@better-auth/oauth-provider 1.6.22 → 1.6.24

package/dist/client-resource.d.mts

@@ -1,7 +1,6 @@
-import { s as ResourceServerMetadata } from "./oauth-D74mBkw6.mjs";
+import { s as ResourceServerMetadata } from "./oauth-BFBataE_.mjs";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";
-
 //#region src/client-resource.d.ts
 type ResourceClientAuth = {
   options: {
@@ -69,20 +68,23 @@ type VerifyAccessTokenAuthOpts = {
   verifyOptions?: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience">>;
   scopes?: string[];
   jwksUrl?: string;
-  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type VerifyAccessTokenNoAuthOpts = {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   scopes?: string[];
   jwksUrl: string;
-  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 } | {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   scopes?: string[];
   jwksUrl?: string;
-  remoteVerify: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify: VerifyAccessTokenRemote;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type ProtectedResourceMetadataOutput<T> = T extends undefined ? (overrides: ResourceServerMetadata, opts?: {

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { a as getJwtPlugin, b as handleMcpErrors, o as getOAuthProviderPlugin } from "./utils-DQLdireY.mjs";
-import { t as PACKAGE_VERSION } from "./version-DaSfXJQ1.mjs";
+import { a as getJwtPlugin, b as handleMcpErrors, o as getOAuthProviderPlugin } from "./utils-C7lKElJN.mjs";
+import { t as PACKAGE_VERSION } from "./version-rl1vdpzB.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";
@@ -26,6 +26,14 @@ const oauthProviderResourceClient = (auth) => {
 		version: PACKAGE_VERSION,
 		getActions() {
 			return {
+				/**
+				* Performs verification of an access token for your APIs. Can perform
+				* local verification using `jwksUrl` by default. Can also be configured
+				* for remote introspection using `remoteVerify` if a confidential client
+				* is set up for this API.
+				*
+				* The optional auth parameter can fill known values automatically.
+				*/
 				verifyAccessToken: (async (token, opts) => {
 					const jwtPluginOptions = await getJwtPluginOptions();
 					const audience = opts?.verifyOptions?.audience ?? authServerBaseUrl;
@@ -53,13 +61,23 @@ const oauthProviderResourceClient = (auth) => {
 						throw handleMcpErrors(error, audience, { resourceMetadataMappings: opts?.resourceMetadataMappings });
 					}
 				}),
+				/**
+				* An authorization server does not typically publish
+				* the `/.well-known/oauth-protected-resource` themselves.
+				* Thus, we provide a client-only endpoint to help set up
+				* your protected resource metadata.
+				*
+				* The optional auth parameter can fill known values automatically.
+				*
+				* @see https://datatracker.ietf.org/doc/html/rfc8414#section-2
+				*/
 				getProtectedResourceMetadata: (async (overrides, opts) => {
 					const resource = overrides?.resource ?? authServerBaseUrl;
 					const oauthProviderOptions = (await getOauthProviderPlugin())?.options;
 					if (!resource) throw Error("missing required resource");
 					if (oauthProviderOptions?.scopes && opts?.externalScopes && (overrides?.authorization_servers?.length ?? 0) <= 1) throw new BetterAuthError("external scopes should not be provided with one authorization server");
 					if (overrides?.scopes_supported) {
-						const allValidScopes = new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
+						const allValidScopes = /* @__PURE__ */ new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
 						for (const sc of overrides.scopes_supported) {
 							if (sc === "openid") throw new BetterAuthError("Only the Auth Server should utilize the openid scope");
 							if ([

package/dist/client.d.mts

@@ -1,6 +1,4 @@
-import { n as oauthProvider } from "./oauth-DZ80cNUW.mjs";
-import * as _better_fetch_fetch0 from "@better-fetch/fetch";
-
+import { n as oauthProvider } from "./oauth-dQVivAXR.mjs";
 //#region src/client.d.ts
 declare const oauthProviderClient: () => {
   id: "oauth-provider-client";
@@ -10,7 +8,7 @@ declare const oauthProviderClient: () => {
     name: string;
     description: string;
     hooks: {
-      onRequest<T extends Record<string, any>>(ctx: _better_fetch_fetch0.RequestContext<T>): Promise<void>;
+      onRequest<T extends Record<string, any>>(ctx: import("@better-fetch/fetch").RequestContext<T>): Promise<void>;
     };
   }[];
   $InferServerPlugin: ReturnType<typeof oauthProvider>;

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { n as buildSignedOAuthQuery, t as PACKAGE_VERSION } from "./version-DaSfXJQ1.mjs";
+import { n as buildSignedOAuthQuery, t as PACKAGE_VERSION } from "./version-rl1vdpzB.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 //#region src/client.ts
 const oauthProviderClient = () => {

package/dist/index.d.mts

@@ -1,10 +1,9 @@
-import { _ as Scope, a as OAuthClient, b as Awaitable, c as TokenEndpointAuthMethod, d as OAuthConsent, f as OAuthOpaqueAccessToken, g as SchemaClient, h as Prompt, i as GrantType, l as AuthorizePrompt, m as OAuthRefreshToken, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions, r as BearerMethodsSupported, s as ResourceServerMetadata, t as AuthMethod, u as OAuthAuthorizationQuery, v as StoreTokenType, y as VerificationValue } from "./oauth-D74mBkw6.mjs";
-import { n as oauthProvider, t as getOAuthProviderState } from "./oauth-DZ80cNUW.mjs";
+import { _ as Scope, a as OAuthClient, b as Awaitable, c as TokenEndpointAuthMethod, d as OAuthConsent, f as OAuthOpaqueAccessToken, g as SchemaClient, h as Prompt, i as GrantType, l as AuthorizePrompt, m as OAuthRefreshToken, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions, r as BearerMethodsSupported, s as ResourceServerMetadata, t as AuthMethod, u as OAuthAuthorizationQuery, v as StoreTokenType, y as VerificationValue } from "./oauth-BFBataE_.mjs";
+import { n as oauthProvider, t as getOAuthProviderState } from "./oauth-dQVivAXR.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { JWTPayload } from "jose";
 import { GenericEndpointContext } from "@better-auth/core";
-
 //#region src/mcp.d.ts
 /**
  * A request middleware handler that checks and responds with
@@ -12,10 +11,11 @@ import { GenericEndpointContext } from "@better-auth/core";
  *
  * @external
  */
-declare const mcpHandler: (/** Resource is the same url as the audience */
-
+declare const mcpHandler: (
+/** Resource is the same url as the audience */
 verifyOptions: Parameters<typeof verifyAccessToken>[1], handler: (req: Request, jwt: JWTPayload) => Awaitable<Response>, opts?: {
-  /** Maps non-url (ie urn, client) resources to resource_metadata */resourceMetadataMappings: Record<string, string>;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  resourceMetadataMappings: Record<string, string>;
 }) => (req: Request) => Promise<Response>;
 //#endregion
 //#region src/metadata.d.ts
@@ -62,4 +62,4 @@ declare const oauthProviderOpenIdConfigMetadata: <Auth extends {
   headers?: HeadersInit;
 }) => (request: Request) => Promise<Response>;
 //#endregion
-export { AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, GrantType, OAuthAuthorizationQuery, OAuthClient, OAuthConsent, OAuthOpaqueAccessToken, OAuthOptions, OAuthRefreshToken, OIDCMetadata, Prompt, ResourceServerMetadata, SchemaClient, Scope, StoreTokenType, TokenEndpointAuthMethod, VerificationValue, authServerMetadata, getOAuthProviderState, mcpHandler, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { type AuthMethod, type AuthServerMetadata, type AuthorizePrompt, type BearerMethodsSupported, type GrantType, type OAuthAuthorizationQuery, type OAuthClient, type OAuthConsent, type OAuthOpaqueAccessToken, type OAuthOptions, type OAuthRefreshToken, type OIDCMetadata, type Prompt, type ResourceServerMetadata, type SchemaClient, type Scope, type StoreTokenType, type TokenEndpointAuthMethod, type VerificationValue, authServerMetadata, getOAuthProviderState, mcpHandler, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { _ as storeToken, a as getJwtPlugin, c as isPKCERequired, d as parsePrompt, f as removePromptFromQuery, g as storeClientSecret, h as searchParamsToQuery, i as getClient, l as normalizeTimestampValue, m as resolveSubjectIdentifier, n as clientAllowsGrant, p as resolveSessionAuthTime, r as decryptStoredClientSecret, s as getStoredToken, t as basicToClientCredentials, u as parseClientMetadata, v as validateClientCredentials, x as mcpHandler, y as verifyOAuthQueryParams } from "./utils-DQLdireY.mjs";
-import { a as postLoginClearedParam, i as getSignedQueryIssuedAt, o as setSignedOAuthQueryParameterNames, r as canonicalizeOAuthQueryParams, s as signedQueryIssuedAtParam, t as PACKAGE_VERSION } from "./version-DaSfXJQ1.mjs";
+import { _ as storeToken, a as getJwtPlugin, c as isPKCERequired, d as parsePrompt, f as removePromptFromQuery, g as storeClientSecret, h as searchParamsToQuery, i as getClient, l as normalizeTimestampValue, m as resolveSubjectIdentifier, n as clientAllowsGrant, p as resolveSessionAuthTime, r as decryptStoredClientSecret, s as getStoredToken, t as basicToClientCredentials, u as parseClientMetadata, v as validateClientCredentials, x as mcpHandler, y as verifyOAuthQueryParams } from "./utils-C7lKElJN.mjs";
+import { a as postLoginClearedParam, i as getSignedQueryIssuedAt, o as setSignedOAuthQueryParameterNames, r as canonicalizeOAuthQueryParams, s as signedQueryIssuedAtParam, t as PACKAGE_VERSION } from "./version-rl1vdpzB.mjs";
 import { APIError, createAuthEndpoint, createAuthMiddleware, dispatchAuthEndpoint, getOAuthState, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { generateCodeChallenge, getJwks, verifyJwsAccessToken } from "better-auth/oauth2";
 import { APIError as APIError$1 } from "better-call";
@@ -708,7 +708,7 @@ async function handleClientCredentialsGrant(ctx, opts) {
 	let requestedScopes = scope?.split(" ");
 	if (requestedScopes) {
 		const validScopes = new Set(client.scopes ?? opts.scopes);
-		const oidcScopes = new Set([
+		const oidcScopes = /* @__PURE__ */ new Set([
 			"openid",
 			"profile",
 			"email",
@@ -1680,6 +1680,7 @@ const adminCreateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/creat
 			responses: { "200": {
 				description: "OAuth2 application registered successfully",
 				content: { "application/json": { schema: {
+					/** @returns {OauthClient} */
 					type: "object",
 					properties: {
 						client_id: {
@@ -1855,6 +1856,7 @@ const createOAuthClient = (opts) => createAuthEndpoint("/oauth2/create-client",
 		responses: { "200": {
 			description: "OAuth2 application registered successfully",
 			content: { "application/json": { schema: {
+				/** @returns {OauthClient} */
 				type: "object",
 				properties: {
 					client_id: {
@@ -2581,6 +2583,11 @@ const schema = {
 			}
 		}
 	},
+	/**
+	* An opaque refresh token created with "offline_access"
+	*
+	* Refresh tokens are linked to a session.
+	*/
 	oauthRefreshToken: { fields: {
 		token: {
 			type: "string",
@@ -2634,6 +2641,18 @@ const schema = {
 			required: true
 		}
 	} },
+	/**
+	* An opaque access token sent when there is no audience
+	* to assigned to the JWT.
+	*
+	* Access tokens are linked to a session, better-auth
+	* authors SHALL always check for valid session!
+	*
+	* AccessTokens SHALL only be created at refresh,
+	* destroyed at revoke, and read at introspection.
+	* NEVER update an access token! Typically a refresh and
+	* revoke (if not expired) may want to occur at the same time.
+	*/
 	oauthAccessToken: {
 		modelName: "oauthAccessToken",
 		fields: {
@@ -2738,7 +2757,7 @@ const getOAuthProviderState = oAuthState.get;
 const oauthProvider = (options) => {
 	let clientRegistrationAllowedScopes = options.clientRegistrationAllowedScopes;
 	if (options.clientRegistrationDefaultScopes) {
-		const _allowedScopes = clientRegistrationAllowedScopes ? new Set([...clientRegistrationAllowedScopes, ...options.clientRegistrationDefaultScopes]) : new Set([...options.clientRegistrationDefaultScopes]);
+		const _allowedScopes = clientRegistrationAllowedScopes ? /* @__PURE__ */ new Set([...clientRegistrationAllowedScopes, ...options.clientRegistrationDefaultScopes]) : /* @__PURE__ */ new Set([...options.clientRegistrationDefaultScopes]);
 		clientRegistrationAllowedScopes = Array.from(_allowedScopes);
 	}
 	const scopes = new Set((options.scopes ?? [
@@ -2751,7 +2770,7 @@ const oauthProvider = (options) => {
 		for (const sc of clientRegistrationAllowedScopes) if (!scopes.has(sc)) throw new BetterAuthError(`clientRegistrationAllowedScope ${sc} not found in scopes`);
 	}
 	for (const sc of options.advertisedMetadata?.scopes_supported ?? []) if (!scopes?.has(sc)) throw new BetterAuthError(`advertisedMetadata.scopes_supported ${sc} not found in scopes`);
-	const claims = new Set([
+	const claims = /* @__PURE__ */ new Set([
 		"sub",
 		"iss",
 		"aud",
@@ -2803,7 +2822,7 @@ const oauthProvider = (options) => {
 			issuerPath = new URL(ctx.baseURL).pathname.replace(/\/$/, "") || "";
 		}
 		const endpointCtx = { context: ctx };
-		const authServerMetadataPaths = new Set([`/.well-known/oauth-authorization-server${issuerPath}`, `${issuerPath}/.well-known/oauth-authorization-server`]);
+		const authServerMetadataPaths = /* @__PURE__ */ new Set([`/.well-known/oauth-authorization-server${issuerPath}`, `${issuerPath}/.well-known/oauth-authorization-server`]);
 		const openIdConfigPath = `${issuerPath}/.well-known/openid-configuration`;
 		const isAuthServerMetadataRequest = authServerMetadataPaths.has(requestPath);
 		const isOpenIdConfigRequest = opts.scopes?.includes("openid") && requestPath === openIdConfigPath;
@@ -2958,7 +2977,8 @@ const oauthProvider = (options) => {
 			}
 		} }
 	}, async (ctx) => {
-		return authorizeEndpoint(ctx, opts, ctx.authorizeSettings ?? { isAuthorize: true });
+		const settings = ctx.authorizeSettings ?? { isAuthorize: true };
+		return authorizeEndpoint(ctx, opts, settings);
 	});
 	const runOAuth2Authorize = (ctx, settings) => dispatchAuthEndpoint(oauth2AuthorizeEndpoint, {
 		...ctx,
@@ -3038,6 +3058,13 @@ const oauthProvider = (options) => {
 			}]
 		},
 		endpoints: {
+			/**
+			* A server-only endpoint that helps provide the
+			* oAuth Server configuration at the well-known endpoint.
+			*
+			* Provided at /.well-known/oauth-authorization-server/[issuer-path]
+			* (root if no issuer-path).
+			*/
 			getOAuthServerConfig: createAuthEndpoint("/.well-known/oauth-authorization-server", {
 				method: "GET",
 				metadata: { SERVER_ONLY: true }
@@ -3051,6 +3078,13 @@ const oauthProvider = (options) => {
 					jwt_disabled: opts.disableJwtPlugin
 				});
 			}),
+			/**
+			* A server-only endpoint that helps provide the
+			* OpenId configuration at the well-known endpoint.
+			*
+			* Provided at [issuer-path]/.well-known/openid-configuration
+			* (root if no issuer-path).
+			*/
 			getOpenIdConfig: createAuthEndpoint("/.well-known/openid-configuration", {
 				method: "GET",
 				metadata: { SERVER_ONLY: true }
@@ -3582,6 +3616,7 @@ const oauthProvider = (options) => {
 					responses: { "200": {
 						description: "OAuth2 application registered successfully",
 						content: { "application/json": { schema: {
+							/** @returns {OauthClient} */
 							type: "object",
 							properties: {
 								client_id: {

package/dist/{oauth-D74mBkw6.d.mts → oauth-BFBataE_.d.mts}

@@ -2,7 +2,6 @@ import { JWSAlgorithms } from "better-auth/plugins";
 import { JWTPayload } from "jose";
 import { InferOptionSchema, Session, User } from "better-auth/types";
 import { GenericEndpointContext, LiteralString } from "@better-auth/core";
-
 //#region src/schema.d.ts
 declare const schema: {
   oauthClient: {
@@ -398,7 +397,7 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @example
    * { "write:payments": "5m", "read:payments": "30m" }
    */
-  scopeExpirations?: { [K in Scopes[number]]?: number | string | Date };
+  scopeExpirations?: { [K in Scopes[number]]?: number | string | Date; };
   /**
    * Allows /oauth2/public-client-prelogin endpoint to be
    * requestable prior to login via a valid oauth_query.
@@ -722,10 +721,12 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @returns Additional claims for userinfo request
    */
   customUserInfoClaims?: (info: {
-    /** The user object */user: User & Record<string, unknown>;
+    /** The user object */
+    user: User & Record<string, unknown>;
     /** The scopes from the access token used
      * in the /userinfo request (matches jwt.scopes) */
-    scopes: Scopes; /** The access token payload used in the /userinfo request */
+    scopes: Scopes;
+    /** The access token payload used in the /userinfo request */
     jwt: JWTPayload;
   }) => Awaitable<Record<string, any>>;
   /**
@@ -739,8 +740,11 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @param info - context that may be useful when creating custom claims
    */
   customIdTokenClaims?: (info: {
-    /** The user object if token is associated to a user. */user: User & Record<string, unknown>; /** Scopes granted for this token */
-    scopes: Scopes; /** oAuthClient metadata */
+    /** The user object if token is associated to a user. */
+    user: User & Record<string, unknown>;
+    /** Scopes granted for this token */
+    scopes: Scopes;
+    /** oAuthClient metadata */
     metadata?: Record<string, any>;
   }) => Awaitable<Record<string, any>>;
   /**
@@ -757,10 +761,15 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @param info - context that may be useful when creating custom claims
    */
   customAccessTokenClaims?: (info: {
-    /** The user object if token is associated to a user. Null if user doesn't exist. Undefined if user not applicable. */user?: (User & Record<string, unknown>) | null; /** reference of the consent/authorization */
-    referenceId?: string; /** Scopes granted for this token */
-    scopes: Scopes; /** The resource requesting. Provided by the token endpoint. */
-    resource?: string; /** oAuthClient metadata */
+    /** The user object if token is associated to a user. Null if user doesn't exist. Undefined if user not applicable. */
+    user?: (User & Record<string, unknown>) | null;
+    /** reference of the consent/authorization */
+    referenceId?: string;
+    /** Scopes granted for this token */
+    scopes: Scopes;
+    /** The resource requesting. Provided by the token endpoint. */
+    resource?: string;
+    /** oAuthClient metadata */
     metadata?: Record<string, any>;
   }) => Awaitable<Record<string, any>>;
   /**
@@ -775,14 +784,17 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @param info - context that may be useful when creating custom fields
    */
   customTokenResponseFields?: (info: {
-    /** The grant type being processed */grantType: GrantType;
+    /** The grant type being processed */
+    grantType: GrantType;
     /**
      * The user, if applicable.
      * Undefined for `client_credentials` (M2M, no user).
      * Always present for `authorization_code` and `refresh_token`.
      */
-    user?: (User & Record<string, unknown>) | null; /** Scopes granted for this token */
-    scopes: Scopes; /** oAuthClient metadata */
+    user?: (User & Record<string, unknown>) | null;
+    /** Scopes granted for this token */
+    scopes: Scopes;
+    /** oAuthClient metadata */
     metadata?: Record<string, any>;
     /**
      * The authorization code verification value.

package/dist/{oauth-DZ80cNUW.d.mts → oauth-dQVivAXR.d.mts}

@@ -1,10 +1,5 @@
-import { _ as Scope, a as OAuthClient, d as OAuthConsent, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions } from "./oauth-D74mBkw6.mjs";
-import * as better_call0 from "better-call";
+import { _ as Scope, a as OAuthClient, d as OAuthConsent, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions } from "./oauth-BFBataE_.mjs";
 import * as z from "zod";
-import * as better_auth_plugins0 from "better-auth/plugins";
-import * as jose from "jose";
-import * as better_auth0 from "better-auth";
-
 //#region src/oauth.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -29,20 +24,20 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   id: "oauth-provider";
   version: string;
   options: NoInfer<O>;
-  init: (ctx: better_auth0.AuthContext) => void;
-  onRequest: (request: Request, ctx: better_auth0.AuthContext) => Promise<{
+  init: (ctx: import("better-auth").AuthContext) => void;
+  onRequest: (request: Request, ctx: import("better-auth").AuthContext) => Promise<{
     response: Response;
   } | {
     request: Request;
   } | void>;
   hooks: {
     before: {
-      matcher(ctx: better_auth0.HookEndpointContext): any;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(ctx: import("better-auth").HookEndpointContext): any;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(ctx: better_auth0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      matcher(ctx: import("better-auth").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         redirect: boolean;
         url: string;
       } | undefined>;
@@ -56,7 +51,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
      * Provided at /.well-known/oauth-authorization-server/[issuer-path]
      * (root if no issuer-path).
      */
-    getOAuthServerConfig: better_call0.StrictEndpoint<"/.well-known/oauth-authorization-server", {
+    getOAuthServerConfig: import("better-call").StrictEndpoint<"/.well-known/oauth-authorization-server", {
       method: "GET";
       metadata: {
         SERVER_ONLY: true;
@@ -69,15 +64,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
      * Provided at [issuer-path]/.well-known/openid-configuration
      * (root if no issuer-path).
      */
-    getOpenIdConfig: better_call0.StrictEndpoint<"/.well-known/openid-configuration", {
+    getOpenIdConfig: import("better-call").StrictEndpoint<"/.well-known/openid-configuration", {
       method: "GET";
       metadata: {
         SERVER_ONLY: true;
       };
     }, Omit<OIDCMetadata, "id_token_signing_alg_values_supported"> & {
-      id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
+      id_token_signing_alg_values_supported: import("better-auth/plugins").JWSAlgorithms[] | ["HS256"];
     }>;
-    oauth2Authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
+    oauth2Authorize: import("better-call").StrictEndpoint<"/oauth2/authorize", {
       method: "GET";
       query: z.ZodObject<{
         response_type: z.ZodOptional<z.ZodEnum<{
@@ -176,14 +171,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     }>;
-    oauth2Consent: better_call0.StrictEndpoint<"/oauth2/consent", {
+    oauth2Consent: import("better-call").StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       body: z.ZodObject<{
         accept: z.ZodBoolean;
         scope: z.ZodOptional<z.ZodString>;
         oauth_query: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -238,7 +233,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     }>;
-    oauth2Continue: better_call0.StrictEndpoint<"/oauth2/continue", {
+    oauth2Continue: import("better-call").StrictEndpoint<"/oauth2/continue", {
       method: "POST";
       body: z.ZodObject<{
         selected: z.ZodOptional<z.ZodBoolean>;
@@ -246,7 +241,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         postLogin: z.ZodOptional<z.ZodBoolean>;
         oauth_query: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -298,7 +293,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     }>;
-    oauth2Token: better_call0.StrictEndpoint<"/oauth2/token", {
+    oauth2Token: import("better-call").StrictEndpoint<"/oauth2/token", {
       method: "POST";
       body: z.ZodObject<{
         grant_type: z.ZodEnum<{
@@ -443,7 +438,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       scope: string;
       id_token: string | undefined;
     }>;
-    oauth2Introspect: better_call0.StrictEndpoint<"/oauth2/introspect", {
+    oauth2Introspect: import("better-call").StrictEndpoint<"/oauth2/introspect", {
       method: "POST";
       body: z.ZodObject<{
         client_id: z.ZodOptional<z.ZodString>;
@@ -579,8 +574,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, jose.JWTPayload>;
-    oauth2Revoke: better_call0.StrictEndpoint<"/oauth2/revoke", {
+    }, import("jose").JWTPayload>;
+    oauth2Revoke: import("better-call").StrictEndpoint<"/oauth2/revoke", {
       method: "POST";
       body: z.ZodObject<{
         client_id: z.ZodOptional<z.ZodString>;
@@ -663,7 +658,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, null | undefined>;
-    oauth2UserInfo: better_call0.StrictEndpoint<"/oauth2/userinfo", {
+    oauth2UserInfo: import("better-call").StrictEndpoint<"/oauth2/userinfo", {
       method: ("GET" | "POST")[];
       metadata: {
         openapi: {
@@ -784,7 +779,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       family_name?: string | undefined;
       sub: string;
     }>;
-    oauth2EndSession: better_call0.StrictEndpoint<"/oauth2/end-session", {
+    oauth2EndSession: import("better-call").StrictEndpoint<"/oauth2/end-session", {
       method: "GET";
       query: z.ZodObject<{
         id_token_hint: z.ZodString;
@@ -824,7 +819,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     } | undefined>;
-    registerOAuthClient: better_call0.StrictEndpoint<"/oauth2/register", {
+    registerOAuthClient: import("better-call").StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodURL>;
@@ -872,7 +867,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
               content: {
                 "application/json": {
                   schema: {
-                    /** @returns {OauthClient} */type: "object";
+                    /** @returns {OauthClient} */
+                    type: "object";
                     properties: {
                       client_id: {
                         type: string;
@@ -997,7 +993,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    adminCreateOAuthClient: better_call0.StrictEndpoint<"/admin/oauth2/create-client", {
+    adminCreateOAuthClient: import("better-call").StrictEndpoint<"/admin/oauth2/create-client", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodURL>;
@@ -1178,9 +1174,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    createOAuthClient: better_call0.StrictEndpoint<"/oauth2/create-client", {
+    createOAuthClient: import("better-call").StrictEndpoint<"/oauth2/create-client", {
       method: "POST";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1367,9 +1363,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClient: better_call0.StrictEndpoint<"/oauth2/get-client", {
+    getOAuthClient: import("better-call").StrictEndpoint<"/oauth2/get-client", {
       method: "GET";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1401,9 +1397,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClientPublic: better_call0.StrictEndpoint<"/oauth2/public-client", {
+    getOAuthClientPublic: import("better-call").StrictEndpoint<"/oauth2/public-client", {
       method: "GET";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1435,9 +1431,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClientPublicPrelogin: better_call0.StrictEndpoint<"/oauth2/public-client-prelogin", {
+    getOAuthClientPublicPrelogin: import("better-call").StrictEndpoint<"/oauth2/public-client-prelogin", {
       method: "POST";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
       body: z.ZodObject<{
         client_id: z.ZodString;
         oauth_query: z.ZodOptional<z.ZodString>;
@@ -1448,9 +1444,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClients: better_call0.StrictEndpoint<"/oauth2/get-clients", {
+    getOAuthClients: import("better-call").StrictEndpoint<"/oauth2/get-clients", {
       method: "GET";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1479,7 +1475,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient[] | null>;
-    adminUpdateOAuthClient: better_call0.StrictEndpoint<"/admin/oauth2/update-client", {
+    adminUpdateOAuthClient: import("better-call").StrictEndpoint<"/admin/oauth2/update-client", {
       method: "PATCH";
       body: z.ZodObject<{
         client_id: z.ZodString;
@@ -1522,9 +1518,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    updateOAuthClient: better_call0.StrictEndpoint<"/oauth2/update-client", {
+    updateOAuthClient: import("better-call").StrictEndpoint<"/oauth2/update-client", {
       method: "POST";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1583,9 +1579,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    rotateClientSecret: better_call0.StrictEndpoint<"/oauth2/client/rotate-secret", {
+    rotateClientSecret: import("better-call").StrictEndpoint<"/oauth2/client/rotate-secret", {
       method: "POST";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1617,9 +1613,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    deleteOAuthClient: better_call0.StrictEndpoint<"/oauth2/delete-client", {
+    deleteOAuthClient: import("better-call").StrictEndpoint<"/oauth2/delete-client", {
       method: "POST";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1651,12 +1647,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, void>;
-    getOAuthConsent: better_call0.StrictEndpoint<"/oauth2/get-consent", {
+    getOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/get-consent", {
       method: "GET";
       query: z.ZodObject<{
         id: z.ZodString;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1685,9 +1681,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthConsent<Scope[]>>;
-    getOAuthConsents: better_call0.StrictEndpoint<"/oauth2/get-consents", {
+    getOAuthConsents: import("better-call").StrictEndpoint<"/oauth2/get-consents", {
       method: "GET";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1716,9 +1712,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthConsent<Scope[]>[]>;
-    updateOAuthConsent: better_call0.StrictEndpoint<"/oauth2/update-consent", {
+    updateOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/update-consent", {
       method: "POST";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1753,9 +1749,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthConsent<Scope[]> | null>;
-    deleteOAuthConsent: better_call0.StrictEndpoint<"/oauth2/delete-consent", {
+    deleteOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/delete-consent", {
       method: "POST";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;

package/dist/{utils-DQLdireY.mjs → utils-C7lKElJN.mjs}

@@ -1,4 +1,4 @@
-import { r as canonicalizeOAuthQueryParams } from "./version-DaSfXJQ1.mjs";
+import { r as canonicalizeOAuthQueryParams } from "./version-rl1vdpzB.mjs";
 import { isAPIError } from "better-auth/api";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { APIError as APIError$1 } from "better-call";
@@ -402,12 +402,6 @@ function removePromptFromQuery(query, prompt) {
 	}
 	return nextQuery;
 }
-var PKCERequirementErrors = /* @__PURE__ */ function(PKCERequirementErrors) {
-	PKCERequirementErrors["PUBLIC_CLIENT"] = "pkce is required for public clients";
-	PKCERequirementErrors["OFFLINE_ACCESS_SCOPE"] = "pkce is required when requesting offline_access scope";
-	PKCERequirementErrors["CLIENT_REQUIRE_PKCE"] = "pkce is required for this client";
-	return PKCERequirementErrors;
-}(PKCERequirementErrors || {});
 /**
 * Determines if PKCE is required for a given client and scope.
 *
@@ -423,9 +417,9 @@ var PKCERequirementErrors = /* @__PURE__ */ function(PKCERequirementErrors) {
 * @internal
 */
 function isPKCERequired(client, requestedScopes) {
-	if (client.tokenEndpointAuthMethod === "none" || client.type === "native" || client.type === "user-agent-based" || client.public === true) return PKCERequirementErrors.PUBLIC_CLIENT;
-	if (requestedScopes?.includes("offline_access")) return PKCERequirementErrors.OFFLINE_ACCESS_SCOPE;
-	if (client.requirePKCE ?? true) return PKCERequirementErrors.CLIENT_REQUIRE_PKCE;
+	if (client.tokenEndpointAuthMethod === "none" || client.type === "native" || client.type === "user-agent-based" || client.public === true) return "pkce is required for public clients";
+	if (requestedScopes?.includes("offline_access")) return "pkce is required when requesting offline_access scope";
+	if (client.requirePKCE ?? true) return "pkce is required for this client";
 	return false;
 }
 //#endregion

package/dist/{version-DaSfXJQ1.mjs → version-rl1vdpzB.mjs}

@@ -16,7 +16,7 @@ function canonicalizeOAuthQueryParams(params) {
 }
 function setSignedOAuthQueryParameterNames(params) {
 	params.delete(signedQueryParameterNameParam);
-	const signedParameterNames = [...new Set([...params.keys(), signedQueryParameterNameParam])].sort();
+	const signedParameterNames = [.../* @__PURE__ */ new Set([...params.keys(), signedQueryParameterNameParam])].sort();
 	for (const parameterName of signedParameterNames) params.append(signedQueryParameterNameParam, parameterName);
 }
 function getSignedOAuthQueryParameterNames(params) {
@@ -42,6 +42,6 @@ function getSignedQueryIssuedAt(oauthQuery) {
 }
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.22";
+const PACKAGE_VERSION = "1.6.24";
 //#endregion
 export { postLoginClearedParam as a, getSignedQueryIssuedAt as i, buildSignedOAuthQuery as n, setSignedOAuthQueryParameterNames as o, canonicalizeOAuthQueryParams as r, signedQueryIssuedAtParam as s, PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.6.22",
+  "version": "1.6.24",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -63,16 +63,16 @@
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "listhen": "^1.9.0",
-    "tsdown": "0.21.1",
-    "@better-auth/core": "1.6.22",
-    "better-auth": "1.6.22"
+    "tsdown": "0.22.7",
+    "@better-auth/core": "1.6.24",
+    "better-auth": "1.6.24"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.3.7",
-    "@better-auth/core": "^1.6.22",
-    "better-auth": "^1.6.22"
+    "@better-auth/core": "^1.6.24",
+    "better-auth": "^1.6.24"
   },
   "scripts": {
     "build": "tsdown",