default, then apply the change with your migration tool.",
+	prisma: "Remove it from the Prisma schema, make it optional, or give it a default, then run `prisma migrate`."
+};
+const sourceLabel = {
+	database: "Database",
+	drizzle: "Drizzle",
+	prisma: "Prisma"
+};
+/**
+* One finding as a sentence that names the change resolving it.
+*/
+function formatSchemaFinding(finding, source) {
+	switch (finding.kind) {
+		case "missing-table": return `Table "${finding.table}" is missing. ${applyHint[source]}`;
+		case "missing-column": return `Column "${finding.column}" is missing from table "${finding.table}". ${applyHint[source]}`;
+		case "unexpected-required-column": {
+			const issuer = finding.column === "issuer" ? " If this column came from Better Auth 1.7.0 through 1.7.2, follow the upgrade guide before removing it: https://www.better-auth.com/docs/guides/1-7-upgrade-guide" : "";
+			return `Column "${finding.column}" on table "${finding.table}" is required but Better Auth never writes it, so every insert into "${finding.table}" fails. ${relaxHint[source]}${issuer}`;
+		}
+	}
+}
+const repairHint = {
+	database: "Make the listed columns nullable, give them defaults, or remove them.",
+	drizzle: "Make the listed columns nullable in your Drizzle schema, give them defaults, or remove them.",
+	prisma: "Make the listed fields optional in your Prisma schema, give them defaults, or remove them."
+};
+const migrationHint = {
+	...applyHint,
+	database: "Run `npx auth migrate` to add the missing tables and columns."
+};
+function formatSchemaMismatch(findings, source) {
+	const tables = [];
+	const columns = [];
+	const required = [];
+	const affectedTables = /* @__PURE__ */ new Set();
+	let hasIssuer = false;
+	for (const finding of findings) switch (finding.kind) {
+		case "missing-table":
+			tables.push(finding.table);
+			break;
+		case "missing-column":
+			columns.push(`${finding.table}.${finding.column}`);
+			break;
+		case "unexpected-required-column":
+			required.push(`${finding.table}.${finding.column}`);
+			affectedTables.add(finding.table);
+			hasIssuer ||= finding.column === "issuer";
+			break;
+	}
+	const sections = [`${sourceLabel[source]} schema mismatch`];
+	if (tables.length) sections.push(`  Missing tables\n    ${tables.join(", ")}`);
+	if (columns.length) sections.push(`  Missing columns\n    ${columns.join("\n    ")}`);
+	if (required.length) {
+		sections.push(`  Required columns Better Auth never writes\n    ${required.join("\n    ")}`);
+		sections.push(`  Inserts into ${[...affectedTables].join(", ")} will fail.`);
+	}
+	const help = [];
+	if (required.length) help.push(repairHint[source]);
+	if (tables.length || columns.length || required.length && source !== "database") help.push(migrationHint[source]);
+	if (help.length) sections.push(`  help: ${help.join("\n        ")}`);
+	if (hasIssuer) sections.push("  note: If this column came from Better Auth 1.7.0 through 1.7.2,\n        follow the upgrade guide before removing it:\n        https://www.better-auth.com/docs/guides/1-7-upgrade-guide");
+	return sections.join("\n\n");
+}
+/**
+* The store cannot hold what this configuration writes.
+*
+* `findings` carries every problem as data; `message` lists each one with the
+* change that resolves it. Reported during initialization and thrown when
+* requests await validation, in every environment. Also thrown by
+* `auth migrate` before it changes anything.
+*
+* @example
+* ```ts
+* try {
+*   await auth.api.getSession({ headers });
+* } catch (error) {
+*   if (error instanceof SchemaMismatchError) console.error(error.findings);
+* }
+* ```
+*/
+var SchemaMismatchError = class extends BetterAuthError {
+	code = "SCHEMA_MISMATCH";
+	constructor(findings, source) {
+		super(formatSchemaMismatch(findings, source));
+		this.findings = findings;
+		this.source = source;
+	}
+};
+//#endregion
+export { SchemaMismatchError, diffSchema, formatSchemaFinding, getExpectedSchema };

package/dist/env/logger.mjs

@@ -1,3 +1,4 @@
+import { __getCurrentEndpointContext } from "../context/global.mjs";
 import { getColorDepth } from "./color-depth.mjs";
 //#region src/env/logger.ts
 const TTY_COLORS = {
@@ -74,6 +75,20 @@ const createLogger = (options) => {
 		}
 	};
 };
-const logger = createLogger();
+const defaultLogger = createLogger();
+const getCurrentLogger = () => {
+	const currentLogger = __getCurrentEndpointContext()?.context.logger;
+	return currentLogger && currentLogger !== logger ? currentLogger : defaultLogger;
+};
+const logger = {
+	debug: (...params) => getCurrentLogger().debug(...params),
+	info: (...params) => getCurrentLogger().info(...params),
+	success: (...params) => getCurrentLogger().success(...params),
+	warn: (...params) => getCurrentLogger().warn(...params),
+	error: (...params) => getCurrentLogger().error(...params),
+	get level() {
+		return getCurrentLogger().level;
+	}
+};
 //#endregion
 export { TTY_COLORS, createLogger, levels, logger, shouldPublishLog };

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.1";
+const INSTRUMENTATION_VERSION = "1.7.3";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/oauth2/index.d.mts

@@ -2,7 +2,7 @@ import { additionalAuthorizationParamsSchema } from "./authorization-params.mjs"
 import { decodeBasicCredentials, encodeBasicCredentials } from "./basic-credentials.mjs";
 import { CLIENT_ASSERTION_TYPE, ClientAssertionContext, ClientAssertionGetter, ClientAssertionGrantType, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, PrivateKeyJwtClientAssertionGetterOptions, PrivateKeyJwtSigningAlgorithm, createPrivateKeyJwtClientAssertionGetter, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion } from "./client-assertion.mjs";
 import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, OAuthAccountSubject, OAuthIdTokenConfig, OAuthMappedUser, OAuthProvider, OAuthRefreshContext, ProviderOptions } from "./oauth-provider.mjs";
-import { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
+import { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointRequestContext, TokenEndpointRequestHook, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
 import { clientCredentialsToken, clientCredentialsTokenRequest } from "./client-credentials-token.mjs";
 import { RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, createAuthorizationURL } from "./create-authorization-url.mjs";
 import { AccessTokenAuthorization, AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, DpopBindingError, DpopBindingErrorCode, DpopProofError, DpopProofErrorCode, DpopReplayReservation, DpopReplayReservations, DpopReplayStore, DpopSigningAlgorithm, EnforceDpopBindingParams, VerifiedDpopProof, VerifyDpopProofOptions, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, deriveDpopAth, deriveDpopJkt, enforceDpopBinding, getConfirmationJkt, getDpopJktFromPayload, isDpopBindingError, isDpopProofError, normalizeDpopHtu, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof } from "./dpop.mjs";
@@ -11,4 +11,4 @@ import { applyDefaultAccessTokenExpiry, generateCodeChallenge, getOAuth2Tokens,
 import { authorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
 import { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken } from "./verify.mjs";
 import { supportsIdTokenSignIn, verifyProviderIdToken } from "./verify-id-token.mjs";
-export { type AccessTokenAuthorization, type AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, type ClientAssertionContext, type ClientAssertionGetter, type ClientAssertionGrantType, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, type DpopBindingError, type DpopBindingErrorCode, type DpopProofError, type DpopProofErrorCode, type DpopReplayReservation, type DpopReplayReservations, type DpopReplayStore, type DpopSigningAlgorithm, type EnforceDpopBindingParams, type OAuth2Tokens, type OAuth2UserInfo, type OAuthAccountKeyContext, type OAuthAccountSubject, type OAuthIdTokenConfig, type OAuthMappedUser, type OAuthProvider, type OAuthRefreshContext, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, type PrivateKeyJwtClientAssertionGetterOptions, type PrivateKeyJwtSigningAlgorithm, type ProviderOptions, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, type ResourceRequestInput, type TokenEndpointAuth, type TokenEndpointAuthMethod, type TokenEndpointSecretAuthentication, type VerifiedDpopProof, type VerifyAccessTokenOptions, type VerifyAccessTokenRequestOptions, type VerifyDpopProofOptions, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createInsufficientScopeError, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, isInsufficientScopeError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };
+export { type AccessTokenAuthorization, type AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, type ClientAssertionContext, type ClientAssertionGetter, type ClientAssertionGrantType, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, type DpopBindingError, type DpopBindingErrorCode, type DpopProofError, type DpopProofErrorCode, type DpopReplayReservation, type DpopReplayReservations, type DpopReplayStore, type DpopSigningAlgorithm, type EnforceDpopBindingParams, type OAuth2Tokens, type OAuth2UserInfo, type OAuthAccountKeyContext, type OAuthAccountSubject, type OAuthIdTokenConfig, type OAuthMappedUser, type OAuthProvider, type OAuthRefreshContext, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, type PrivateKeyJwtClientAssertionGetterOptions, type PrivateKeyJwtSigningAlgorithm, type ProviderOptions, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, type ResourceRequestInput, type TokenEndpointAuth, type TokenEndpointAuthMethod, type TokenEndpointRequestContext, type TokenEndpointRequestHook, type TokenEndpointSecretAuthentication, type VerifiedDpopProof, type VerifyAccessTokenOptions, type VerifyAccessTokenRequestOptions, type VerifyDpopProofOptions, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createInsufficientScopeError, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, isInsufficientScopeError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };

package/dist/oauth2/oauth-provider.d.mts

@@ -214,16 +214,6 @@ interface OAuthProvider<T extends object = object, O extends object = Partial<Pr
    * against this value to prevent authorization server mix-up attacks.
    */
   issuer?: string | undefined;
-  /**
-   * Stable issuer used with the provider subject to recognize an account.
-   *
-   * Use the validated OpenID Connect issuer for OIDC providers. A resolver is
-   * supported for tenant-specific issuers and receives only provider-verified
-   * data. OAuth providers without an issuer omit this property and are scoped
-   * to the synthetic `local:oauth:<encoded providerId>` issuer, where the
-   * provider ID segment is percent-encoded.
-   */
-  accountIssuer?: string | OAuthAccountKeyResolver<T, string> | undefined;
   /**
    * Require shared OAuth redirect routes to bind ID-token verification to an
    * authorization request nonce. When true, routes generate `idTokenNonce`,

package/dist/oauth2/token-endpoint-auth.d.mts

@@ -1,4 +1,4 @@
-import { ClientAssertionGetter } from "./client-assertion.mjs";
+import { ClientAssertionGetter, ClientAssertionGrantType } from "./client-assertion.mjs";
 
 //#region src/oauth2/token-endpoint-auth.d.ts
 type TokenEndpointAuth = {
@@ -10,8 +10,32 @@ type TokenEndpointAuth = {
 } | {
   method: "private_key_jwt";
   getClientAssertion: ClientAssertionGetter;
+} | {
+  method: "custom";
+  /**
+   * Customize the token request after standard grant parameters are set.
+   */
+  customizeRequest: TokenEndpointRequestHook;
 };
 type TokenEndpointAuthMethod = TokenEndpointAuth["method"];
 type TokenEndpointSecretAuthentication = "basic" | "post";
+/**
+ * Mutable token request state passed to a custom authentication strategy.
+ */
+interface TokenEndpointRequestContext {
+  body: URLSearchParams;
+  headers: Record<string, string>;
+  options: TokenEndpointClientOptions;
+  tokenEndpoint: string;
+  grantType: ClientAssertionGrantType;
+}
+/**
+ * Applies provider-specific authentication to a token request.
+ */
+type TokenEndpointRequestHook = (context: TokenEndpointRequestContext) => void | Promise<void>;
+interface TokenEndpointClientOptions {
+  clientId?: string | string[] | undefined;
+  clientSecret?: string | undefined;
+}
 //#endregion
-export { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointSecretAuthentication };
+export { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointRequestContext, TokenEndpointRequestHook, TokenEndpointSecretAuthentication };

package/dist/oauth2/token-endpoint-auth.mjs

@@ -46,6 +46,17 @@ async function applyTokenEndpointAuth({ body, headers, options, tokenEndpoint, g
 		return;
 	}
 	const auth = tokenEndpointAuth ?? getDefaultTokenEndpointAuth(options, authentication);
+	if (auth.method === "custom") {
+		await auth.customizeRequest({
+			body,
+			headers,
+			options,
+			tokenEndpoint,
+			grantType
+		});
+		assertCompleteManualClientAssertion(body);
+		return;
+	}
 	if (auth.method === "private_key_jwt") {
 		assertNoClientSecret(auth.method, options, body);
 		assertClientIdConfigured(auth.method, clientId);

package/dist/social-providers/apple.d.mts

@@ -72,7 +72,6 @@ declare const apple: (options: AppleOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<AppleProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/apple.mjs

@@ -13,7 +13,6 @@ const apple = (options) => {
 		id: "apple",
 		name: "Apple",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: "https://appleid.apple.com",
 		async createAuthorizationURL({ state, scopes, redirectURI, additionalParams, codeVerifier }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client ID and client secret are required for Apple. Make sure to provide them in the options.");

package/dist/social-providers/cloudflare.d.mts

@@ -0,0 +1,132 @@
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+//#region src/social-providers/cloudflare.d.ts
+/**
+ * The user profile returned by the Cloudflare API `/user` endpoint.
+ *
+ * @see https://developers.cloudflare.com/api/resources/user/methods/get/
+ */
+interface CloudflareProfile {
+  /**
+   * Identifier of the user.
+   */
+  id: string;
+  /**
+   * Current email address of the user.
+   */
+  email: string;
+  /**
+   * The user's first name.
+   */
+  first_name?: string | null | undefined;
+  /**
+   * The user's last name.
+   */
+  last_name?: string | null | undefined;
+  /**
+   * The country in which the user lives.
+   */
+  country?: string | null | undefined;
+  /**
+   * The user's telephone number.
+   */
+  telephone?: string | null | undefined;
+  /**
+   * The zipcode or postal code where the user lives.
+   */
+  zipcode?: string | null | undefined;
+  /**
+   * Indicates whether two-factor authentication is enabled for the user account.
+   */
+  two_factor_authentication_enabled?: boolean | undefined;
+  /**
+   * Indicates whether the user has been suspended.
+   */
+  suspended?: boolean | undefined;
+}
+/**
+ * Token endpoint authentication supported by Cloudflare OAuth clients.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#choose-a-flow
+ */
+type CloudflareClientAuthentication = {
+  /**
+   * The client secret of a confidential Cloudflare OAuth client.
+   */
+  clientSecret: string;
+  /**
+   * The authentication method configured for the token endpoint.
+   *
+   * @default "client_secret_basic"
+   */
+  tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | undefined;
+} | {
+  /**
+   * Clients that use PKCE do not have a client secret.
+   */
+  clientSecret?: undefined;
+  /**
+   * Clients without a secret do not authenticate at the token endpoint.
+   *
+   * @default "none"
+   */
+  tokenEndpointAuthMethod?: "none" | undefined;
+};
+interface CloudflareBaseOptions extends ProviderOptions<CloudflareProfile> {
+  /**
+   * The client ID of the Cloudflare OAuth client.
+   */
+  clientId: string;
+}
+/**
+ * Options for configuring the Cloudflare social provider.
+ */
+type CloudflareOptions = CloudflareBaseOptions & CloudflareClientAuthentication;
+declare const cloudflare: (options: CloudflareOptions) => {
+  id: "cloudflare";
+  name: string;
+  accountSubject: ({
+    profile
+  }: OAuthAccountKeyContext<CloudflareProfile>) => string;
+  createAuthorizationURL({
+    state,
+    scopes,
+    codeVerifier,
+    redirectURI
+  }: {
+    state: string;
+    codeVerifier: string;
+    scopes?: string[] | undefined;
+    redirectURI: string;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
+  }): Promise<URL>;
+  validateAuthorizationCode: ({
+    code,
+    codeVerifier,
+    redirectURI
+  }: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens>;
+  refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+  getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
+    user?: {
+      name?: {
+        firstName?: string;
+        lastName?: string;
+      };
+      email?: string;
+    } | undefined;
+  }): Promise<{
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: CloudflareProfile;
+  } | null>;
+  options: CloudflareOptions;
+};
+//#endregion
+export { CloudflareOptions, CloudflareProfile, cloudflare };