@better-auth/oauth-provider 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/{oauth-B_qonG53.d.mts → oauth-BrNRbP2A.d.mts}

@@ -1,11 +1,58 @@
-import { _ as Scope, d as OAuthConsent, h as Prompt, i as OAuthClient, p as OAuthOptions, r as GrantType, s as TokenEndpointAuthMethod, t as AuthMethod } from "./oauth-CU79t-eG.mjs";
+import { C as OAuthConsent, L as Prompt, M as OAuthResource, O as OAuthOptions, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, z as Scope } from "./oauth-ScTJEcFV.mjs";
 import * as better_call0 from "better-call";
 import * as z from "zod";
-import * as better_auth_plugins0 from "better-auth/plugins";
 import * as jose from "jose";
+import * as better_auth_plugins0 from "better-auth/plugins";
+import { AuthContext, GenericEndpointContext } from "@better-auth/core";
 import * as better_auth0 from "better-auth";
 
+//#region src/oauth-endpoint.d.ts
+/**
+ * Canonical OAuth 2.0 / OpenID Connect error codes. The union is the single
+ * vocabulary for every error-emitting surface in this plugin: token, authorize,
+ * revoke, introspect, register, userinfo, logout, consent, and the redirect
+ * error channel. Entries are grouped by source RFC so the declaration doubles
+ * as a specification map.
+ *
+ * The trailing `(string & {})` keeps the type open for product-specific codes
+ * (e.g. `"invalid_verification"`, `"invalid_user"`) while preserving editor
+ * autocomplete for the listed standard codes. Prefer a standard code whenever
+ * one applies; fall back to a custom string only for states no RFC covers.
+ */
+type OAuthErrorCode = "invalid_request" | "invalid_client" | "invalid_grant" | "unauthorized_client" | "unsupported_grant_type" | "unsupported_response_type" | "invalid_scope" | "access_denied" | "server_error" | "temporarily_unavailable" | "invalid_token" | "unsupported_token_type" | "invalid_redirect_uri" | "invalid_client_metadata" | "invalid_software_statement" | "unapproved_software_statement" | "invalid_target" | "invalid_request_object" | "login_required" | "consent_required" | "interaction_required" | "account_selection_required" | "invalid_request_uri" | "request_not_supported" | "request_uri_not_supported" | "registration_not_supported" | (string & {});
+type OAuthFieldErrorCodeMap = {
+  missing?: OAuthErrorCode;
+  invalid?: OAuthErrorCode;
+};
+type OAuthFieldErrorCode = OAuthErrorCode | OAuthFieldErrorCodeMap;
+interface OAuthEndpointErrorResult {
+  error: OAuthErrorCode;
+  error_description: string;
+}
+interface OAuthEndpointRedirectContext<Ctx = unknown> {
+  error: OAuthErrorCode;
+  error_description: string;
+  ctx: Ctx;
+}
+type OAuthRedirectOnError<Ctx = unknown, Result = unknown> = (result: OAuthEndpointRedirectContext<Ctx>) => Result | Promise<Result>;
+//#endregion
+//#region src/authorize.d.ts
+type OAuthRedirectResult = {
+  redirect: true;
+  url: string;
+};
+/**
+ * Gets the issuer identifier
+ */
+declare function getIssuer(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>): string;
+//#endregion
 //#region src/oauth.d.ts
+/**
+ * Default scopes advertised and accepted when a configuration sets none. Shared
+ * with the MCP preset so the resource metadata it serves matches what the
+ * authorization-server metadata advertises.
+ */
+declare const DEFAULT_OAUTH_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     "oauth-provider": {
@@ -15,6 +62,8 @@ declare module "@better-auth/core" {
 }
 declare const getOAuthProviderState: () => Promise<{
   query?: string;
+  signedQueryIssuedAt?: Date;
+  postLoginClearedForSession?: string;
 } | null>;
 /**
  * oAuth 2.1 provider plugin for Better Auth.
@@ -27,7 +76,31 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   id: "oauth-provider";
   version: string;
   options: NoInfer<O>;
-  init: (ctx: better_auth0.AuthContext) => void;
+  onRequest: (request: Request, ctx: better_auth0.AuthContext) => Promise<{
+    response: Response;
+  } | {
+    request: Request;
+  } | void>;
+  init: (ctx: better_auth0.AuthContext) => Promise<{
+    options: {
+      databaseHooks: {
+        session: {
+          delete: {
+            before(session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, unknown>, hookCtx: GenericEndpointContext | null): Promise<void>;
+          };
+        };
+      };
+    };
+  }>;
   hooks: {
     before: {
       matcher(ctx: better_auth0.HookEndpointContext): any;
@@ -35,10 +108,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }[];
     after: {
       matcher(ctx: better_auth0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-        redirect: boolean;
-        url: string;
-      } | undefined>;
+      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<OAuthRedirectResult | undefined>;
     }[];
   };
   endpoints: {
@@ -54,64 +124,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       metadata: {
         SERVER_ONLY: true;
       };
-    }, {
-      jwks_uri?: string | undefined;
-      userinfo_endpoint: string;
-      acr_values_supported: string[];
-      subject_types_supported: ("public" | "pairwise")[];
-      claims_supported: string[];
-      end_session_endpoint: string;
-      prompt_values_supported: Prompt[];
-      issuer: string;
-      authorization_endpoint: string;
-      token_endpoint: string;
-      registration_endpoint: string;
-      scopes_supported?: string[] | undefined;
-      response_types_supported: "code"[];
-      response_modes_supported: "query"[];
-      grant_types_supported: GrantType[];
-      token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
-      service_documentation?: string | undefined;
-      ui_locales_supported?: string[] | undefined;
-      op_policy_uri?: string | undefined;
-      op_tos_uri?: string | undefined;
-      revocation_endpoint?: string | undefined;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
-      introspection_endpoint?: string | undefined;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
-      code_challenge_methods_supported: "S256"[];
-      authorization_response_iss_parameter_supported?: boolean | undefined;
-      client_id_metadata_document_supported?: boolean | undefined;
-      id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
-    } | {
-      issuer: string;
-      authorization_endpoint: string;
-      token_endpoint: string;
-      jwks_uri?: string;
-      registration_endpoint: string;
-      scopes_supported?: string[];
-      response_types_supported: "code"[];
-      response_modes_supported: "query"[];
-      grant_types_supported: GrantType[];
-      token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
-      service_documentation?: string;
-      ui_locales_supported?: string[];
-      op_policy_uri?: string;
-      op_tos_uri?: string;
-      revocation_endpoint?: string;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[];
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
-      introspection_endpoint?: string;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[];
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[];
-      code_challenge_methods_supported: "S256"[];
-      authorization_response_iss_parameter_supported?: boolean;
-      client_id_metadata_document_supported?: boolean;
-    }>;
+    }, AuthServerMetadata>;
     /**
      * A server-only endpoint that helps provide the
      * OpenId configuration at the well-known endpoint.
@@ -127,63 +140,48 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }, {
       jwks_uri?: string | undefined;
       userinfo_endpoint: string;
-      acr_values_supported: string[];
+      acr_values_supported?: string[] | undefined;
       subject_types_supported: ("public" | "pairwise")[];
       claims_supported: string[];
+      claims_parameter_supported?: boolean | undefined;
       end_session_endpoint: string;
+      request_parameter_supported?: boolean | undefined;
+      request_uri_parameter_supported?: boolean | undefined;
       prompt_values_supported: Prompt[];
       issuer: string;
       authorization_endpoint: string;
       token_endpoint: string;
-      registration_endpoint: string;
+      registration_endpoint?: string | undefined;
       scopes_supported?: string[] | undefined;
       response_types_supported: "code"[];
       response_modes_supported: "query"[];
       grant_types_supported: GrantType[];
       token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       service_documentation?: string | undefined;
       ui_locales_supported?: string[] | undefined;
       op_policy_uri?: string | undefined;
       op_tos_uri?: string | undefined;
       revocation_endpoint?: string | undefined;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       introspection_endpoint?: string | undefined;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.AssertionSigningAlgorithm[] | undefined;
+      introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
+      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean | undefined;
       client_id_metadata_document_supported?: boolean | undefined;
+      backchannel_logout_supported?: boolean | undefined;
+      backchannel_logout_session_supported?: boolean | undefined;
+      dpop_signing_alg_values_supported?: better_auth_plugins0.JWSAlgorithms[] | undefined;
       id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
     }>;
     oauth2Authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
-      method: "GET";
-      query: z.ZodObject<{
-        response_type: z.ZodOptional<z.ZodEnum<{
-          code: "code";
-        }>>;
-        client_id: z.ZodString;
-        redirect_uri: z.ZodOptional<z.ZodURL>;
-        scope: z.ZodOptional<z.ZodString>;
-        state: z.ZodOptional<z.ZodString>;
-        request_uri: z.ZodOptional<z.ZodString>;
-        code_challenge: z.ZodOptional<z.ZodString>;
-        code_challenge_method: z.ZodOptional<z.ZodEnum<{
-          S256: "S256";
-        }>>;
-        nonce: z.ZodOptional<z.ZodString>;
-        prompt: z.ZodOptional<z.ZodEnum<{
-          none: "none";
-          consent: "consent";
-          login: "login";
-          create: "create";
-          select_account: "select_account";
-          "login consent": "login consent";
-          "select_account consent": "select_account consent";
-        }>>;
-      }, z.core.$strip>;
+      method: ("GET" | "POST")[];
+      body: z.ZodObject<{}, z.core.$loose>;
+      redirectOnError: OAuthRedirectOnError<GenericEndpointContext, OAuthRedirectResult>;
       metadata: {
+        allowedMediaTypes: string[];
         openapi: {
           description: string;
           parameters: ({
@@ -193,6 +191,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              minimum?: undefined;
+              items?: undefined;
             };
             description: string;
           } | {
@@ -202,6 +202,8 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              minimum?: undefined;
+              items?: undefined;
             };
             description: string;
           } | {
@@ -211,6 +213,32 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format: string;
+              minimum?: undefined;
+              items?: undefined;
+            };
+            description: string;
+          } | {
+            name: string;
+            in: "query";
+            required: false;
+            schema: {
+              type: "integer";
+              minimum: number;
+              format?: undefined;
+              items?: undefined;
+            };
+            description: string;
+          } | {
+            name: string;
+            in: "query";
+            required: false;
+            schema: {
+              type: "array";
+              items: {
+                type: "string";
+              };
+              format?: undefined;
+              minimum?: undefined;
             };
             description: string;
           })[];
@@ -252,15 +280,13 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    }>;
+    }, OAuthRedirectResult>;
     oauth2Consent: better_call0.StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       body: z.ZodObject<{
         accept: z.ZodBoolean;
         scope: z.ZodOptional<z.ZodString>;
+        claims: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
         oauth_query: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
@@ -311,7 +337,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
+    }, OAuthRedirectResult | {
       redirect: boolean;
       url: string;
     }>;
@@ -371,18 +397,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    }>;
+    }, OAuthRedirectResult>;
     oauth2Token: better_call0.StrictEndpoint<"/oauth2/token", {
       method: "POST";
+      cloneRequest: true;
       body: z.ZodObject<{
-        grant_type: z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>;
+        grant_type: z.ZodString;
         client_id: z.ZodOptional<z.ZodString>;
         client_secret: z.ZodOptional<z.ZodString>;
         client_assertion: z.ZodOptional<z.ZodString>;
@@ -391,13 +411,32 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         code_verifier: z.ZodOptional<z.ZodString>;
         redirect_uri: z.ZodOptional<z.ZodURL>;
         refresh_token: z.ZodOptional<z.ZodString>;
-        resource: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         scope: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
+      }, z.core.$loose>;
+      errorCodesByField: {
+        grant_type: {
+          missing: "invalid_request";
+          invalid: "unsupported_grant_type";
+        };
+        resource: {
+          invalid: "invalid_target";
+        };
+      };
       metadata: {
+        noStore: boolean;
         allowedMediaTypes: string[];
         openapi: {
           description: string;
+          parameters: {
+            name: string;
+            in: "header";
+            required: false;
+            schema: {
+              type: "string";
+            };
+            description: string;
+          }[];
           requestBody: {
             required: boolean;
             content: {
@@ -407,7 +446,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                   properties: {
                     grant_type: {
                       type: string;
-                      enum: string[];
                       description: string;
                     };
                     client_id: {
@@ -436,7 +474,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       description: string;
                     };
                     resource: {
-                      type: string;
+                      oneOf: ({
+                        type: string;
+                        description: string;
+                        items?: undefined;
+                      } | {
+                        type: string;
+                        items: {
+                          type: string;
+                        };
+                        description: string;
+                      })[];
                       description: string;
                     };
                     scope: {
@@ -514,10 +562,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, {
-      access_token: string;
       expires_in: number;
+      access_token: string;
       expires_at: number;
-      token_type: "Bearer";
+      token_type: TokenType;
       refresh_token: string | undefined;
       scope: string;
       id_token: string | undefined;
@@ -530,12 +578,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         client_assertion: z.ZodOptional<z.ZodString>;
         client_assertion_type: z.ZodOptional<z.ZodString>;
         token: z.ZodString;
-        token_type_hint: z.ZodOptional<z.ZodEnum<{
-          refresh_token: "refresh_token";
-          access_token: "access_token";
-        }>>;
+        token_type_hint: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         allowedMediaTypes: string[];
         openapi: {
           description: string;
@@ -559,11 +605,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       description: string;
                     };
                     token_type_hint: {
-                      type: string;
-                      enum: string[];
-                      description: string;
-                    };
-                    resource: {
                       type: string;
                       description: string;
                     };
@@ -669,10 +710,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         client_assertion: z.ZodOptional<z.ZodString>;
         client_assertion_type: z.ZodOptional<z.ZodString>;
         token: z.ZodString;
-        token_type_hint: z.ZodOptional<z.ZodEnum<{
-          refresh_token: "refresh_token";
-          access_token: "access_token";
-        }>>;
+        token_type_hint: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
         allowedMediaTypes: string[];
@@ -699,7 +737,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                     };
                     token_type_hint: {
                       type: string;
-                      enum: string[];
                       description: string;
                     };
                   };
@@ -747,8 +784,13 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       };
     }, null | undefined>;
     oauth2UserInfo: better_call0.StrictEndpoint<"/oauth2/userinfo", {
-      method: "GET";
+      method: ("GET" | "POST")[];
+      body: z.ZodOptional<z.ZodObject<{
+        access_token: z.ZodOptional<z.ZodString>;
+      }, z.core.$loose>>;
       metadata: {
+        noStore: boolean;
+        allowedMediaTypes: string[];
         openapi: {
           description: string;
           security: ({
@@ -859,13 +901,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, {
-      email?: string | undefined;
-      email_verified?: boolean | undefined;
-      name?: string | undefined;
-      picture?: string | undefined;
-      given_name?: string | undefined;
-      family_name?: string | undefined;
-      sub: string;
+      sub: unknown;
     }>;
     oauth2EndSession: better_call0.StrictEndpoint<"/oauth2/end-session", {
       method: "GET";
@@ -903,14 +939,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    } | undefined>;
+    }, OAuthRedirectResult | undefined>;
     registerOAuthClient: better_call0.StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -922,24 +955,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
@@ -949,13 +975,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           public: "public";
           pairwise: "pairwise";
         }>>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+        resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
         skip_consent: z.ZodOptional<z.ZodNever>;
       }, z.core.$strip>;
+      errorCodesByField: {
+        redirect_uris: "invalid_redirect_uri";
+        post_logout_redirect_uris: "invalid_redirect_uri";
+        software_statement: "invalid_software_statement";
+        resources: "invalid_target";
+      };
+      defaultError: "invalid_client_metadata";
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1041,16 +1077,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                         };
                         description: string;
                       };
+                      backchannel_logout_uri: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      backchannel_logout_session_required: {
+                        type: string;
+                        description: string;
+                      };
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1088,7 +1131,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     adminCreateOAuthClient: better_call0.StrictEndpoint<"/admin/oauth2/create-client", {
       method: "POST";
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -1100,24 +1143,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
@@ -1127,6 +1163,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         skip_consent: z.ZodOptional<z.ZodBoolean>;
         enable_end_session: z.ZodOptional<z.ZodBoolean>;
         require_pkce: z.ZodOptional<z.ZodBoolean>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
         subject_type: z.ZodOptional<z.ZodEnum<{
           public: "public";
           pairwise: "pairwise";
@@ -1134,11 +1171,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         SERVER_ONLY: true;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1219,13 +1257,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1297,7 +1333,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       }>)[];
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -1309,35 +1345,30 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
           "user-agent-based": "user-agent-based";
         }>>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1418,13 +1449,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1594,11 +1623,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-          grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            authorization_code: "authorization_code";
-            client_credentials: "client_credentials";
-            refresh_token: "refresh_token";
-          }>>>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+          grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
           response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             code: "code";
           }>>>;
@@ -1610,6 +1637,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           client_secret_expires_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
           skip_consent: z.ZodOptional<z.ZodBoolean>;
           enable_end_session: z.ZodOptional<z.ZodBoolean>;
+          dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
           metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>;
       }, z.core.$strip>;
@@ -1660,11 +1688,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-          grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            authorization_code: "authorization_code";
-            client_credentials: "client_credentials";
-            refresh_token: "refresh_token";
-          }>>>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+          grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
           response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             code: "code";
           }>>>;
@@ -1710,6 +1736,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         client_id: z.ZodString;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
         };
@@ -1885,6 +1912,92 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, void>;
+    adminCreateOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources", {
+      method: "POST";
+      body: z.ZodObject<{
+        identifier: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+        name: z.ZodOptional<z.ZodString>;
+        accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+          RS256: "RS256";
+          PS256: "PS256";
+          ES256: "ES256";
+          ES512: "ES512";
+          EdDSA: "EdDSA";
+        }>>>;
+        signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+      }, z.core.$strip>;
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminListOAuthResources: better_call0.StrictEndpoint<"/admin/oauth2/resources", {
+      method: "GET";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource[]>;
+    adminGetOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "GET";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminUpdateOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "PATCH";
+      body: z.ZodObject<{
+        identifier: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+          RS256: "RS256";
+          PS256: "PS256";
+          ES256: "ES256";
+          ES512: "ES512";
+          EdDSA: "EdDSA";
+        }>>>;
+        signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+      }, z.core.$strip>;
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminDeleteOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "DELETE";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      deleted: boolean;
+    }>;
+    adminLinkClientResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+      method: "POST";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      linked: boolean;
+    }>;
+    adminUnlinkClientResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+      method: "DELETE";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      unlinked: boolean;
+    }>;
   };
   schema: {
     oauthClient: {
@@ -1927,6 +2040,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         createdAt: {
           type: "date";
@@ -1980,6 +2094,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "string[]";
           required: false;
         };
+        backchannelLogoutUri: {
+          type: "string";
+          required: false;
+        };
+        backchannelLogoutSessionRequired: {
+          type: "boolean";
+          required: false;
+        };
         tokenEndpointAuthMethod: {
           type: "string";
           required: false;
@@ -2012,6 +2134,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "boolean";
           required: false;
         };
+        dpopBoundAccessTokens: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
         referenceId: {
           type: "string";
           required: false;
@@ -2022,11 +2149,110 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     };
+    oauthResource: {
+      modelName: string;
+      fields: {
+        identifier: {
+          type: "string";
+          required: true;
+          unique: true;
+        };
+        name: {
+          type: "string";
+          required: true;
+        };
+        accessTokenTtl: {
+          type: "number";
+          required: false;
+        };
+        refreshTokenTtl: {
+          type: "number";
+          required: false;
+        };
+        signingAlgorithm: {
+          type: "string";
+          required: false;
+        };
+        signingKeyId: {
+          type: "string";
+          required: false;
+        };
+        allowedScopes: {
+          type: "string[]";
+          required: false;
+        };
+        customClaims: {
+          type: "json";
+          required: false;
+        };
+        dpopBoundAccessTokensRequired: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
+        disabled: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
+        createdAt: {
+          type: "date";
+          required: false;
+        };
+        updatedAt: {
+          type: "date";
+          required: false;
+        };
+        policyVersion: {
+          type: "number";
+          required: false;
+          defaultValue: number;
+        };
+        metadata: {
+          type: "json";
+          required: false;
+        };
+      };
+    };
+    oauthClientResource: {
+      modelName: string;
+      fields: {
+        clientId: {
+          type: "string";
+          required: true;
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+          index: true;
+        };
+        resourceId: {
+          type: "string";
+          required: true;
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+          index: true;
+        };
+        metadata: {
+          type: "json";
+          required: false;
+        };
+        createdAt: {
+          type: "date";
+          required: false;
+        };
+      };
+    };
     oauthRefreshToken: {
       fields: {
         token: {
           type: "string";
           required: true;
+          unique: true;
         };
         clientId: {
           type: "string";
@@ -2035,6 +2261,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         sessionId: {
           type: "string";
@@ -2044,6 +2271,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             field: string;
             onDelete: "set null";
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2052,11 +2280,25 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
           required: false;
         };
+        authorizationCodeId: {
+          type: "string";
+          required: false;
+          index: true;
+        };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
+        requestedUserInfoClaims: {
+          type: "string[]";
+          required: false;
+        };
         expiresAt: {
           type: "date";
         };
@@ -2067,10 +2309,26 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "date";
           required: false;
         };
+        rotatedAt: {
+          type: "date";
+          required: false;
+        };
+        rotationReplayResponse: {
+          type: "string";
+          required: false;
+        };
+        rotationReplayExpiresAt: {
+          type: "date";
+          required: false;
+        };
         authTime: {
           type: "date";
           required: false;
         };
+        confirmation: {
+          type: "json";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2091,6 +2349,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         sessionId: {
           type: "string";
@@ -2100,6 +2359,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             field: string;
             onDelete: "set null";
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2108,11 +2368,25 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
           required: false;
         };
+        authorizationCodeId: {
+          type: "string";
+          required: false;
+          index: true;
+        };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
+        requestedUserInfoClaims: {
+          type: "string[]";
+          required: false;
+        };
         refreshId: {
           type: "string";
           required: false;
@@ -2120,6 +2394,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         expiresAt: {
           type: "date";
@@ -2127,6 +2402,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         createdAt: {
           type: "date";
         };
+        revoked: {
+          type: "date";
+          required: false;
+        };
+        confirmation: {
+          type: "json";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2143,6 +2426,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         userId: {
           type: "string";
@@ -2151,11 +2435,20 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             model: string;
             field: string;
           };
+          index: true;
         };
         referenceId: {
           type: "string";
           required: false;
         };
+        resources: {
+          type: "string[]";
+          required: false;
+        };
+        requestedUserInfoClaims: {
+          type: "string[]";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2168,6 +2461,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     };
+    oauthClientAssertion: {
+      modelName: string;
+      fields: {
+        expiresAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
   };
   rateLimit: ({
     pathMatcher: (path: string) => path is "/oauth2/token";
@@ -2196,4 +2498,4 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   })[];
 };
 //#endregion
-export { oauthProvider as n, getOAuthProviderState as t };
+export { OAuthEndpointErrorResult as a, OAuthFieldErrorCode as c, getIssuer as i, OAuthFieldErrorCodeMap as l, getOAuthProviderState as n, OAuthEndpointRedirectContext as o, oauthProvider as r, OAuthErrorCode as s, DEFAULT_OAUTH_SCOPES as t, OAuthRedirectOnError as u };