@better-auth/oauth-provider 1.7.0-beta.5 → 1.7.0-beta.7

package/dist/{oauth-DU6NeviY.d.mts → oauth-CqOygaZd.d.mts}

@@ -1,9 +1,9 @@
-import { a as OAuthClient, c as TokenEndpointAuthMethod, f as OAuthConsent, g as Prompt, i as GrantType, m as OAuthOptions, t as AuthMethod, v as Scope } from "./oauth-BXrYl5x6.mjs";
+import { C as OAuthConsent, F as OAuthTokenResponse, L as Prompt, M as OAuthResource, O as OAuthOptions, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, z as Scope } from "./oauth-CPWY2Few.mjs";
 import * as better_call0 from "better-call";
 import * as z from "zod";
-import * as better_auth_plugins0 from "better-auth/plugins";
 import * as jose from "jose";
-import { GenericEndpointContext } from "@better-auth/core";
+import * as better_auth_plugins0 from "better-auth/plugins";
+import { AuthContext, GenericEndpointContext } from "@better-auth/core";
 import * as better_auth0 from "better-auth";
 
 //#region src/oauth-endpoint.d.ts
@@ -41,8 +41,18 @@ type OAuthRedirectResult = {
   redirect: true;
   url: string;
 };
+/**
+ * Gets the issuer identifier
+ */
+declare function getIssuer(ctx: GenericEndpointContext, opts: OAuthOptions<Scope[]>): string;
 //#endregion
 //#region src/oauth.d.ts
+/**
+ * Default scopes advertised and accepted when a configuration sets none. Shared
+ * with the MCP preset so the resource metadata it serves matches what the
+ * authorization-server metadata advertises.
+ */
+declare const DEFAULT_OAUTH_SCOPES: readonly ["openid", "profile", "email", "offline_access"];
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     "oauth-provider": {
@@ -71,7 +81,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   } | {
     request: Request;
   } | void>;
-  init: (ctx: better_auth0.AuthContext) => {
+  init: (ctx: better_auth0.AuthContext) => Promise<{
     options: {
       databaseHooks: {
         session: {
@@ -90,7 +100,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     };
-  };
+  }>;
   hooks: {
     before: {
       matcher(ctx: better_auth0.HookEndpointContext): any;
@@ -114,68 +124,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       metadata: {
         SERVER_ONLY: true;
       };
-    }, {
-      jwks_uri?: string | undefined;
-      userinfo_endpoint: string;
-      acr_values_supported: string[];
-      subject_types_supported: ("public" | "pairwise")[];
-      claims_supported: string[];
-      end_session_endpoint: string;
-      prompt_values_supported: Prompt[];
-      issuer: string;
-      authorization_endpoint: string;
-      token_endpoint: string;
-      registration_endpoint?: string | undefined;
-      scopes_supported?: string[] | undefined;
-      response_types_supported: "code"[];
-      response_modes_supported: "query"[];
-      grant_types_supported: GrantType[];
-      token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-      service_documentation?: string | undefined;
-      ui_locales_supported?: string[] | undefined;
-      op_policy_uri?: string | undefined;
-      op_tos_uri?: string | undefined;
-      revocation_endpoint?: string | undefined;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-      introspection_endpoint?: string | undefined;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
-      code_challenge_methods_supported: "S256"[];
-      authorization_response_iss_parameter_supported?: boolean | undefined;
-      client_id_metadata_document_supported?: boolean | undefined;
-      backchannel_logout_supported?: boolean | undefined;
-      backchannel_logout_session_supported?: boolean | undefined;
-      id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
-    } | {
-      issuer: string;
-      authorization_endpoint: string;
-      token_endpoint: string;
-      jwks_uri?: string;
-      registration_endpoint?: string;
-      scopes_supported?: string[];
-      response_types_supported: "code"[];
-      response_modes_supported: "query"[];
-      grant_types_supported: GrantType[];
-      token_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[];
-      token_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
-      service_documentation?: string;
-      ui_locales_supported?: string[];
-      op_policy_uri?: string;
-      op_tos_uri?: string;
-      revocation_endpoint?: string;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[];
-      revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
-      introspection_endpoint?: string;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[];
-      introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[];
-      code_challenge_methods_supported: "S256"[];
-      authorization_response_iss_parameter_supported?: boolean;
-      client_id_metadata_document_supported?: boolean;
-      backchannel_logout_supported?: boolean;
-      backchannel_logout_session_supported?: boolean;
-    }>;
+    }, AuthServerMetadata>;
     /**
      * A server-only endpoint that helps provide the
      * OpenId configuration at the well-known endpoint.
@@ -211,16 +160,17 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
       op_policy_uri?: string | undefined;
       op_tos_uri?: string | undefined;
       revocation_endpoint?: string | undefined;
-      revocation_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
+      revocation_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
       revocation_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       introspection_endpoint?: string | undefined;
-      introspection_endpoint_auth_methods_supported?: AuthMethod[] | undefined;
+      introspection_endpoint_auth_methods_supported?: TokenEndpointAuthMethod[] | undefined;
       introspection_endpoint_auth_signing_alg_values_supported?: better_auth0.PrivateKeyJwtSigningAlgorithm[] | undefined;
       code_challenge_methods_supported: "S256"[];
       authorization_response_iss_parameter_supported?: boolean | undefined;
       client_id_metadata_document_supported?: boolean | undefined;
       backchannel_logout_supported?: boolean | undefined;
       backchannel_logout_session_supported?: boolean | undefined;
+      dpop_signing_alg_values_supported?: better_auth_plugins0.JWSAlgorithms[] | undefined;
       id_token_signing_alg_values_supported: better_auth_plugins0.JWSAlgorithms[] | ["HS256"];
     }>;
     oauth2Authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
@@ -246,6 +196,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           S256: "S256";
         }>>>;
         nonce: z.ZodOptional<z.ZodString>;
+        dpop_jkt: z.ZodOptional<z.ZodString>;
         resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
       }, z.core.$loose>;
       redirectOnError: OAuthRedirectOnError<GenericEndpointContext, OAuthRedirectResult>;
@@ -475,12 +426,9 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     }, OAuthRedirectResult>;
     oauth2Token: better_call0.StrictEndpoint<"/oauth2/token", {
       method: "POST";
+      cloneRequest: true;
       body: z.ZodObject<{
-        grant_type: z.ZodPipe<z.ZodString, z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>;
+        grant_type: z.ZodString;
         client_id: z.ZodOptional<z.ZodString>;
         client_secret: z.ZodOptional<z.ZodString>;
         client_assertion: z.ZodOptional<z.ZodString>;
@@ -491,7 +439,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         refresh_token: z.ZodOptional<z.ZodString>;
         resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
         scope: z.ZodOptional<z.ZodString>;
-      }, z.core.$strip>;
+      }, z.core.$loose>;
       errorCodesByField: {
         grant_type: {
           missing: "invalid_request";
@@ -502,9 +450,19 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
       metadata: {
+        noStore: boolean;
         allowedMediaTypes: string[];
         openapi: {
           description: string;
+          parameters: {
+            name: string;
+            in: "header";
+            required: false;
+            schema: {
+              type: "string";
+            };
+            description: string;
+          }[];
           requestBody: {
             required: boolean;
             content: {
@@ -514,7 +472,6 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                   properties: {
                     grant_type: {
                       type: string;
-                      enum: string[];
                       description: string;
                     };
                     client_id: {
@@ -630,15 +587,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           };
         };
       };
-    }, {
-      access_token: string;
-      expires_in: number;
-      expires_at: number;
-      token_type: "Bearer";
-      refresh_token: string | undefined;
-      scope: string;
-      id_token: string | undefined;
-    }>;
+    }, OAuthTokenResponse>;
     oauth2Introspect: better_call0.StrictEndpoint<"/oauth2/introspect", {
       method: "POST";
       body: z.ZodObject<{
@@ -650,6 +599,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         token_type_hint: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         allowedMediaTypes: string[];
         openapi: {
           description: string;
@@ -854,6 +804,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     oauth2UserInfo: better_call0.StrictEndpoint<"/oauth2/userinfo", {
       method: ("GET" | "POST")[];
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           security: ({
@@ -964,13 +915,13 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, {
+      sub: string;
       email?: string | undefined;
       email_verified?: boolean | undefined;
       name?: string | undefined;
       picture?: string | undefined;
       given_name?: string | undefined;
       family_name?: string | undefined;
-      sub: string;
     }>;
     oauth2EndSession: better_call0.StrictEndpoint<"/oauth2/end-session", {
       method: "GET";
@@ -1012,7 +963,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     registerOAuthClient: better_call0.StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -1026,24 +977,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
         backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
@@ -1053,19 +995,23 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           public: "public";
           pairwise: "pairwise";
         }>>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+        resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
         skip_consent: z.ZodOptional<z.ZodNever>;
       }, z.core.$strip>;
       errorCodesByField: {
         redirect_uris: "invalid_redirect_uri";
         post_logout_redirect_uris: "invalid_redirect_uri";
         software_statement: "invalid_software_statement";
+        resources: "invalid_target";
       };
       defaultError: "invalid_client_metadata";
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1163,13 +1109,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1207,7 +1151,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     adminCreateOAuthClient: better_call0.StrictEndpoint<"/admin/oauth2/create-client", {
       method: "POST";
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -1221,24 +1165,15 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
         backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
@@ -1248,6 +1183,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         skip_consent: z.ZodOptional<z.ZodBoolean>;
         enable_end_session: z.ZodOptional<z.ZodBoolean>;
         require_pkce: z.ZodOptional<z.ZodBoolean>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
         subject_type: z.ZodOptional<z.ZodEnum<{
           public: "public";
           pairwise: "pairwise";
@@ -1255,11 +1191,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         SERVER_ONLY: true;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1340,13 +1277,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1418,7 +1353,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       }>)[];
       body: z.ZodObject<{
-        redirect_uris: z.ZodArray<z.ZodURL>;
+        redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         scope: z.ZodOptional<z.ZodString>;
         client_name: z.ZodOptional<z.ZodString>;
         client_uri: z.ZodOptional<z.ZodString>;
@@ -1432,35 +1367,28 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
         backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
         backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
-        token_endpoint_auth_method: z.ZodOptional<z.ZodDefault<z.ZodEnum<{
-          none: "none";
-          client_secret_basic: "client_secret_basic";
-          client_secret_post: "client_secret_post";
-          private_key_jwt: "private_key_jwt";
-        }>>>;
+        token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
         jwks: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>, z.ZodObject<{
           keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>]>>;
         jwks_uri: z.ZodOptional<z.ZodString>;
-        grant_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-          authorization_code: "authorization_code";
-          client_credentials: "client_credentials";
-          refresh_token: "refresh_token";
-        }>>>>;
-        response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
-        }>>>>;
+        }>>>;
         type: z.ZodOptional<z.ZodEnum<{
           web: "web";
           native: "native";
           "user-agent-based": "user-agent-based";
         }>>;
+        dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
           responses: {
-            "200": {
+            "201": {
               description: string;
               content: {
                 "application/json": {
@@ -1541,13 +1469,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                       token_endpoint_auth_method: {
                         type: string;
                         description: string;
-                        enum: string[];
                       };
                       grant_types: {
                         type: string;
                         items: {
                           type: string;
-                          enum: string[];
                         };
                         description: string;
                       };
@@ -1719,11 +1645,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
           backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
           backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
-          grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            authorization_code: "authorization_code";
-            client_credentials: "client_credentials";
-            refresh_token: "refresh_token";
-          }>>>;
+          grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
           response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             code: "code";
           }>>>;
@@ -1735,6 +1657,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           client_secret_expires_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
           skip_consent: z.ZodOptional<z.ZodBoolean>;
           enable_end_session: z.ZodOptional<z.ZodBoolean>;
+          dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
           metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>;
       }, z.core.$strip>;
@@ -1787,11 +1710,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
           backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
           backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
-          grant_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            authorization_code: "authorization_code";
-            client_credentials: "client_credentials";
-            refresh_token: "refresh_token";
-          }>>>;
+          grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
           response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             code: "code";
           }>>>;
@@ -1837,6 +1756,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         client_id: z.ZodString;
       }, z.core.$strip>;
       metadata: {
+        noStore: boolean;
         openapi: {
           description: string;
         };
@@ -2012,6 +1932,92 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, void>;
+    adminCreateOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources", {
+      method: "POST";
+      body: z.ZodObject<{
+        identifier: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+        name: z.ZodOptional<z.ZodString>;
+        accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+          RS256: "RS256";
+          PS256: "PS256";
+          ES256: "ES256";
+          ES512: "ES512";
+          EdDSA: "EdDSA";
+        }>>>;
+        signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+      }, z.core.$strip>;
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminListOAuthResources: better_call0.StrictEndpoint<"/admin/oauth2/resources", {
+      method: "GET";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource[]>;
+    adminGetOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "GET";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminUpdateOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "PATCH";
+      body: z.ZodObject<{
+        identifier: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+          RS256: "RS256";
+          PS256: "PS256";
+          ES256: "ES256";
+          ES512: "ES512";
+          EdDSA: "EdDSA";
+        }>>>;
+        signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+        disabled: z.ZodOptional<z.ZodBoolean>;
+        metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+      }, z.core.$strip>;
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, OAuthResource>;
+    adminDeleteOAuthResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+      method: "DELETE";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      deleted: boolean;
+    }>;
+    adminLinkClientResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+      method: "POST";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      linked: boolean;
+    }>;
+    adminUnlinkClientResource: better_call0.StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+      method: "DELETE";
+      metadata: {
+        SERVER_ONLY: true;
+      };
+    }, {
+      unlinked: boolean;
+    }>;
   };
   schema: {
     oauthClient: {
@@ -2148,6 +2154,11 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "boolean";
           required: false;
         };
+        dpopBoundAccessTokens: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
         referenceId: {
           type: "string";
           required: false;
@@ -2158,6 +2169,104 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     };
+    oauthResource: {
+      modelName: string;
+      fields: {
+        identifier: {
+          type: "string";
+          required: true;
+          unique: true;
+        };
+        name: {
+          type: "string";
+          required: true;
+        };
+        accessTokenTtl: {
+          type: "number";
+          required: false;
+        };
+        refreshTokenTtl: {
+          type: "number";
+          required: false;
+        };
+        signingAlgorithm: {
+          type: "string";
+          required: false;
+        };
+        signingKeyId: {
+          type: "string";
+          required: false;
+        };
+        allowedScopes: {
+          type: "string[]";
+          required: false;
+        };
+        customClaims: {
+          type: "json";
+          required: false;
+        };
+        dpopBoundAccessTokensRequired: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
+        disabled: {
+          type: "boolean";
+          required: false;
+          defaultValue: false;
+        };
+        createdAt: {
+          type: "date";
+          required: false;
+        };
+        updatedAt: {
+          type: "date";
+          required: false;
+        };
+        policyVersion: {
+          type: "number";
+          required: false;
+          defaultValue: number;
+        };
+        metadata: {
+          type: "json";
+          required: false;
+        };
+      };
+    };
+    oauthClientResource: {
+      modelName: string;
+      fields: {
+        clientId: {
+          type: "string";
+          required: true;
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+          index: true;
+        };
+        resourceId: {
+          type: "string";
+          required: true;
+          references: {
+            model: string;
+            field: string;
+            onDelete: "cascade";
+          };
+          index: true;
+        };
+        metadata: {
+          type: "json";
+          required: false;
+        };
+        createdAt: {
+          type: "date";
+          required: false;
+        };
+      };
+    };
     oauthRefreshToken: {
       fields: {
         token: {
@@ -2215,6 +2324,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "date";
           required: false;
         };
+        confirmation: {
+          type: "json";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2283,6 +2396,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           type: "date";
           required: false;
         };
+        confirmation: {
+          type: "json";
+          required: false;
+        };
         scopes: {
           type: "string[]";
           required: true;
@@ -2367,4 +2484,4 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
   })[];
 };
 //#endregion
-export { OAuthErrorCode as a, OAuthRedirectOnError as c, OAuthEndpointRedirectContext as i, oauthProvider as n, OAuthFieldErrorCode as o, OAuthEndpointErrorResult as r, OAuthFieldErrorCodeMap as s, getOAuthProviderState as t };
+export { OAuthEndpointErrorResult as a, OAuthFieldErrorCode as c, getIssuer as i, OAuthFieldErrorCodeMap as l, getOAuthProviderState as n, OAuthEndpointRedirectContext as o, oauthProvider as r, OAuthErrorCode as s, DEFAULT_OAUTH_SCOPES as t, OAuthRedirectOnError as u };