@better-auth/oauth-provider 1.6.26 → 1.6.28

package/dist/client-resource.d.mts

@@ -1,6 +1,7 @@
-import { s as ResourceServerMetadata } from "./oauth-BFBataE_.mjs";
+import { s as ResourceServerMetadata } from "./oauth-D74mBkw6.mjs";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";
+
 //#region src/client-resource.d.ts
 type ResourceClientAuth = {
   options: {
@@ -68,23 +69,20 @@ type VerifyAccessTokenAuthOpts = {
   verifyOptions?: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience">>;
   scopes?: string[];
   jwksUrl?: string;
-  remoteVerify?: VerifyAccessTokenRemote;
-  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type VerifyAccessTokenNoAuthOpts = {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   scopes?: string[];
   jwksUrl: string;
-  remoteVerify?: VerifyAccessTokenRemote;
-  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify?: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 } | {
   verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
   scopes?: string[];
   jwksUrl?: string;
-  remoteVerify: VerifyAccessTokenRemote;
-  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  remoteVerify: VerifyAccessTokenRemote; /** Maps non-url (ie urn, client) resources to resource_metadata */
   resourceMetadataMappings?: Record<string, string>;
 };
 type ProtectedResourceMetadataOutput<T> = T extends undefined ? (overrides: ResourceServerMetadata, opts?: {

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { a as getJwtPlugin, b as handleMcpErrors, o as getOAuthProviderPlugin } from "./utils-DYn-npiB.mjs";
-import { t as PACKAGE_VERSION } from "./version-BZrv-Tx8.mjs";
+import { a as getJwtPlugin, b as handleMcpErrors, o as getOAuthProviderPlugin } from "./utils-BX7pt3Pi.mjs";
+import { t as PACKAGE_VERSION } from "./version-D0csl_Bb.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { APIError } from "better-call";
 import { logger } from "@better-auth/core/env";
@@ -77,7 +77,7 @@ const oauthProviderResourceClient = (auth) => {
 					if (!resource) throw Error("missing required resource");
 					if (oauthProviderOptions?.scopes && opts?.externalScopes && (overrides?.authorization_servers?.length ?? 0) <= 1) throw new BetterAuthError("external scopes should not be provided with one authorization server");
 					if (overrides?.scopes_supported) {
-						const allValidScopes = /* @__PURE__ */ new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
+						const allValidScopes = new Set([...oauthProviderOptions?.scopes ?? [], ...opts?.externalScopes ?? []]);
 						for (const sc of overrides.scopes_supported) {
 							if (sc === "openid") throw new BetterAuthError("Only the Auth Server should utilize the openid scope");
 							if ([

package/dist/client.d.mts

@@ -1,4 +1,6 @@
-import { n as oauthProvider } from "./oauth-dQVivAXR.mjs";
+import { n as oauthProvider } from "./oauth-C5Ss3rSz.mjs";
+import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
+
 //#region src/client.d.ts
 declare const oauthProviderClient: () => {
   id: "oauth-provider-client";
@@ -8,7 +10,7 @@ declare const oauthProviderClient: () => {
     name: string;
     description: string;
     hooks: {
-      onRequest<T extends Record<string, any>>(ctx: import("@better-fetch/fetch").RequestContext<T>): Promise<void>;
+      onRequest<T extends Record<string, any>>(ctx: _$_better_fetch_fetch0.RequestContext<T>): Promise<void>;
     };
   }[];
   $InferServerPlugin: ReturnType<typeof oauthProvider>;

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { n as buildSignedOAuthQuery, t as PACKAGE_VERSION } from "./version-BZrv-Tx8.mjs";
+import { n as buildSignedOAuthQuery, t as PACKAGE_VERSION } from "./version-D0csl_Bb.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 //#region src/client.ts
 const oauthProviderClient = () => {

package/dist/index.d.mts

@@ -1,9 +1,10 @@
-import { _ as Scope, a as OAuthClient, b as Awaitable, c as TokenEndpointAuthMethod, d as OAuthConsent, f as OAuthOpaqueAccessToken, g as SchemaClient, h as Prompt, i as GrantType, l as AuthorizePrompt, m as OAuthRefreshToken, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions, r as BearerMethodsSupported, s as ResourceServerMetadata, t as AuthMethod, u as OAuthAuthorizationQuery, v as StoreTokenType, y as VerificationValue } from "./oauth-BFBataE_.mjs";
-import { n as oauthProvider, t as getOAuthProviderState } from "./oauth-dQVivAXR.mjs";
+import { _ as Scope, a as OAuthClient, b as Awaitable, c as TokenEndpointAuthMethod, d as OAuthConsent, f as OAuthOpaqueAccessToken, g as SchemaClient, h as Prompt, i as GrantType, l as AuthorizePrompt, m as OAuthRefreshToken, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions, r as BearerMethodsSupported, s as ResourceServerMetadata, t as AuthMethod, u as OAuthAuthorizationQuery, v as StoreTokenType, y as VerificationValue } from "./oauth-D74mBkw6.mjs";
+import { n as oauthProvider, t as getOAuthProviderState } from "./oauth-C5Ss3rSz.mjs";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { JWTPayload } from "jose";
 import { GenericEndpointContext } from "@better-auth/core";
+
 //#region src/mcp.d.ts
 /**
  * A request middleware handler that checks and responds with
@@ -11,11 +12,10 @@ import { GenericEndpointContext } from "@better-auth/core";
  *
  * @external
  */
-declare const mcpHandler: (
-/** Resource is the same url as the audience */
+declare const mcpHandler: (/** Resource is the same url as the audience */
+
 verifyOptions: Parameters<typeof verifyAccessToken>[1], handler: (req: Request, jwt: JWTPayload) => Awaitable<Response>, opts?: {
-  /** Maps non-url (ie urn, client) resources to resource_metadata */
-  resourceMetadataMappings: Record<string, string>;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */resourceMetadataMappings: Record<string, string>;
 }) => (req: Request) => Promise<Response>;
 //#endregion
 //#region src/metadata.d.ts
@@ -62,4 +62,4 @@ declare const oauthProviderOpenIdConfigMetadata: <Auth extends {
   headers?: HeadersInit;
 }) => (request: Request) => Promise<Response>;
 //#endregion
-export { type AuthMethod, type AuthServerMetadata, type AuthorizePrompt, type BearerMethodsSupported, type GrantType, type OAuthAuthorizationQuery, type OAuthClient, type OAuthConsent, type OAuthOpaqueAccessToken, type OAuthOptions, type OAuthRefreshToken, type OIDCMetadata, type Prompt, type ResourceServerMetadata, type SchemaClient, type Scope, type StoreTokenType, type TokenEndpointAuthMethod, type VerificationValue, authServerMetadata, getOAuthProviderState, mcpHandler, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };
+export { AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, GrantType, OAuthAuthorizationQuery, OAuthClient, OAuthConsent, OAuthOpaqueAccessToken, OAuthOptions, OAuthRefreshToken, OIDCMetadata, Prompt, ResourceServerMetadata, SchemaClient, Scope, StoreTokenType, TokenEndpointAuthMethod, VerificationValue, authServerMetadata, getOAuthProviderState, mcpHandler, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oidcServerMetadata };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { _ as storeToken, a as getJwtPlugin, c as isPKCERequired, d as parsePrompt, f as removePromptFromQuery, g as storeClientSecret, h as searchParamsToQuery, i as getClient, l as normalizeTimestampValue, m as resolveSubjectIdentifier, n as clientAllowsGrant, p as resolveSessionAuthTime, r as decryptStoredClientSecret, s as getStoredToken, t as basicToClientCredentials, u as parseClientMetadata, v as validateClientCredentials, x as mcpHandler, y as verifyOAuthQueryParams } from "./utils-DYn-npiB.mjs";
-import { a as postLoginClearedParam, i as getSignedQueryIssuedAt, o as setSignedOAuthQueryParameterNames, r as canonicalizeOAuthQueryParams, s as signedQueryIssuedAtParam, t as PACKAGE_VERSION } from "./version-BZrv-Tx8.mjs";
+import { _ as storeToken, a as getJwtPlugin, c as isPKCERequired, d as parsePrompt, f as removePromptFromQuery, g as storeClientSecret, h as searchParamsToQuery, i as getClient, l as normalizeTimestampValue, m as resolveSubjectIdentifier, n as clientAllowsGrant, p as resolveSessionAuthTime, r as decryptStoredClientSecret, s as getStoredToken, t as basicToClientCredentials, u as parseClientMetadata, v as validateClientCredentials, x as mcpHandler, y as verifyOAuthQueryParams } from "./utils-BX7pt3Pi.mjs";
+import { a as postLoginClearedParam, i as getSignedQueryIssuedAt, o as setSignedOAuthQueryParameterNames, r as canonicalizeOAuthQueryParams, s as signedQueryIssuedAtParam, t as PACKAGE_VERSION } from "./version-D0csl_Bb.mjs";
 import { APIError, createAuthEndpoint, createAuthMiddleware, dispatchAuthEndpoint, getOAuthState, getSessionFromCtx, sessionMiddleware } from "better-auth/api";
 import { generateCodeChallenge, getJwks, verifyJwsAccessToken } from "better-auth/oauth2";
 import { APIError as APIError$1 } from "better-call";
@@ -708,7 +708,7 @@ async function handleClientCredentialsGrant(ctx, opts) {
 	let requestedScopes = scope?.split(" ");
 	if (requestedScopes) {
 		const validScopes = new Set(client.scopes ?? opts.scopes);
-		const oidcScopes = /* @__PURE__ */ new Set([
+		const oidcScopes = new Set([
 			"openid",
 			"profile",
 			"email",
@@ -2757,7 +2757,7 @@ const getOAuthProviderState = oAuthState.get;
 const oauthProvider = (options) => {
 	let clientRegistrationAllowedScopes = options.clientRegistrationAllowedScopes;
 	if (options.clientRegistrationDefaultScopes) {
-		const _allowedScopes = clientRegistrationAllowedScopes ? /* @__PURE__ */ new Set([...clientRegistrationAllowedScopes, ...options.clientRegistrationDefaultScopes]) : /* @__PURE__ */ new Set([...options.clientRegistrationDefaultScopes]);
+		const _allowedScopes = clientRegistrationAllowedScopes ? new Set([...clientRegistrationAllowedScopes, ...options.clientRegistrationDefaultScopes]) : new Set([...options.clientRegistrationDefaultScopes]);
 		clientRegistrationAllowedScopes = Array.from(_allowedScopes);
 	}
 	const scopes = new Set((options.scopes ?? [
@@ -2770,7 +2770,7 @@ const oauthProvider = (options) => {
 		for (const sc of clientRegistrationAllowedScopes) if (!scopes.has(sc)) throw new BetterAuthError(`clientRegistrationAllowedScope ${sc} not found in scopes`);
 	}
 	for (const sc of options.advertisedMetadata?.scopes_supported ?? []) if (!scopes?.has(sc)) throw new BetterAuthError(`advertisedMetadata.scopes_supported ${sc} not found in scopes`);
-	const claims = /* @__PURE__ */ new Set([
+	const claims = new Set([
 		"sub",
 		"iss",
 		"aud",
@@ -2822,7 +2822,7 @@ const oauthProvider = (options) => {
 			issuerPath = new URL(ctx.baseURL).pathname.replace(/\/$/, "") || "";
 		}
 		const endpointCtx = { context: ctx };
-		const authServerMetadataPaths = /* @__PURE__ */ new Set([`/.well-known/oauth-authorization-server${issuerPath}`, `${issuerPath}/.well-known/oauth-authorization-server`]);
+		const authServerMetadataPaths = new Set([`/.well-known/oauth-authorization-server${issuerPath}`, `${issuerPath}/.well-known/oauth-authorization-server`]);
 		const openIdConfigPath = `${issuerPath}/.well-known/openid-configuration`;
 		const isAuthServerMetadataRequest = authServerMetadataPaths.has(requestPath);
 		const isOpenIdConfigRequest = opts.scopes?.includes("openid") && requestPath === openIdConfigPath;
@@ -2977,8 +2977,7 @@ const oauthProvider = (options) => {
 			}
 		} }
 	}, async (ctx) => {
-		const settings = ctx.authorizeSettings ?? { isAuthorize: true };
-		return authorizeEndpoint(ctx, opts, settings);
+		return authorizeEndpoint(ctx, opts, ctx.authorizeSettings ?? { isAuthorize: true });
 	});
 	const runOAuth2Authorize = (ctx, settings) => dispatchAuthEndpoint(oauth2AuthorizeEndpoint, {
 		...ctx,

package/dist/{oauth-dQVivAXR.d.mts → oauth-C5Ss3rSz.d.mts}

@@ -1,5 +1,10 @@
-import { _ as Scope, a as OAuthClient, d as OAuthConsent, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions } from "./oauth-BFBataE_.mjs";
+import { _ as Scope, a as OAuthClient, d as OAuthConsent, n as AuthServerMetadata, o as OIDCMetadata, p as OAuthOptions } from "./oauth-D74mBkw6.mjs";
+import * as _$better_call0 from "better-call";
 import * as z from "zod";
+import * as _$better_auth_plugins0 from "better-auth/plugins";
+import * as _$jose from "jose";
+import * as _$better_auth0 from "better-auth";
+
 //#region src/oauth.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -24,23 +29,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   id: "oauth-provider";
   version: string;
   options: NoInfer<O>;
-  init: (ctx: import("better-auth").AuthContext) => void;
-  onRequest: (request: Request, ctx: import("better-auth").AuthContext) => Promise<{
+  init: (ctx: _$better_auth0.AuthContext) => void;
+  onRequest: (request: Request, ctx: _$better_auth0.AuthContext) => Promise<{
     response: Response;
   } | {
     request: Request;
   } | void>;
   hooks: {
     before: {
-      matcher(ctx: import("better-auth").HookEndpointContext): any;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
+      matcher(ctx: _$better_auth0.HookEndpointContext): any;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
     }[];
     after: {
-      matcher(ctx: import("better-auth").HookEndpointContext): boolean;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      matcher(ctx: _$better_auth0.HookEndpointContext): boolean;
+      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         redirect: boolean;
         url: string;
-      } | undefined>;
+      } | undefined>>;
     }[];
   };
   endpoints: {
@@ -51,7 +56,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
      * Provided at /.well-known/oauth-authorization-server/[issuer-path]
      * (root if no issuer-path).
      */
-    getOAuthServerConfig: import("better-call").StrictEndpoint<"/.well-known/oauth-authorization-server", {
+    getOAuthServerConfig: _$better_call0.StrictEndpoint<"/.well-known/oauth-authorization-server", {
       method: "GET";
       metadata: {
         SERVER_ONLY: true;
@@ -64,15 +69,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
      * Provided at [issuer-path]/.well-known/openid-configuration
      * (root if no issuer-path).
      */
-    getOpenIdConfig: import("better-call").StrictEndpoint<"/.well-known/openid-configuration", {
+    getOpenIdConfig: _$better_call0.StrictEndpoint<"/.well-known/openid-configuration", {
       method: "GET";
       metadata: {
         SERVER_ONLY: true;
       };
     }, Omit<OIDCMetadata, "id_token_signing_alg_values_supported"> & {
-      id_token_signing_alg_values_supported: import("better-auth/plugins").JWSAlgorithms[] | ["HS256"];
+      id_token_signing_alg_values_supported: _$better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
     }>;
-    oauth2Authorize: import("better-call").StrictEndpoint<"/oauth2/authorize", {
+    oauth2Authorize: _$better_call0.StrictEndpoint<"/oauth2/authorize", {
       method: "GET";
       query: z.ZodObject<{
         response_type: z.ZodOptional<z.ZodEnum<{
@@ -171,14 +176,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     }>;
-    oauth2Consent: import("better-call").StrictEndpoint<"/oauth2/consent", {
+    oauth2Consent: _$better_call0.StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       body: z.ZodObject<{
         accept: z.ZodBoolean;
         scope: z.ZodOptional<z.ZodString>;
         oauth_query: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -200,7 +205,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       metadata: {
         openapi: {
           description: string;
@@ -233,7 +238,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     }>;
-    oauth2Continue: import("better-call").StrictEndpoint<"/oauth2/continue", {
+    oauth2Continue: _$better_call0.StrictEndpoint<"/oauth2/continue", {
       method: "POST";
       body: z.ZodObject<{
         selected: z.ZodOptional<z.ZodBoolean>;
@@ -241,7 +246,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         postLogin: z.ZodOptional<z.ZodBoolean>;
         oauth_query: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -263,7 +268,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       metadata: {
         openapi: {
           description: string;
@@ -293,7 +298,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     }>;
-    oauth2Token: import("better-call").StrictEndpoint<"/oauth2/token", {
+    oauth2Token: _$better_call0.StrictEndpoint<"/oauth2/token", {
       method: "POST";
       body: z.ZodObject<{
         grant_type: z.ZodEnum<{
@@ -438,7 +443,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       scope: string;
       id_token: string | undefined;
     }>;
-    oauth2Introspect: import("better-call").StrictEndpoint<"/oauth2/introspect", {
+    oauth2Introspect: _$better_call0.StrictEndpoint<"/oauth2/introspect", {
       method: "POST";
       body: z.ZodObject<{
         client_id: z.ZodOptional<z.ZodString>;
@@ -574,8 +579,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, import("jose").JWTPayload>;
-    oauth2Revoke: import("better-call").StrictEndpoint<"/oauth2/revoke", {
+    }, _$jose.JWTPayload>;
+    oauth2Revoke: _$better_call0.StrictEndpoint<"/oauth2/revoke", {
       method: "POST";
       body: z.ZodObject<{
         client_id: z.ZodOptional<z.ZodString>;
@@ -658,7 +663,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, null | undefined>;
-    oauth2UserInfo: import("better-call").StrictEndpoint<"/oauth2/userinfo", {
+    oauth2UserInfo: _$better_call0.StrictEndpoint<"/oauth2/userinfo", {
       method: ("GET" | "POST")[];
       metadata: {
         openapi: {
@@ -779,7 +784,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       family_name?: string | undefined;
       sub: string;
     }>;
-    oauth2EndSession: import("better-call").StrictEndpoint<"/oauth2/end-session", {
+    oauth2EndSession: _$better_call0.StrictEndpoint<"/oauth2/end-session", {
       method: "GET";
       query: z.ZodObject<{
         id_token_hint: z.ZodString;
@@ -819,7 +824,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       redirect: boolean;
       url: string;
     } | undefined>;
-    registerOAuthClient: import("better-call").StrictEndpoint<"/oauth2/register", {
+    registerOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodURL>;
@@ -867,8 +872,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
               content: {
                 "application/json": {
                   schema: {
-                    /** @returns {OauthClient} */
-                    type: "object";
+                    /** @returns {OauthClient} */type: "object";
                     properties: {
                       client_id: {
                         type: string;
@@ -993,7 +997,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    adminCreateOAuthClient: import("better-call").StrictEndpoint<"/admin/oauth2/create-client", {
+    adminCreateOAuthClient: _$better_call0.StrictEndpoint<"/admin/oauth2/create-client", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodURL>;
@@ -1174,9 +1178,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    createOAuthClient: import("better-call").StrictEndpoint<"/oauth2/create-client", {
+    createOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/create-client", {
       method: "POST";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1198,7 +1202,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodURL>;
         scope: z.ZodOptional<z.ZodString>;
@@ -1363,9 +1367,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClient: import("better-call").StrictEndpoint<"/oauth2/get-client", {
+    getOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/get-client", {
       method: "GET";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1387,7 +1391,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       query: z.ZodObject<{
         client_id: z.ZodString;
       }, z.core.$strip>;
@@ -1397,9 +1401,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClientPublic: import("better-call").StrictEndpoint<"/oauth2/public-client", {
+    getOAuthClientPublic: _$better_call0.StrictEndpoint<"/oauth2/public-client", {
       method: "GET";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1421,7 +1425,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       query: z.ZodObject<{
         client_id: z.ZodString;
       }, z.core.$strip>;
@@ -1431,9 +1435,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClientPublicPrelogin: import("better-call").StrictEndpoint<"/oauth2/public-client-prelogin", {
+    getOAuthClientPublicPrelogin: _$better_call0.StrictEndpoint<"/oauth2/public-client-prelogin", {
       method: "POST";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>[];
       body: z.ZodObject<{
         client_id: z.ZodString;
         oauth_query: z.ZodOptional<z.ZodString>;
@@ -1444,9 +1448,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    getOAuthClients: import("better-call").StrictEndpoint<"/oauth2/get-clients", {
+    getOAuthClients: _$better_call0.StrictEndpoint<"/oauth2/get-clients", {
       method: "GET";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1468,14 +1472,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       metadata: {
         openapi: {
           description: string;
         };
       };
     }, OAuthClient[] | null>;
-    adminUpdateOAuthClient: import("better-call").StrictEndpoint<"/admin/oauth2/update-client", {
+    adminUpdateOAuthClient: _$better_call0.StrictEndpoint<"/admin/oauth2/update-client", {
       method: "PATCH";
       body: z.ZodObject<{
         client_id: z.ZodString;
@@ -1518,9 +1522,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    updateOAuthClient: import("better-call").StrictEndpoint<"/oauth2/update-client", {
+    updateOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/update-client", {
       method: "POST";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1542,7 +1546,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       body: z.ZodObject<{
         client_id: z.ZodString;
         update: z.ZodObject<{
@@ -1579,9 +1583,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    rotateClientSecret: import("better-call").StrictEndpoint<"/oauth2/client/rotate-secret", {
+    rotateClientSecret: _$better_call0.StrictEndpoint<"/oauth2/client/rotate-secret", {
       method: "POST";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1603,7 +1607,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       body: z.ZodObject<{
         client_id: z.ZodString;
       }, z.core.$strip>;
@@ -1613,9 +1617,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
-    deleteOAuthClient: import("better-call").StrictEndpoint<"/oauth2/delete-client", {
+    deleteOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/delete-client", {
       method: "POST";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1637,7 +1641,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       body: z.ZodObject<{
         client_id: z.ZodString;
       }, z.core.$strip>;
@@ -1647,12 +1651,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, void>;
-    getOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/get-consent", {
+    getOAuthConsent: _$better_call0.StrictEndpoint<"/oauth2/get-consent", {
       method: "GET";
       query: z.ZodObject<{
         id: z.ZodString;
       }, z.core.$strip>;
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1674,16 +1678,16 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       metadata: {
         openapi: {
           description: string;
         };
       };
     }, OAuthConsent<Scope[]>>;
-    getOAuthConsents: import("better-call").StrictEndpoint<"/oauth2/get-consents", {
+    getOAuthConsents: _$better_call0.StrictEndpoint<"/oauth2/get-consents", {
       method: "GET";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1705,16 +1709,16 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       metadata: {
         openapi: {
           description: string;
         };
       };
     }, OAuthConsent<Scope[]>[]>;
-    updateOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/update-consent", {
+    updateOAuthConsent: _$better_call0.StrictEndpoint<"/oauth2/update-consent", {
       method: "POST";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1736,7 +1740,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       body: z.ZodObject<{
         id: z.ZodString;
         update: z.ZodObject<{
@@ -1749,9 +1753,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthConsent<Scope[]> | null>;
-    deleteOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/delete-consent", {
+    deleteOAuthConsent: _$better_call0.StrictEndpoint<"/oauth2/delete-consent", {
       method: "POST";
-      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -1773,7 +1777,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       body: z.ZodObject<{
         id: z.ZodString;
       }, z.core.$strip>;

package/dist/{oauth-BFBataE_.d.mts → oauth-D74mBkw6.d.mts}

@@ -2,6 +2,7 @@ import { JWSAlgorithms } from "better-auth/plugins";
 import { JWTPayload } from "jose";
 import { InferOptionSchema, Session, User } from "better-auth/types";
 import { GenericEndpointContext, LiteralString } from "@better-auth/core";
+
 //#region src/schema.d.ts
 declare const schema: {
   oauthClient: {
@@ -397,7 +398,7 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @example
    * { "write:payments": "5m", "read:payments": "30m" }
    */
-  scopeExpirations?: { [K in Scopes[number]]?: number | string | Date; };
+  scopeExpirations?: { [K in Scopes[number]]?: number | string | Date };
   /**
    * Allows /oauth2/public-client-prelogin endpoint to be
    * requestable prior to login via a valid oauth_query.
@@ -721,12 +722,10 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @returns Additional claims for userinfo request
    */
   customUserInfoClaims?: (info: {
-    /** The user object */
-    user: User & Record<string, unknown>;
+    /** The user object */user: User & Record<string, unknown>;
     /** The scopes from the access token used
      * in the /userinfo request (matches jwt.scopes) */
-    scopes: Scopes;
-    /** The access token payload used in the /userinfo request */
+    scopes: Scopes; /** The access token payload used in the /userinfo request */
     jwt: JWTPayload;
   }) => Awaitable<Record<string, any>>;
   /**
@@ -740,11 +739,8 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @param info - context that may be useful when creating custom claims
    */
   customIdTokenClaims?: (info: {
-    /** The user object if token is associated to a user. */
-    user: User & Record<string, unknown>;
-    /** Scopes granted for this token */
-    scopes: Scopes;
-    /** oAuthClient metadata */
+    /** The user object if token is associated to a user. */user: User & Record<string, unknown>; /** Scopes granted for this token */
+    scopes: Scopes; /** oAuthClient metadata */
     metadata?: Record<string, any>;
   }) => Awaitable<Record<string, any>>;
   /**
@@ -761,15 +757,10 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @param info - context that may be useful when creating custom claims
    */
   customAccessTokenClaims?: (info: {
-    /** The user object if token is associated to a user. Null if user doesn't exist. Undefined if user not applicable. */
-    user?: (User & Record<string, unknown>) | null;
-    /** reference of the consent/authorization */
-    referenceId?: string;
-    /** Scopes granted for this token */
-    scopes: Scopes;
-    /** The resource requesting. Provided by the token endpoint. */
-    resource?: string;
-    /** oAuthClient metadata */
+    /** The user object if token is associated to a user. Null if user doesn't exist. Undefined if user not applicable. */user?: (User & Record<string, unknown>) | null; /** reference of the consent/authorization */
+    referenceId?: string; /** Scopes granted for this token */
+    scopes: Scopes; /** The resource requesting. Provided by the token endpoint. */
+    resource?: string; /** oAuthClient metadata */
     metadata?: Record<string, any>;
   }) => Awaitable<Record<string, any>>;
   /**
@@ -784,17 +775,14 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @param info - context that may be useful when creating custom fields
    */
   customTokenResponseFields?: (info: {
-    /** The grant type being processed */
-    grantType: GrantType;
+    /** The grant type being processed */grantType: GrantType;
     /**
      * The user, if applicable.
      * Undefined for `client_credentials` (M2M, no user).
      * Always present for `authorization_code` and `refresh_token`.
      */
-    user?: (User & Record<string, unknown>) | null;
-    /** Scopes granted for this token */
-    scopes: Scopes;
-    /** oAuthClient metadata */
+    user?: (User & Record<string, unknown>) | null; /** Scopes granted for this token */
+    scopes: Scopes; /** oAuthClient metadata */
     metadata?: Record<string, any>;
     /**
      * The authorization code verification value.

package/dist/{utils-DYn-npiB.mjs → utils-BX7pt3Pi.mjs}

@@ -1,4 +1,4 @@
-import { r as canonicalizeOAuthQueryParams } from "./version-BZrv-Tx8.mjs";
+import { r as canonicalizeOAuthQueryParams } from "./version-D0csl_Bb.mjs";
 import { isAPIError } from "better-auth/api";
 import { verifyAccessToken } from "better-auth/oauth2";
 import { APIError as APIError$1 } from "better-call";

package/dist/{version-BZrv-Tx8.mjs → version-D0csl_Bb.mjs}

@@ -16,7 +16,7 @@ function canonicalizeOAuthQueryParams(params) {
 }
 function setSignedOAuthQueryParameterNames(params) {
 	params.delete(signedQueryParameterNameParam);
-	const signedParameterNames = [.../* @__PURE__ */ new Set([...params.keys(), signedQueryParameterNameParam])].sort();
+	const signedParameterNames = [...new Set([...params.keys(), signedQueryParameterNameParam])].sort();
 	for (const parameterName of signedParameterNames) params.append(signedQueryParameterNameParam, parameterName);
 }
 function getSignedOAuthQueryParameterNames(params) {
@@ -42,6 +42,6 @@ function getSignedQueryIssuedAt(oauthQuery) {
 }
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.6.26";
+const PACKAGE_VERSION = "1.6.28";
 //#endregion
 export { postLoginClearedParam as a, getSignedQueryIssuedAt as i, buildSignedOAuthQuery as n, setSignedOAuthQueryParameterNames as o, canonicalizeOAuthQueryParams as r, signedQueryIssuedAtParam as s, PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.6.26",
+  "version": "1.6.28",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -63,16 +63,16 @@
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "listhen": "^1.9.0",
-    "tsdown": "0.22.7",
-    "@better-auth/core": "1.6.26",
-    "better-auth": "1.6.26"
+    "tsdown": "0.21.10",
+    "@better-auth/core": "1.6.28",
+    "better-auth": "1.6.28"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
-    "better-call": "1.3.7",
-    "@better-auth/core": "^1.6.26",
-    "better-auth": "^1.6.26"
+    "better-call": "1.4.0",
+    "@better-auth/core": "^1.6.28",
+    "better-auth": "^1.6.28"
   },
   "scripts": {
     "build": "tsdown",