@better-auth/core 1.7.2 → 1.7.3

package/dist/db/schema-diff.d.mts

@@ -0,0 +1,104 @@
+import { DBFieldAttribute } from "./type.mjs";
+import { BetterAuthOptions } from "../types/init-options.mjs";
+import { BetterAuthError } from "../error/index.mjs";
+//#region src/db/schema-diff.d.ts
+/**
+ * A column as the database, or an ORM schema definition, reports it.
+ */
+interface IntrospectedColumn {
+  name: string;
+  nullable: boolean;
+  /**
+   * The store fills the column when an insert omits it.
+   */
+  hasDefault: boolean;
+}
+/**
+ * A table as the database, or an ORM schema definition, reports it.
+ */
+interface IntrospectedTable {
+  name: string;
+  /**
+   * The schema the table lives in, when the store has schemas.
+   */
+  schema?: string | undefined;
+  columns: IntrospectedColumn[];
+}
+/**
+ * The tables Better Auth writes, keyed the way the store addresses them:
+ * physical table name, then physical column name. A table that manages its
+ * own storage is excluded from migrations and from this comparison.
+ */
+type ExpectedSchema = Record<string, {
+  fields: Record<string, DBFieldAttribute>;
+  idColumn?: string | undefined;
+  disableMigrations?: boolean | undefined;
+  /**
+   * The schema the table is addressed in. Unset when the store has no
+   * schemas or the table is found by name alone.
+   */
+  schema?: string | undefined;
+}>;
+/**
+ * The tables this configuration writes, keyed the way the adapter addresses
+ * them. Tables that share a physical name are merged into one entry.
+ */
+declare function getExpectedSchema(options: BetterAuthOptions, {
+  usePlural
+}?: {
+  usePlural?: boolean | undefined;
+}): ExpectedSchema;
+type SchemaFinding = {
+  kind: "missing-table";
+  table: string;
+} | {
+  kind: "missing-column";
+  table: string;
+  column: string;
+} | {
+  kind: "unexpected-required-column";
+  table: string;
+  column: string;
+};
+/**
+ * How the schema reaches the store, which decides the fix each finding names.
+ */
+type SchemaSource = "database" | "drizzle" | "prisma";
+/**
+ * Compares the tables Better Auth writes with what the store holds.
+ *
+ * A table or column Better Auth writes must exist. A column Better Auth does
+ * not write must accept an insert that omits it, so it is nullable or carries
+ * a default. Otherwise every insert into that table fails with a constraint
+ * error that says nothing about why the schema drifted.
+ */
+declare function diffSchema(expected: ExpectedSchema, actual: readonly IntrospectedTable[]): SchemaFinding[];
+/**
+ * One finding as a sentence that names the change resolving it.
+ */
+declare function formatSchemaFinding(finding: SchemaFinding, source: SchemaSource): string;
+/**
+ * The store cannot hold what this configuration writes.
+ *
+ * `findings` carries every problem as data; `message` lists each one with the
+ * change that resolves it. Reported during initialization and thrown when
+ * requests await validation, in every environment. Also thrown by
+ * `auth migrate` before it changes anything.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   await auth.api.getSession({ headers });
+ * } catch (error) {
+ *   if (error instanceof SchemaMismatchError) console.error(error.findings);
+ * }
+ * ```
+ */
+declare class SchemaMismatchError extends BetterAuthError {
+  readonly findings: readonly SchemaFinding[];
+  readonly source: SchemaSource;
+  readonly code = "SCHEMA_MISMATCH";
+  constructor(findings: readonly SchemaFinding[], source: SchemaSource);
+}
+//#endregion
+export { ExpectedSchema, IntrospectedColumn, IntrospectedTable, SchemaFinding, SchemaMismatchError, SchemaSource, diffSchema, formatSchemaFinding, getExpectedSchema };

package/dist/db/schema-diff.mjs

@@ -0,0 +1,154 @@
+import { BetterAuthError } from "../error/index.mjs";
+import { getAuthTables } from "./get-tables.mjs";
+//#region src/db/schema-diff.ts
+/**
+* The tables this configuration writes, keyed the way the adapter addresses
+* them. Tables that share a physical name are merged into one entry.
+*/
+function getExpectedSchema(options, { usePlural = false } = {}) {
+	const expected = {};
+	for (const table of Object.values(getAuthTables(options))) {
+		const name = usePlural ? `${table.modelName}s` : table.modelName;
+		const entry = expected[name] ??= {
+			fields: {},
+			disableMigrations: true
+		};
+		for (const [key, field] of Object.entries(table.fields)) entry.fields[field.fieldName || key] = field;
+		entry.disableMigrations = entry.disableMigrations && !!table.disableMigrations;
+	}
+	return expected;
+}
+/**
+* Compares the tables Better Auth writes with what the store holds.
+*
+* A table or column Better Auth writes must exist. A column Better Auth does
+* not write must accept an insert that omits it, so it is nullable or carries
+* a default. Otherwise every insert into that table fails with a constraint
+* error that says nothing about why the schema drifted.
+*/
+function diffSchema(expected, actual) {
+	const findings = [];
+	for (const [tableName, table] of Object.entries(expected)) {
+		if (table.disableMigrations) continue;
+		const actualTable = actual.find((candidate) => candidate.name === tableName && (table.schema === void 0 || candidate.schema === table.schema));
+		if (!actualTable) {
+			findings.push({
+				kind: "missing-table",
+				table: tableName
+			});
+			continue;
+		}
+		const written = new Set([table.idColumn ?? "id", ...Object.keys(table.fields)]);
+		for (const column of written) if (!actualTable.columns.some((candidate) => candidate.name === column)) findings.push({
+			kind: "missing-column",
+			table: tableName,
+			column
+		});
+		for (const column of actualTable.columns) {
+			if (written.has(column.name) || column.nullable || column.hasDefault) continue;
+			findings.push({
+				kind: "unexpected-required-column",
+				table: tableName,
+				column: column.name
+			});
+		}
+	}
+	return findings;
+}
+const applyHint = {
+	database: "Run `npx auth migrate` to add it.",
+	drizzle: "Run `npx auth generate` to refresh the Drizzle schema, then apply it with your migration tool.",
+	prisma: "Run `npx auth generate` to refresh the Prisma schema, then run `prisma migrate`."
+};
+const relaxHint = {
+	database: "Drop the column, make it nullable, or give it a database default.",
+	drizzle: "Remove it from the Drizzle schema, make it nullable, or give it a default, then apply the change with your migration tool.",
+	prisma: "Remove it from the Prisma schema, make it optional, or give it a default, then run `prisma migrate`."
+};
+const sourceLabel = {
+	database: "Database",
+	drizzle: "Drizzle",
+	prisma: "Prisma"
+};
+/**
+* One finding as a sentence that names the change resolving it.
+*/
+function formatSchemaFinding(finding, source) {
+	switch (finding.kind) {
+		case "missing-table": return `Table "${finding.table}" is missing. ${applyHint[source]}`;
+		case "missing-column": return `Column "${finding.column}" is missing from table "${finding.table}". ${applyHint[source]}`;
+		case "unexpected-required-column": {
+			const issuer = finding.column === "issuer" ? " If this column came from Better Auth 1.7.0 through 1.7.2, follow the upgrade guide before removing it: https://www.better-auth.com/docs/guides/1-7-upgrade-guide" : "";
+			return `Column "${finding.column}" on table "${finding.table}" is required but Better Auth never writes it, so every insert into "${finding.table}" fails. ${relaxHint[source]}${issuer}`;
+		}
+	}
+}
+const repairHint = {
+	database: "Make the listed columns nullable, give them defaults, or remove them.",
+	drizzle: "Make the listed columns nullable in your Drizzle schema, give them defaults, or remove them.",
+	prisma: "Make the listed fields optional in your Prisma schema, give them defaults, or remove them."
+};
+const migrationHint = {
+	...applyHint,
+	database: "Run `npx auth migrate` to add the missing tables and columns."
+};
+function formatSchemaMismatch(findings, source) {
+	const tables = [];
+	const columns = [];
+	const required = [];
+	const affectedTables = /* @__PURE__ */ new Set();
+	let hasIssuer = false;
+	for (const finding of findings) switch (finding.kind) {
+		case "missing-table":
+			tables.push(finding.table);
+			break;
+		case "missing-column":
+			columns.push(`${finding.table}.${finding.column}`);
+			break;
+		case "unexpected-required-column":
+			required.push(`${finding.table}.${finding.column}`);
+			affectedTables.add(finding.table);
+			hasIssuer ||= finding.column === "issuer";
+			break;
+	}
+	const sections = [`${sourceLabel[source]} schema mismatch`];
+	if (tables.length) sections.push(`  Missing tables\n    ${tables.join(", ")}`);
+	if (columns.length) sections.push(`  Missing columns\n    ${columns.join("\n    ")}`);
+	if (required.length) {
+		sections.push(`  Required columns Better Auth never writes\n    ${required.join("\n    ")}`);
+		sections.push(`  Inserts into ${[...affectedTables].join(", ")} will fail.`);
+	}
+	const help = [];
+	if (required.length) help.push(repairHint[source]);
+	if (tables.length || columns.length || required.length && source !== "database") help.push(migrationHint[source]);
+	if (help.length) sections.push(`  help: ${help.join("\n        ")}`);
+	if (hasIssuer) sections.push("  note: If this column came from Better Auth 1.7.0 through 1.7.2,\n        follow the upgrade guide before removing it:\n        https://www.better-auth.com/docs/guides/1-7-upgrade-guide");
+	return sections.join("\n\n");
+}
+/**
+* The store cannot hold what this configuration writes.
+*
+* `findings` carries every problem as data; `message` lists each one with the
+* change that resolves it. Reported during initialization and thrown when
+* requests await validation, in every environment. Also thrown by
+* `auth migrate` before it changes anything.
+*
+* @example
+* ```ts
+* try {
+*   await auth.api.getSession({ headers });
+* } catch (error) {
+*   if (error instanceof SchemaMismatchError) console.error(error.findings);
+* }
+* ```
+*/
+var SchemaMismatchError = class extends BetterAuthError {
+	code = "SCHEMA_MISMATCH";
+	constructor(findings, source) {
+		super(formatSchemaMismatch(findings, source));
+		this.findings = findings;
+		this.source = source;
+	}
+};
+//#endregion
+export { SchemaMismatchError, diffSchema, formatSchemaFinding, getExpectedSchema };

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.2";
+const INSTRUMENTATION_VERSION = "1.7.3";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/oauth2/index.d.mts

@@ -2,7 +2,7 @@ import { additionalAuthorizationParamsSchema } from "./authorization-params.mjs"
 import { decodeBasicCredentials, encodeBasicCredentials } from "./basic-credentials.mjs";
 import { CLIENT_ASSERTION_TYPE, ClientAssertionContext, ClientAssertionGetter, ClientAssertionGrantType, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, PrivateKeyJwtClientAssertionGetterOptions, PrivateKeyJwtSigningAlgorithm, createPrivateKeyJwtClientAssertionGetter, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion } from "./client-assertion.mjs";
 import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, OAuthAccountSubject, OAuthIdTokenConfig, OAuthMappedUser, OAuthProvider, OAuthRefreshContext, ProviderOptions } from "./oauth-provider.mjs";
-import { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
+import { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointRequestContext, TokenEndpointRequestHook, TokenEndpointSecretAuthentication } from "./token-endpoint-auth.mjs";
 import { clientCredentialsToken, clientCredentialsTokenRequest } from "./client-credentials-token.mjs";
 import { RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, createAuthorizationURL } from "./create-authorization-url.mjs";
 import { AccessTokenAuthorization, AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, DpopBindingError, DpopBindingErrorCode, DpopProofError, DpopProofErrorCode, DpopReplayReservation, DpopReplayReservations, DpopReplayStore, DpopSigningAlgorithm, EnforceDpopBindingParams, VerifiedDpopProof, VerifyDpopProofOptions, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, deriveDpopAth, deriveDpopJkt, enforceDpopBinding, getConfirmationJkt, getDpopJktFromPayload, isDpopBindingError, isDpopProofError, normalizeDpopHtu, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof } from "./dpop.mjs";
@@ -11,4 +11,4 @@ import { applyDefaultAccessTokenExpiry, generateCodeChallenge, getOAuth2Tokens,
 import { authorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
 import { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, createInsufficientScopeError, getJwks, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken } from "./verify.mjs";
 import { supportsIdTokenSignIn, verifyProviderIdToken } from "./verify-id-token.mjs";
-export { type AccessTokenAuthorization, type AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, type ClientAssertionContext, type ClientAssertionGetter, type ClientAssertionGrantType, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, type DpopBindingError, type DpopBindingErrorCode, type DpopProofError, type DpopProofErrorCode, type DpopReplayReservation, type DpopReplayReservations, type DpopReplayStore, type DpopSigningAlgorithm, type EnforceDpopBindingParams, type OAuth2Tokens, type OAuth2UserInfo, type OAuthAccountKeyContext, type OAuthAccountSubject, type OAuthIdTokenConfig, type OAuthMappedUser, type OAuthProvider, type OAuthRefreshContext, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, type PrivateKeyJwtClientAssertionGetterOptions, type PrivateKeyJwtSigningAlgorithm, type ProviderOptions, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, type ResourceRequestInput, type TokenEndpointAuth, type TokenEndpointAuthMethod, type TokenEndpointSecretAuthentication, type VerifiedDpopProof, type VerifyAccessTokenOptions, type VerifyAccessTokenRequestOptions, type VerifyDpopProofOptions, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createInsufficientScopeError, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, isInsufficientScopeError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };
+export { type AccessTokenAuthorization, type AccessTokenAuthorizationScheme, BEARER_AUTHORIZATION_SCHEME, CLIENT_ASSERTION_TYPE, type ClientAssertionContext, type ClientAssertionGetter, type ClientAssertionGrantType, DPOP_AUTHORIZATION_SCHEME, DPOP_PROOF_TYPE, DPOP_SIGNING_ALGORITHMS, type DpopBindingError, type DpopBindingErrorCode, type DpopProofError, type DpopProofErrorCode, type DpopReplayReservation, type DpopReplayReservations, type DpopReplayStore, type DpopSigningAlgorithm, type EnforceDpopBindingParams, type OAuth2Tokens, type OAuth2UserInfo, type OAuthAccountKeyContext, type OAuthAccountSubject, type OAuthIdTokenConfig, type OAuthMappedUser, type OAuthProvider, type OAuthRefreshContext, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS, type PrivateKeyJwtClientAssertionGetterOptions, type PrivateKeyJwtSigningAlgorithm, type ProviderOptions, RESERVED_AUTHORIZATION_PARAMS, RESERVED_AUTHORIZATION_PARAMS_SET, type ResourceRequestInput, type TokenEndpointAuth, type TokenEndpointAuthMethod, type TokenEndpointRequestContext, type TokenEndpointRequestHook, type TokenEndpointSecretAuthentication, type VerifiedDpopProof, type VerifyAccessTokenOptions, type VerifyAccessTokenRequestOptions, type VerifyDpopProofOptions, additionalAuthorizationParamsSchema, applyDefaultAccessTokenExpiry, authorizationCodeRequest, clientCredentialsToken, clientCredentialsTokenRequest, createAuthorizationURL, createDpopBindingError, createDpopProofError, createDpopReplayStore, createInMemoryDpopReplayStore, createInsufficientScopeError, createPrivateKeyJwtClientAssertionGetter, decodeBasicCredentials, deriveDpopAth, deriveDpopJkt, encodeBasicCredentials, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, getOAuth2Tokens, getPrimaryClientId, isDpopBindingError, isDpopProofError, isInsufficientScopeError, mergeScopes, normalizeDpopHtu, parseAccessTokenAuthorization, refreshAccessToken, refreshAccessTokenRequest, requestToResourceInput, resolveClientAssertionParams, signPrivateKeyJwtClientAssertion, stripAccessTokenAuthorizationScheme, supportsIdTokenSignIn, validateAuthorizationCode, validateToken, verifyAccessTokenRequest, verifyBearerToken, verifyDpopProof, verifyJwsAccessToken, verifyProviderIdToken };

package/dist/oauth2/oauth-provider.d.mts

@@ -214,16 +214,6 @@ interface OAuthProvider<T extends object = object, O extends object = Partial<Pr
    * against this value to prevent authorization server mix-up attacks.
    */
   issuer?: string | undefined;
-  /**
-   * Stable issuer used with the provider subject to recognize an account.
-   *
-   * Use the validated OpenID Connect issuer for OIDC providers. A resolver is
-   * supported for tenant-specific issuers and receives only provider-verified
-   * data. OAuth providers without an issuer omit this property and are scoped
-   * to the synthetic `local:oauth:<encoded providerId>` issuer, where the
-   * provider ID segment is percent-encoded.
-   */
-  accountIssuer?: string | OAuthAccountKeyResolver<T, string> | undefined;
   /**
    * Require shared OAuth redirect routes to bind ID-token verification to an
    * authorization request nonce. When true, routes generate `idTokenNonce`,

package/dist/oauth2/token-endpoint-auth.d.mts

@@ -1,4 +1,4 @@
-import { ClientAssertionGetter } from "./client-assertion.mjs";
+import { ClientAssertionGetter, ClientAssertionGrantType } from "./client-assertion.mjs";
 
 //#region src/oauth2/token-endpoint-auth.d.ts
 type TokenEndpointAuth = {
@@ -10,8 +10,32 @@ type TokenEndpointAuth = {
 } | {
   method: "private_key_jwt";
   getClientAssertion: ClientAssertionGetter;
+} | {
+  method: "custom";
+  /**
+   * Customize the token request after standard grant parameters are set.
+   */
+  customizeRequest: TokenEndpointRequestHook;
 };
 type TokenEndpointAuthMethod = TokenEndpointAuth["method"];
 type TokenEndpointSecretAuthentication = "basic" | "post";
+/**
+ * Mutable token request state passed to a custom authentication strategy.
+ */
+interface TokenEndpointRequestContext {
+  body: URLSearchParams;
+  headers: Record<string, string>;
+  options: TokenEndpointClientOptions;
+  tokenEndpoint: string;
+  grantType: ClientAssertionGrantType;
+}
+/**
+ * Applies provider-specific authentication to a token request.
+ */
+type TokenEndpointRequestHook = (context: TokenEndpointRequestContext) => void | Promise<void>;
+interface TokenEndpointClientOptions {
+  clientId?: string | string[] | undefined;
+  clientSecret?: string | undefined;
+}
 //#endregion
-export { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointSecretAuthentication };
+export { TokenEndpointAuth, TokenEndpointAuthMethod, TokenEndpointRequestContext, TokenEndpointRequestHook, TokenEndpointSecretAuthentication };

package/dist/oauth2/token-endpoint-auth.mjs

@@ -46,6 +46,17 @@ async function applyTokenEndpointAuth({ body, headers, options, tokenEndpoint, g
 		return;
 	}
 	const auth = tokenEndpointAuth ?? getDefaultTokenEndpointAuth(options, authentication);
+	if (auth.method === "custom") {
+		await auth.customizeRequest({
+			body,
+			headers,
+			options,
+			tokenEndpoint,
+			grantType
+		});
+		assertCompleteManualClientAssertion(body);
+		return;
+	}
 	if (auth.method === "private_key_jwt") {
 		assertNoClientSecret(auth.method, options, body);
 		assertClientIdConfigured(auth.method, clientId);

package/dist/social-providers/apple.d.mts

@@ -72,7 +72,6 @@ declare const apple: (options: AppleOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<AppleProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/apple.mjs

@@ -13,7 +13,6 @@ const apple = (options) => {
 		id: "apple",
 		name: "Apple",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: "https://appleid.apple.com",
 		async createAuthorizationURL({ state, scopes, redirectURI, additionalParams, codeVerifier }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client ID and client secret are required for Apple. Make sure to provide them in the options.");

package/dist/social-providers/cloudflare.d.mts

@@ -0,0 +1,132 @@
+import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+//#region src/social-providers/cloudflare.d.ts
+/**
+ * The user profile returned by the Cloudflare API `/user` endpoint.
+ *
+ * @see https://developers.cloudflare.com/api/resources/user/methods/get/
+ */
+interface CloudflareProfile {
+  /**
+   * Identifier of the user.
+   */
+  id: string;
+  /**
+   * Current email address of the user.
+   */
+  email: string;
+  /**
+   * The user's first name.
+   */
+  first_name?: string | null | undefined;
+  /**
+   * The user's last name.
+   */
+  last_name?: string | null | undefined;
+  /**
+   * The country in which the user lives.
+   */
+  country?: string | null | undefined;
+  /**
+   * The user's telephone number.
+   */
+  telephone?: string | null | undefined;
+  /**
+   * The zipcode or postal code where the user lives.
+   */
+  zipcode?: string | null | undefined;
+  /**
+   * Indicates whether two-factor authentication is enabled for the user account.
+   */
+  two_factor_authentication_enabled?: boolean | undefined;
+  /**
+   * Indicates whether the user has been suspended.
+   */
+  suspended?: boolean | undefined;
+}
+/**
+ * Token endpoint authentication supported by Cloudflare OAuth clients.
+ *
+ * @see https://developers.cloudflare.com/fundamentals/oauth/create-an-oauth-client/#choose-a-flow
+ */
+type CloudflareClientAuthentication = {
+  /**
+   * The client secret of a confidential Cloudflare OAuth client.
+   */
+  clientSecret: string;
+  /**
+   * The authentication method configured for the token endpoint.
+   *
+   * @default "client_secret_basic"
+   */
+  tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | undefined;
+} | {
+  /**
+   * Clients that use PKCE do not have a client secret.
+   */
+  clientSecret?: undefined;
+  /**
+   * Clients without a secret do not authenticate at the token endpoint.
+   *
+   * @default "none"
+   */
+  tokenEndpointAuthMethod?: "none" | undefined;
+};
+interface CloudflareBaseOptions extends ProviderOptions<CloudflareProfile> {
+  /**
+   * The client ID of the Cloudflare OAuth client.
+   */
+  clientId: string;
+}
+/**
+ * Options for configuring the Cloudflare social provider.
+ */
+type CloudflareOptions = CloudflareBaseOptions & CloudflareClientAuthentication;
+declare const cloudflare: (options: CloudflareOptions) => {
+  id: "cloudflare";
+  name: string;
+  accountSubject: ({
+    profile
+  }: OAuthAccountKeyContext<CloudflareProfile>) => string;
+  createAuthorizationURL({
+    state,
+    scopes,
+    codeVerifier,
+    redirectURI
+  }: {
+    state: string;
+    codeVerifier: string;
+    scopes?: string[] | undefined;
+    redirectURI: string;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
+  }): Promise<URL>;
+  validateAuthorizationCode: ({
+    code,
+    codeVerifier,
+    redirectURI
+  }: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens>;
+  refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+  getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
+    user?: {
+      name?: {
+        firstName?: string;
+        lastName?: string;
+      };
+      email?: string;
+    } | undefined;
+  }): Promise<{
+    user: OAuth2UserInfo & Record<string, unknown>;
+    data: CloudflareProfile;
+  } | null>;
+  options: CloudflareOptions;
+};
+//#endregion
+export { CloudflareOptions, CloudflareProfile, cloudflare };

package/dist/social-providers/cloudflare.mjs

@@ -0,0 +1,85 @@
+import { logger } from "../env/logger.mjs";
+import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
+import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
+import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/social-providers/cloudflare.ts
+const authorizationEndpoint = "https://dash.cloudflare.com/oauth2/auth";
+const tokenEndpoint = "https://dash.cloudflare.com/oauth2/token";
+/**
+* Cloudflare's OIDC `userinfo` endpoint only returns the `sub` claim, so it
+* cannot be used to build a user. The user's profile (email, name, ...) is
+* read from the Cloudflare API `/user` endpoint instead, which the access
+* token can call when the `user-details.read` scope is granted.
+*/
+const userEndpoint = "https://api.cloudflare.com/client/v4/user";
+const getTokenEndpointAuth = (options) => {
+	const defaultMethod = options.clientSecret ? "client_secret_basic" : "none";
+	return { method: options.tokenEndpointAuthMethod ?? defaultMethod };
+};
+const cloudflare = (options) => {
+	return {
+		id: "cloudflare",
+		name: "Cloudflare",
+		accountSubject: ({ profile }) => profile.id,
+		createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+			const _scopes = options.disableDefaultScope ? [] : ["user-details.read"];
+			if (options.scope?.length) _scopes.push(...options.scope);
+			if (scopes?.length) _scopes.push(...scopes);
+			return createAuthorizationURL({
+				id: "cloudflare",
+				options,
+				authorizationEndpoint,
+				scopes: _scopes.length ? [...new Set(_scopes)] : void 0,
+				state,
+				codeVerifier,
+				redirectURI
+			});
+		},
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
+			return validateAuthorizationCode({
+				code,
+				codeVerifier,
+				redirectURI,
+				options,
+				tokenEndpoint,
+				tokenEndpointAuth: getTokenEndpointAuth(options)
+			});
+		},
+		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
+			return refreshAccessToken({
+				refreshToken,
+				options: {
+					clientId: options.clientId,
+					clientKey: options.clientKey,
+					clientSecret: options.clientSecret
+				},
+				tokenEndpoint,
+				tokenEndpointAuth: getTokenEndpointAuth(options)
+			});
+		},
+		async getUserInfo(token) {
+			if (options.getUserInfo) return options.getUserInfo(token);
+			const { data, error } = await betterFetch(userEndpoint, { headers: { authorization: `Bearer ${token.accessToken}` } });
+			if (error || !data?.success || !data.result) {
+				logger.error("Failed to fetch user info from Cloudflare:", error ?? data?.errors);
+				return null;
+			}
+			const profile = data.result;
+			const name = [profile.first_name, profile.last_name].filter(Boolean).join(" ") || profile.email;
+			const userMap = await options.mapProfileToUser?.(profile);
+			return {
+				user: {
+					name,
+					email: profile.email,
+					emailVerified: false,
+					...userMap
+				},
+				data: profile
+			};
+		},
+		options
+	};
+};
+//#endregion
+export { cloudflare };

package/dist/social-providers/cognito.d.mts

@@ -52,7 +52,6 @@ declare const cognito: (options: CognitoOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<CognitoProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/cognito.mjs

@@ -20,7 +20,6 @@ const cognito = (options) => {
 		id: "cognito",
 		name: "Cognito",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: `https://cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`,
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("ClientId is required for Amazon Cognito. Make sure to provide them in the options.");

package/dist/social-providers/facebook.d.mts

@@ -42,7 +42,6 @@ declare const facebook: (options: FacebookOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<FacebookProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/facebook.mjs

@@ -40,7 +40,6 @@ const facebook = (options) => {
 		id: "facebook",
 		name: "Facebook",
 		accountSubject: ({ profile }) => "sub" in profile ? profile.sub : profile.id,
-		accountIssuer: "https://www.facebook.com",
 		async createAuthorizationURL({ state, scopes, redirectURI, loginHint, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client ID and client secret are required for Facebook. Make sure to provide them in the options.");

package/dist/social-providers/google.d.mts

@@ -85,7 +85,6 @@ declare const google: (options: GoogleOptions) => {
   accountSubject: ({
     profile
   }: OAuthAccountKeyContext<GoogleProfile>) => string;
-  accountIssuer: string;
   createAuthorizationURL({
     state,
     scopes,

package/dist/social-providers/google.mjs

@@ -54,7 +54,6 @@ const google = (options) => {
 		id: "google",
 		name: "Google",
 		accountSubject: ({ profile }) => profile.sub,
-		accountIssuer: "https://accounts.google.com",
 		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, display, additionalParams }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error("Client Id and Client Secret is required for Google. Make sure to provide them in the options.");