@better-auth/oauth-provider 1.7.0-beta.4 → 1.7.0-beta.6

package/dist/{oauth-Vt3lTNHX.d.mts → oauth-CAeemjD7.d.mts}

@@ -1,9 +1,9 @@
-import { a as OAuthClient, c as TokenEndpointAuthMethod, f as OAuthConsent, g as Prompt, i as GrantType, m as OAuthOptions, t as AuthMethod, v as Scope } from "./oauth-q7dn10NU.mjs";
+import { C as OAuthConsent, F as OAuthTokenResponse, L as Prompt, M as OAuthResource, O as OAuthOptions, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, z as Scope } from "./oauth-CaXmZpoL.mjs";
 import * as better_call0 from "better-call";
 import * as z from "zod";
-import * as better_auth_plugins0 from "better-auth/plugins";
 import * as jose from "jose";
-import { GenericEndpointContext } from "@better-auth/core";
+import * as better_auth_plugins0 from "better-auth/plugins";
+import { AuthContext, GenericEndpointContext } from "@better-auth/core";
 import * as better_auth0 from "better-auth";
 
 //#region src/oauth-endpoint.d.ts
@@ -34,9 +34,25 @@ interface OAuthEndpointRedirectContext<Ctx = unknown> {
   error_description: string;
   ctx: Ctx;
 }
-type OAuthRedirectOnError<Ctx = any> = (result: OAuthEndpointRedirectContext<Ctx>) => unknown;
+type OAuthRedirectOnError<Ctx = unknown, Result = unknown> = (result: OAuthEndpointRedirectContext<Ctx>) => Result | Promise<Result>;
+//#endregion
+//#region src/authorize.d.ts
+type OAuthRedirectResult = {
+  redirect: true;
+  url: string;
+};
+/**
+ * Gets the issuer identifier
+ */
+declare function getIssuer(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>): string;
 //#endregion
 //#region src/oauth.d.ts
+/**
+ * Default scopes advertised and accepted when a configuration sets none. Shared
+ * with the MCP preset so the resource metadata it serves matches what the
+ * authorization-server metadata advertises.
+ */
+declare const DEFAULT_OAUTH_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     "oauth-provider": {
@@ -65,7 +81,26 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   } | {
     request: Request;
   } | void>;
-  init: (ctx: better_auth0.AuthContext) => void;
+  init: (ctx: better_auth0.AuthContext) => Promise<{
+    options: {
+      databaseHooks: {
+        session: {
+          delete: {
+            before(session: {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            } & Record<string, unknown>, hookCtx: GenericEndpointContext | null): Promise<void>;
+          };
+        };
+      };
+    };
+  }>;
   hooks: {
     before: {
       matcher(ctx: better_auth0.HookEndpointContext): any;
@@ -73,10 +108,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }[];
     after: {
       matcher(ctx: better_auth0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
-        redirect: boolean;
-        url: string;
-      } | undefined>;
+      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<OAuthRedirectResult | undefined>;
     }[];
   };
   endpoints: {
@@ -92,64 +124,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       metadata: {
         SERVER_ONLY: true;
       };
-    }, {
-      jwks_uri?: string | undefined;
-      userinfo_endpoint: string;
-      acr_values_supported: string[];
-      subject_types_supported: ("public" | "pairwise")[];
-      claims_supported: string[];
-      end_session_endpoint: string;
-      prompt_values_supported: Prompt[];
-      issuer: string;
-      authorization_endpoint: string;
-      token_endpoint: string;
-      registration_endpoint?: string | undefined;
-      scopes_supported?: string[] | undefined;
-      response_types_supported: "code"[];
-      response_modes_supported: "query"[];
-      grant_types_supported: GrantType[];
-      token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-      service_documentation?: string | undefined;
-      ui_locales_supported?: string[] | undefined;
-      op_policy_uri?: string | undefined;
-      op_tos_uri?: string | undefined;
-      revocation_endpoint?: string | undefined;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-      introspection_endpoint?: string | undefined;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-      code_challenge_methods_supported: "S256"[];
-      authorization_response_iss_parameter_supported?: boolean | undefined;
-      client_id_metadata_document_supported?: boolean | undefined;
-      id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
-    } | {
-      issuer: string;
-      authorization_endpoint: string;
-      token_endpoint: string;
-      jwks_uri?: string;
-      registration_endpoint?: string;
-      scopes_supported?: string[];
-      response_types_supported: "code"[];
-      response_modes_supported: "query"[];
-      grant_types_supported: GrantType[];
-      token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
-      service_documentation?: string;
-      ui_locales_supported?: string[];
-      op_policy_uri?: string;
-      op_tos_uri?: string;
-      revocation_endpoint?: string;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[];
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
-      introspection_endpoint?: string;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[];
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
-      code_challenge_methods_supported: "S256"[];
-      authorization_response_iss_parameter_supported?: boolean;
-      client_id_metadata_document_supported?: boolean;
-    }>;
+    }, AuthServerMetadata>;
     /**
      * A server-only endpoint that helps provide the
      * OpenId configuration at the well-known endpoint.
@@ -185,14 +160,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       op_policy_uri?: string | undefined;
       op_tos_uri?: string | undefined;
       revocation_endpoint?: string | undefined;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
+      revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
       revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       introspection_endpoint?: string | undefined;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
+      introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
       introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean | undefined;
       client_id_metadata_document_supported?: boolean | undefined;
+      backchannel_logout_supported?: boolean | undefined;
+      backchannel_logout_session_supported?: boolean | undefined;
+      dpop_signing_alg_values_supported?: better_auth_plugins0.JWSAlgorithms[] | undefined;
       id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
     }>;
     oauth2Authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
@@ -201,28 +179,27 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         response_type: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           code: "code";
         }>>>;
-        client_id: z.ZodString;
+        request_uri: z.ZodOptional<z.ZodString>;
         redirect_uri: z.ZodOptional<z.ZodURL>;
         scope: z.ZodOptional<z.ZodString>;
         state: z.ZodOptional<z.ZodString>;
-        request_uri: z.ZodOptional<z.ZodString>;
+        client_id: z.ZodString;
+        prompt: z.ZodOptional<z.ZodString>;
+        display: z.ZodOptional<z.ZodString>;
+        ui_locales: z.ZodOptional<z.ZodString>;
+        max_age: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+        acr_values: z.ZodOptional<z.ZodString>;
+        login_hint: z.ZodOptional<z.ZodString>;
+        id_token_hint: z.ZodOptional<z.ZodString>;
         code_challenge: z.ZodOptional<z.ZodString>;
         code_challenge_method: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
           S256: "S256";
         }>>>;
         nonce: z.ZodOptional<z.ZodString>;
+        dpop_jkt: z.ZodOptional<z.ZodString>;
         resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        prompt: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodEnum<{
-          none: "none";
-          consent: "consent";
-          login: "login";
-          create: "create";
-          select_account: "select_account";
-          "login consent": "login consent";
-          "select_account consent": "select_account consent";
-        }>>>;
-      }, z.core.$strip>;
-      redirectOnError: OAuthRedirectOnError<GenericEndpointContext>;
+      }, z.core.$loose>;
+      redirectOnError: OAuthRedirectOnError<GenericEndpointContext, OAuthRedirectResult>;
       errorCodesByField: {
         response_type: {
           invalid: "unsupported_response_type";
@@ -241,6 +218,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              minimum?: undefined;
               items?: undefined;
             };
             description: string;
@@ -251,6 +229,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format?: undefined;
+              minimum?: undefined;
               items?: undefined;
             };
             description: string;
@@ -261,6 +240,18 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
             schema: {
               type: "string";
               format: string;
+              minimum?: undefined;
+              items?: undefined;
+            };
+            description: string;
+          } | {
+            name: string;
+            in: "query";
+            required: false;
+            schema: {
+              type: "integer";
+              minimum: number;
+              format?: undefined;
               items?: undefined;
             };
             description: string;
@@ -274,6 +265,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                 type: "string";
               };
               format?: undefined;
+              minimum?: undefined;
             };
             description: string;
           })[];
@@ -315,10 +307,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    }>;
+    }, OAuthRedirectResult>;
     oauth2Consent: better_call0.StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       body: z.ZodObject<{
@@ -374,7 +363,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
+    }, OAuthRedirectResult | {
       redirect: boolean;
       url: string;
     }>;
@@ -434,18 +423,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    }>;
+    }, OAuthRedirectResult>;
     oauth2Token: better_call0.StrictEndpoint<"/oauth2/token", {
       method: "POST";
+      cloneRequest: true;
       body: z.ZodObject<{
-        grant_type: z.ZodPipe<z.ZodString, z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>;
+        grant_type: z.ZodString;
         client_id: z.ZodOptional<z.ZodString>;
         client_secret: z.ZodOptional<z.ZodString>;
         client_assertion: z.ZodOptional<z.ZodString>;
@@ -456,7 +439,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         refresh_token: z.ZodOptional<z.ZodString>;
         resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         scope: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
+      }, z.core.$loose>;
       errorCodesByField: {
         grant_type: {
           missing: "invalid_request";
@@ -467,9 +450,19 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
       metadata: {
+        noStore: boolean;
         allowedMediaTypes: string[];
         openapi: {
           description: string;
+          parameters: {
+            name: string;
+            in: "header";
+            required: false;
+            schema: {
+              type: "string";
+            };
+            description: string;
+          }[];
           requestBody: {
             required: boolean;
             content: {
@@ -479,7 +472,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                   properties: {
                     grant_type: {
                       type: string;
-                      enum: string[];
                       description: string;
                     };
                     client_id: {
@@ -595,15 +587,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      access_token: string;
-      expires_in: number;
-      expires_at: number;
-      token_type: "Bearer";
-      refresh_token: string | undefined;
-      scope: string;
-      id_token: string | undefined;
-    }>;
+    }, OAuthTokenResponse>;
     oauth2Introspect: better_call0.StrictEndpoint<"/oauth2/introspect", {
       method: "POST";
       body: z.ZodObject<{
@@ -615,6 +599,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         token_type_hint: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         allowedMediaTypes: string[];
         openapi: {
           description: string;
@@ -817,8 +802,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       };
     }, null | undefined>;
     oauth2UserInfo: better_call0.StrictEndpoint<"/oauth2/userinfo", {
-      method: "GET";
+      method: ("GET" | "POST")[];
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           security: ({
@@ -929,13 +915,13 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, {
+      sub: string;
       email?: string | undefined;
       email_verified?: boolean | undefined;
       name?: string | undefined;
       picture?: string | undefined;
       given_name?: string | undefined;
       family_name?: string | undefined;
-      sub: string;
     }>;
     oauth2EndSession: better_call0.StrictEndpoint<"/oauth2/end-session", {
       method: "GET";
@@ -973,14 +959,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      redirect: boolean;
-      url: string;
-    } | undefined>;
+    }, OAuthRedirectResult | undefined>;
     registerOAuthClient: better_call0.StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -992,24 +975,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
@@ -1019,19 +995,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           public: "public";
           pairwise: "pairwise";
         }>>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+        resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
         skip_consent: z.ZodOptional<z.ZodNever>;
       }, z.core.$strip>;
       errorCodesByField: {
         redirect_uris: "invalid_redirect_uri";
         post_logout_redirect_uris: "invalid_redirect_uri";
         software_statement: "invalid_software_statement";
+        resources: "invalid_target";
       };
       defaultError: "invalid_client_metadata";
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1117,16 +1097,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                         };
                         description: string;
                       };
+                      backchannel_logout_uri: {
+                        type: string;
+                        format: string;
+                        description: string;
+                      };
+                      backchannel_logout_session_required: {
+                        type: string;
+                        description: string;
+                      };
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1164,7 +1151,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     adminCreateOAuthClient: better_call0.StrictEndpoint<"/admin/oauth2/create-client", {
       method: "POST";
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -1176,24 +1163,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
@@ -1203,6 +1183,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         skip_consent: z.ZodOptional<z.ZodBoolean>;
         enable_end_session: z.ZodOptional<z.ZodBoolean>;
         require_pkce: z.ZodOptional<z.ZodBoolean>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
         subject_type: z.ZodOptional<z.ZodEnum<{
           public: "public";
           pairwise: "pairwise";
@@ -1210,11 +1191,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         SERVER_ONLY: true;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1295,13 +1277,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1373,7 +1353,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       }>)[];
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -1385,35 +1365,30 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         software_version: z.ZodOptional<z.ZodString>;
         software_statement: z.ZodOptional<z.ZodString>;
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+        backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
           "user-agent-based": "user-agent-based";
         }>>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1494,13 +1469,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1670,11 +1643,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-          grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            authorization_code: "authorization_code";
-            client_credentials: "client_credentials";
-            refresh_token: "refresh_token";
-          }>>>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+          grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
           response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             code: "code";
           }>>>;
@@ -1686,6 +1657,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           client_secret_expires_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
           skip_consent: z.ZodOptional<z.ZodBoolean>;
           enable_end_session: z.ZodOptional<z.ZodBoolean>;
+          dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
           metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>;
       }, z.core.$strip>;
@@ -1736,11 +1708,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           software_version: z.ZodOptional<z.ZodString>;
           software_statement: z.ZodOptional<z.ZodString>;
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
-          grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            authorization_code: "authorization_code";
-            client_credentials: "client_credentials";
-            refresh_token: "refresh_token";
-          }>>>;
+          backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+          backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+          grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
           response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             code: "code";
           }>>>;
@@ -1786,6 +1756,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         client_id: z.ZodString;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
         };
@@ -1961,6 +1932,92 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, void>;
+    adminCreateOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources", {
+      method: "POST";
+      body: z.ZodObject<{
+        identifier: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+        name: z.ZodOptional<z.ZodString>;
+        accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+          RS256: "RS256";
+          PS256: "PS256";
+          ES256: "ES256";
+          ES512: "ES512";
+          EdDSA: "EdDSA";
+        }>>>;
+        signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+      }, z.core.$strip>;
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminListOAuthResources: better_call0.StrictEndpoint<"/admin/oauth2/resources", {
+      method: "GET";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource[]>;
+    adminGetOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "GET";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminUpdateOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "PATCH";
+      body: z.ZodObject<{
+        identifier: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+          RS256: "RS256";
+          PS256: "PS256";
+          ES256: "ES256";
+          ES512: "ES512";
+          EdDSA: "EdDSA";
+        }>>>;
+        signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+      }, z.core.$strip>;
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminDeleteOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "DELETE";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      deleted: boolean;
+    }>;
+    adminLinkClientResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+      method: "POST";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      linked: boolean;
+    }>;
+    adminUnlinkClientResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+      method: "DELETE";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      unlinked: boolean;
+    }>;
   };
   schema: {
     oauthClient: {
@@ -2057,6 +2114,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "string[]";
           required: false;
         };
+        backchannelLogoutUri: {
+          type: "string";
+          required: false;
+        };
+        backchannelLogoutSessionRequired: {
+          type: "boolean";
+          required: false;
+        };
         tokenEndpointAuthMethod: {
           type: "string";
           required: false;
@@ -2089,6 +2154,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "boolean";
           required: false;
         };
+        dpopBoundAccessTokens: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
         referenceId: {
           type: "string";
           required: false;
@@ -2099,6 +2169,104 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     };
+    oauthResource: {
+      modelName: string;
+      fields: {
+        identifier: {
+          type: "string";
+          required: true;
+          unique: true;
+        };
+        name: {
+          type: "string";
+          required: true;
+        };
+        accessTokenTtl: {
+          type: "number";
+          required: false;
+        };
+        refreshTokenTtl: {
+          type: "number";
+          required: false;
+        };
+        signingAlgorithm: {
+          type: "string";
+          required: false;
+        };
+        signingKeyId: {
+          type: "string";
+          required: false;
+        };
+        allowedScopes: {
+          type: "string[]";
+          required: false;
+        };
+        customClaims: {
+          type: "json";
+          required: false;
+        };
+        dpopBoundAccessTokensRequired: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
+        disabled: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
+        createdAt: {
+          type: "date";
+          required: false;
+        };
+        updatedAt: {
+          type: "date";
+          required: false;
+        };
+        policyVersion: {
+          type: "number";
+          required: false;
+          defaultValue: number;
+        };
+        metadata: {
+          type: "json";
+          required: false;
+        };
+      };
+    };
+    oauthClientResource: {
+      modelName: string;
+      fields: {
+        clientId: {
+          type: "string";
+          required: true;
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+          index: true;
+        };
+        resourceId: {
+          type: "string";
+          required: true;
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+          index: true;
+        };
+        metadata: {
+          type: "json";
+          required: false;
+        };
+        createdAt: {
+          type: "date";
+          required: false;
+        };
+      };
+    };
     oauthRefreshToken: {
       fields: {
         token: {
@@ -2156,6 +2324,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "date";
           required: false;
         };
+        confirmation: {
+          type: "json";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2220,6 +2392,14 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         createdAt: {
           type: "date";
         };
+        revoked: {
+          type: "date";
+          required: false;
+        };
+        confirmation: {
+          type: "json";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2267,6 +2447,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     };
+    oauthClientAssertion: {
+      modelName: string;
+      fields: {
+        expiresAt: {
+          type: "date";
+          required: true;
+        };
+      };
+    };
   };
   rateLimit: ({
     pathMatcher: (path: string) => path is "/oauth2/token";
@@ -2295,4 +2484,4 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   })[];
 };
 //#endregion
-export { OAuthErrorCode as a, OAuthRedirectOnError as c, OAuthEndpointRedirectContext as i, oauthProvider as n, OAuthFieldErrorCode as o, OAuthEndpointErrorResult as r, OAuthFieldErrorCodeMap as s, getOAuthProviderState as t };
+export { OAuthEndpointErrorResult as a, OAuthFieldErrorCode as c, getIssuer as i, OAuthFieldErrorCodeMap as l, getOAuthProviderState as n, OAuthEndpointRedirectContext as o, oauthProvider as r, OAuthErrorCode as s, DEFAULT_OAUTH_SCOPES as t, OAuthRedirectOnError as u };