@better-auth/oauth-provider 1.7.7 → 1.7.8

package/dist/{authorize-K1WHCNih.mjs → authorize-C95F-9E1.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as filterClaimsRequestUserInfoClaims, C as resolveResourcePolicy, D as getSupportedClaims, E as STANDARD_CLAIM_NAMES, M as isValidOidcClaimsRequest, O as canSatisfyEssentialAcrRequest, S as logEnforcePerClientResourcesResolution, T as STANDARD_CLAIMS, _ as assertIdentifierValid, a as invalidateRefreshFamily, b as invalidateResourceCache, c as ResourceUriSchema, d as clientJwksSchema, f as clientRegistrationRequestSchema, g as JWS_ALGORITHMS, h as validateClientCredentialsScopes, j as getRequestedUserInfoClaims, k as claimsRequestParameterSchema, l as SafeUrlSchema, m as normalizeClientCredentialsScopes, o as tokenEndpoint, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as authorizationQuerySchema, v as extractRepeatedResourceFromForm, w as seedResources, x as isAudienceClaimAllowed, y as getResource } from "./introspect-CNR06Oy3.mjs";
-import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-D6Hp4Qd_.mjs";
+import { A as claimsRequestParameterSchema, C as clientJwksSchema, D as STANDARD_CLAIM_NAMES, E as STANDARD_CLAIMS, M as getRequestedUserInfoClaims, N as isValidOidcClaimsRequest, O as getSupportedClaims, S as authorizationQuerySchema, _ as logStartupSeedFailure, a as invalidateRefreshFamily, b as ResourceUriSchema, c as normalizeClientCredentialsScopes, d as assertIdentifierValid, f as extractRepeatedResourceFromForm, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, j as filterClaimsRequestUserInfoClaims, k as canSatisfyEssentialAcrRequest, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as tokenEndpoint, p as getResource, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as JWS_ALGORITHMS, v as resolveResourcePolicy, w as clientRegistrationRequestSchema, x as SafeUrlSchema, y as seedResourcesOnce } from "./introspect-H3uoUiuS.mjs";
+import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-CGIZS-Da.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-C2j2jEFL.mjs";
+import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { appendQueryParams } from "@better-auth/core/utils/url";
@@ -16,12 +16,12 @@ import { BetterAuthError } from "@better-auth/core/error";
 import { deleteSessionCookie, parseSetCookieHeader } from "better-auth/cookies";
 import { mergeSchema } from "better-auth/db";
 import { CLIENT_ASSERTION_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
-import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 import { getJwks, stripAccessTokenAuthorizationScheme } from "better-auth/oauth2";
 import { compactVerify, createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+import { isNativePrivateUseRedirectUri } from "@better-auth/core/utils/redirect-uri";
 import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
-import { isReverseDomainPrivateUseRedirectUri } from "@better-auth/core/utils/redirect-uri";
+import { encodeDeterministicId } from "@better-auth/core/db/internal";
 //#region src/consent.ts
 async function consentEndpoint(ctx, opts, authorize) {
 	const oauthRequest = await oAuthState.get();
@@ -1172,7 +1172,7 @@ function stripReservedOAuthClientMetadataExtensions(metadata) {
 * @throws APIError UNAUTHORIZED when there is no session or the hook denies the action.
 * @throws APIError BAD_REQUEST when the request carries no headers.
 */
-async function assertClientPrivileges(ctx, session, opts, action) {
+async function assertClientPrivileges(ctx, session, opts, action, clientId) {
 	if (!session) throw new APIError("UNAUTHORIZED");
 	if (!ctx.headers) throw new APIError("BAD_REQUEST");
 	if (action === "configure-client-credentials-scopes" && !opts.clientPrivileges) throw new APIError("UNAUTHORIZED");
@@ -1180,7 +1180,36 @@ async function assertClientPrivileges(ctx, session, opts, action) {
 		headers: ctx.headers,
 		action,
 		session: session.session,
-		user: session.user
+		user: session.user,
+		clientId
+	})) throw new APIError("UNAUTHORIZED");
+}
+//#endregion
+//#region src/oauthResource/privileges.ts
+/**
+* Authorizes a resource action against the configured `resourcePrivileges`
+* hook. Gates every admin resource endpoint and the resource links selected
+* during managed client registration. Mirrors `assertClientPrivileges`:
+* a missing session → 401; a defined `resourcePrivileges` callback that
+* returns falsy → 401 with the original action context preserved.
+*
+* When `resourcePrivileges` is undefined, the gate degrades to "any
+* authenticated session can manage resources" — same forgiving default
+* as `clientPrivileges`. Operators who care about RBAC must define the
+* callback.
+*
+* @internal
+*/
+async function assertResourcePrivileges(ctx, session, opts, action, resourceId) {
+	if (!session) throw new APIError("UNAUTHORIZED");
+	if (!ctx.headers) throw new APIError("BAD_REQUEST");
+	if (!opts.resourcePrivileges) return;
+	if (!await opts.resourcePrivileges({
+		headers: ctx.headers,
+		action,
+		session: session.session,
+		user: session.user,
+		resourceId
 	})) throw new APIError("UNAUTHORIZED");
 }
 //#endregion
@@ -1426,7 +1455,7 @@ async function consumeClientAssertion(ctx, opts, params) {
 		error: "invalid_client"
 	});
 	const jtiDigest = await createHash("SHA-256").digest(new TextEncoder().encode(`${namespace}:${payload.jti}`));
-	const jtiId = base64Url.encode(new Uint8Array(jtiDigest).slice(0, 24), { padding: false });
+	const jtiId = encodeDeterministicId(new Uint8Array(jtiDigest).slice(0, 24), ctx.context.options);
 	try {
 		await ctx.context.adapter.create({
 			model: "oauthClientAssertion",
@@ -1637,14 +1666,31 @@ function applyOAuthClientRegistrationDefaults(client, defaultApplicationType = "
 		response_types: resolveRegistrationResponseTypes(client, grantTypes)
 	};
 }
-const FORBIDDEN_NATIVE_REDIRECT_SCHEMES = new Set([
-	"file:",
-	"ftp:",
-	"mailto:",
-	"javascript:",
-	"data:",
-	"vbscript:"
-]);
+function isCustomSchemeWithHost(redirectUri) {
+	const url = new URL(redirectUri);
+	return url.protocol !== "http:" && url.protocol !== "https:" && url.host !== "";
+}
+function isNonHttpRedirectUri(redirectUri) {
+	try {
+		const protocol = new URL(redirectUri).protocol;
+		return protocol !== "http:" && protocol !== "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Server-owned default for dynamic registrations that omit `application_type`.
+* `"infer"` classifies as native when any redirect URI uses a non-http(s)
+* scheme, because a web client can never register one. Every URI is then
+* validated against the native rules. A sent `application_type` is never
+* overridden because `applyOAuthClientRegistrationDefaults` only fills the
+* absent field.
+*/
+function resolveDynamicRegistrationDefaultApplicationType(opts, client) {
+	const configured = opts.clientRegistrationDefaultApplicationType ?? "web";
+	if (configured !== "infer") return configured;
+	return (client.redirect_uris ?? []).some(isNonHttpRedirectUri) ? "native" : "web";
+}
 function invalidRedirectUri(description) {
 	throw new APIError("BAD_REQUEST", {
 		error: "invalid_redirect_uri",
@@ -1661,13 +1707,15 @@ function getRawHttpHostname(redirectUri) {
 	}
 	return (hostAndPort.split(":")[0] ?? "").toLowerCase();
 }
-async function resolveClientRegistrationResources(ctx, opts, requestedResources) {
-	const defaultResources = opts.clientRegistrationDefaultResources ?? [];
-	const allowedResources = new Set([...defaultResources, ...opts.clientRegistrationAllowedResources ?? []]);
+function assertDynamicRegistrationResourcesAllowed(opts, requestedResources) {
+	const allowedResources = new Set([...opts.clientRegistrationDefaultResources ?? [], ...opts.clientRegistrationAllowedResources ?? []]);
 	for (const identifier of requestedResources) if (!allowedResources.has(identifier)) throw new APIError("BAD_REQUEST", {
 		error: "invalid_target",
 		error_description: `requested resource ${identifier} is not allowed for client registration`
 	});
+}
+async function resolveClientRegistrationResources(ctx, opts, requestedResources) {
+	const defaultResources = opts.clientRegistrationDefaultResources ?? [];
 	const resources = [...new Set([...defaultResources, ...requestedResources])];
 	for (const identifier of resources) {
 		const row = await getResource(ctx, opts, identifier);
@@ -1708,7 +1756,7 @@ function validateClientRedirectUri(redirectUri, applicationType) {
 		if (!isAllowedNativeHttpLoopback) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);
 		return;
 	}
-	if (FORBIDDEN_NATIVE_REDIRECT_SCHEMES.has(url.protocol) || !isReverseDomainPrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must be well-formed reverse-domain names, omit the naming authority, and must not use a reserved scheme: ${redirectUri}`);
+	if (!isNativePrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${redirectUri}`);
 }
 function assertValidRegistrationJwks(jwks) {
 	const result = validatePublicClientJwks(jwks);
@@ -1754,7 +1802,7 @@ async function registerEndpoint(ctx, opts) {
 }
 async function checkOAuthClient(client, opts, settings) {
 	const isClientMetadataDocument = settings?.registrationSource === "clientMetadataDocument";
-	const clientWithDefaults = applyOAuthClientRegistrationDefaults(client, isClientMetadataDocument ? null : "web");
+	const clientWithDefaults = applyOAuthClientRegistrationDefaults(client, isClientMetadataDocument ? null : settings?.registrationSource === "dynamic" ? resolveDynamicRegistrationDefaultApplicationType(opts, client) : "web");
 	const tokenEndpointAuthMethod = clientWithDefaults.token_endpoint_auth_method ?? "client_secret_basic";
 	if (!new Set(getSupportedAuthMethods(opts, { includeNone: true })).has(tokenEndpointAuthMethod)) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
@@ -1803,6 +1851,10 @@ async function checkOAuthClient(client, opts, settings) {
 			error: "invalid_client_metadata",
 			error_description: "pairwise subject_type requires server pairwiseSecret configuration"
 		});
+		if (clientWithDefaults.subject_type === "pairwise" && clientWithDefaults.redirect_uris?.some(isCustomSchemeWithHost)) throw new APIError("BAD_REQUEST", {
+			error: "invalid_client_metadata",
+			error_description: "pairwise clients cannot use custom-scheme redirect URIs that include a host"
+		});
 		if (clientWithDefaults.subject_type === "pairwise" && clientWithDefaults.redirect_uris && clientWithDefaults.redirect_uris.length > 1) {
 			if (new Set(clientWithDefaults.redirect_uris.map((uri) => new URL(uri).host)).size > 1) throw new APIError("BAD_REQUEST", {
 				error: "invalid_client_metadata",
@@ -1914,10 +1966,11 @@ function isClientRegistrationCollision(error) {
 * boundary.
 */
 async function persistOAuthClientRegistration(ctx, opts, input) {
-	const body = applyOAuthClientRegistrationDefaults(input.registrationSource === "dynamic" && !input.metadata.scope ? {
+	const registrationMetadata = input.registrationSource === "dynamic" && !input.metadata.scope ? {
 		...input.metadata,
 		scope: (opts.clientRegistrationDefaultScopes ?? opts.scopes)?.join(" ")
-	} : input.metadata, input.registrationSource === "clientMetadataDocument" ? null : "web");
+	} : input.metadata;
+	const body = applyOAuthClientRegistrationDefaults(registrationMetadata, input.registrationSource === "clientMetadataDocument" ? null : input.registrationSource === "dynamic" ? resolveDynamicRegistrationDefaultApplicationType(opts, registrationMetadata) : "web");
 	const isPublic = body.token_endpoint_auth_method === "none";
 	const isPrivateKeyJwt = body.token_endpoint_auth_method === "private_key_jwt";
 	const isExtensionAuthMethod = isExtensionTokenEndpointAuthMethod(opts, body.token_endpoint_auth_method);
@@ -1954,7 +2007,9 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
 	schema.clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
 	if (input.registrationSource === "clientMetadataDocument" && body.application_type === void 0) schema.applicationType = null;
-	const resources = await resolveClientRegistrationResources(ctx, opts, input.registrationSource === "dynamic" ? input.requestedResources ?? [] : []);
+	const requestedResources = input.registrationSource === "clientMetadataDocument" ? [] : input.requestedResources ?? [];
+	if (input.registrationSource === "dynamic") assertDynamicRegistrationResourcesAllowed(opts, requestedResources);
+	const resources = await resolveClientRegistrationResources(ctx, opts, requestedResources);
 	const clientModel = opts.schema?.oauthClient?.modelName ?? "oauthClient";
 	const clientResourceModel = opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
 	const existingClient = input.registrationSource === "clientMetadataDocument" ? input.existingClient : void 0;
@@ -2175,12 +2230,15 @@ async function createOAuthClientEndpoint(ctx, opts, settings) {
 	const clientCredentialsScopes = settings?.admin ? normalizeClientCredentialsScopes(rawClientCredentialsScopes ?? []) : [];
 	validateClientCredentialsScopes(clientCredentialsScopes, resolveRegistrationGrantTypes(metadata), metadata.token_endpoint_auth_method, opts);
 	if (clientCredentialsScopes.length > 0) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes");
+	const requestedResources = settings?.admin ? metadata.resources : void 0;
+	for (const identifier of new Set(requestedResources ?? [])) await assertResourcePrivileges(ctx, session, opts, "link", identifier);
 	const registrationInput = {
 		metadata,
 		registrationSource: "managed",
 		userId: referenceId ? void 0 : session.session.userId,
 		referenceId,
-		clientCredentialsScopes
+		clientCredentialsScopes,
+		...requestedResources ? { requestedResources } : {}
 	};
 	const responseBody = settings?.admin ? await createOAuthClientAdministrativeRegistration(ctx, opts, registrationInput) : await createOAuthClientRegistration(ctx, opts, registrationInput);
 	ctx.setStatus(201);
@@ -2280,7 +2338,7 @@ function schemaToOAuth(input) {
 //#region src/oauthClient/endpoints.ts
 async function getClientEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "read");
+	await assertClientPrivileges(ctx, session, opts, "read", ctx.query.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const client = await getClient(ctx, opts, ctx.query.client_id);
 	if (!client) throw new APIError("NOT_FOUND", {
@@ -2357,7 +2415,7 @@ async function getClientsEndpoint(ctx, opts) {
 }
 async function deleteClientEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "delete");
+	await assertClientPrivileges(ctx, session, opts, "delete", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
 	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
@@ -2384,7 +2442,7 @@ async function deleteClientEndpoint(ctx, opts) {
 }
 async function updateClientEndpoint(ctx, opts, settings) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "update");
+	await assertClientPrivileges(ctx, session, opts, "update", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
 	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
@@ -2400,7 +2458,7 @@ async function updateClientEndpoint(ctx, opts, settings) {
 	const ownsClient = client.userId ? client.userId === session.user.id : client.referenceId && opts.clientReference ? client.referenceId === await opts.clientReference(session) : false;
 	const isCrossOwnerScopeConfiguration = !ownsClient && settings?.admin && rawClientCredentialsScopes !== void 0 && Object.keys(updates).length === 0;
 	if (!ownsClient && !isCrossOwnerScopeConfiguration) throw new APIError("UNAUTHORIZED");
-	if (isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes");
+	if (isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes", clientId);
 	if (Object.keys(updates).length === 0 && rawClientCredentialsScopes === void 0) {
 		const res = schemaToOAuth(client);
 		res.client_secret = void 0;
@@ -2415,7 +2473,7 @@ async function updateClientEndpoint(ctx, opts, settings) {
 	const clientCredentialsScopes = rawClientCredentialsScopes === void 0 ? void 0 : normalizeClientCredentialsScopes(rawClientCredentialsScopes);
 	if (clientCredentialsScopes !== void 0) {
 		validateClientCredentialsScopes(clientCredentialsScopes, finalGrantTypes, finalTokenEndpointAuthMethod, opts);
-		if (clientCredentialsScopes.length > 0 && !isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes");
+		if (clientCredentialsScopes.length > 0 && !isCrossOwnerScopeConfiguration) await assertClientPrivileges(ctx, session, opts, "configure-client-credentials-scopes", clientId);
 	}
 	await checkOAuthClient({
 		...schemaToOAuth(client),
@@ -2455,7 +2513,7 @@ async function updateClientEndpoint(ctx, opts, settings) {
 }
 async function rotateClientSecretEndpoint(ctx, opts) {
 	const session = await getSessionFromCtx(ctx);
-	await assertClientPrivileges(ctx, session, opts, "rotate");
+	await assertClientPrivileges(ctx, session, opts, "rotate", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
 	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
@@ -2525,6 +2583,7 @@ const adminCreateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/creat
 		jwks_uri: z.string().optional(),
 		grant_types: grantTypesSchema.optional(),
 		client_credentials_scopes: z.array(z.string().trim().min(1)).optional(),
+		resources: z.array(ResourceUriSchema).optional(),
 		response_types: z.array(z.enum(["code"])).optional(),
 		client_secret_expires_at: z.union([z.string(), z.number()]).optional().default(0),
 		skip_consent: z.boolean().optional(),
@@ -2889,6 +2948,7 @@ const adminUpdateOAuthClient = (opts) => createAuthEndpoint("/admin/oauth2/updat
 			client_secret_expires_at: z.union([z.string(), z.number()]).optional(),
 			skip_consent: z.boolean().optional(),
 			enable_end_session: z.boolean().optional(),
+			disabled: z.boolean().optional(),
 			dpop_bound_access_tokens: z.boolean().optional(),
 			metadata: z.record(z.string(), z.unknown()).optional()
 		})
@@ -3085,30 +3145,6 @@ const deleteOAuthConsent = (opts) => createAuthEndpoint("/oauth2/delete-consent"
 });
 //#endregion
 //#region src/oauthResource/endpoints.ts
-/**
-* Gate every admin resource endpoint. Mirrors `assertClientPrivileges`:
-* a missing session → 401; a defined `resourcePrivileges` callback that
-* returns falsy → 401 with the original action context preserved.
-*
-* When `resourcePrivileges` is undefined, the gate degrades to "any
-* authenticated session can manage resources" — same forgiving default
-* as `clientPrivileges`. Operators who care about RBAC must define the
-* callback.
-*
-* @internal
-*/
-async function assertResourcePrivileges(ctx, session, opts, action, resourceId) {
-	if (!session) throw new APIError("UNAUTHORIZED");
-	if (!ctx.headers) throw new APIError("BAD_REQUEST");
-	if (!opts.resourcePrivileges) return;
-	if (!await opts.resourcePrivileges({
-		headers: ctx.headers,
-		action,
-		session: session.session,
-		user: session.user,
-		resourceId
-	})) throw new APIError("UNAUTHORIZED");
-}
 const resourceModel = (opts) => opts.schema?.oauthResource?.modelName ?? "oauthResource";
 const linkModel = (opts) => opts.schema?.oauthClientResource?.modelName ?? "oauthClientResource";
 const clientModel = (opts) => opts.schema?.oauthClient?.modelName ?? "oauthClient";
@@ -4404,7 +4440,7 @@ const oauthProvider = (options) => {
 		onRequest: handleIssuerMetadataRequest,
 		init: async (ctx) => {
 			if (ctx.options.secondaryStorage && ctx.options.session?.storeSessionInDatabase !== true) throw new BetterAuthError("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");
-			await seedResources(ctx, opts);
+			await seedResourcesOnce(ctx, opts).catch((error) => logStartupSeedFailure(ctx, error));
 			logEnforcePerClientResourcesResolution(opts);
 			if (!opts.disableJwtPlugin) {
 				const jwtPluginOptions = getJwtPlugin(ctx)?.options;

package/dist/client-resource.d.mts

@@ -1,4 +1,4 @@
-import { c as ResourceServerMetadata } from "./oauth-C_7TvkRL.mjs";
+import { c as ResourceServerMetadata } from "./oauth-C_RnL2nt.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-D6Hp4Qd_.mjs";
-import { t as PACKAGE_VERSION } from "./version-C2j2jEFL.mjs";
+import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-CGIZS-Da.mjs";
+import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-Dtt-caL2.mjs";
+import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-pKAoqtlo.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-C2j2jEFL.mjs";
+import { t as PACKAGE_VERSION } from "./version-BPS0os17.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-C_7TvkRL.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-Dtt-caL2.mjs";
+import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-C_RnL2nt.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-pKAoqtlo.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { C as resolveResourcePolicy, c as ResourceUriSchema, i as getOAuthProviderApi, p as oauthClientMetadataSchema, v as extractRepeatedResourceFromForm } from "./introspect-CNR06Oy3.mjs";
-import { D as validateClientScopes, N as extendOAuthProvider, O as verifyOAuthQueryParams, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-D6Hp4Qd_.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-K1WHCNih.mjs";
+import { T as oauthClientMetadataSchema, b as ResourceUriSchema, f as extractRepeatedResourceFromForm, i as getOAuthProviderApi, v as resolveResourcePolicy } from "./introspect-H3uoUiuS.mjs";
+import { D as validateClientScopes, N as extendOAuthProvider, O as verifyOAuthQueryParams, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-CGIZS-Da.mjs";
+import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-C95F-9E1.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-auth/api";
 import * as z from "zod";

package/dist/internal.d.mts

@@ -1,4 +1,4 @@
-import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-C_7TvkRL.mjs";
+import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-C_RnL2nt.mjs";
 import { JSONWebKeySet } from "jose";
 import { GenericEndpointContext } from "@better-auth/core";
 

package/dist/internal.mjs

@@ -1,2 +1,2 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-K1WHCNih.mjs";
+import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-C95F-9E1.mjs";
 export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };

package/dist/{introspect-CNR06Oy3.mjs → introspect-H3uoUiuS.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-D6Hp4Qd_.mjs";
+import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-CGIZS-Da.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
@@ -7,8 +7,8 @@ import { logger } from "@better-auth/core/env";
 import * as z from "zod";
 import { createDpopReplayStore, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, isDpopBindingError, isDpopProofError, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof } from "better-auth/oauth2";
 import { SignJWT, base64url, createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
-import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
 import { SafeUrlSchema } from "@better-auth/core/utils/redirect-uri";
+import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
 //#region src/authentication-context.ts
 const RESERVED_ID_TOKEN_CLAIMS = new Set([
 	"iss",
@@ -265,6 +265,187 @@ async function resolveAccessTokenClaims(input) {
 	});
 }
 //#endregion
+//#region src/types/zod.ts
+const DANGEROUS_SCHEMES = [
+	"javascript:",
+	"data:",
+	"vbscript:"
+];
+/**
+* Validates an RFC 8707 resource indicator. The value must be an absolute URI
+* with no fragment (RFC 8707 §2). Unlike a redirect URI it is not restricted to
+* HTTPS, because a resource server identifier may use any absolute URI scheme;
+* configured OAuth resources are the authoritative control over
+* which resources a token may target.
+*/
+const ResourceUriSchema = z.string().superRefine((val, ctx) => {
+	if (!URL.canParse(val)) {
+		ctx.addIssue({
+			code: "custom",
+			message: "resource must be an absolute URI",
+			fatal: true
+		});
+		return z.NEVER;
+	}
+	if (val.includes("#")) {
+		ctx.addIssue({
+			code: "custom",
+			message: "resource must not contain a fragment"
+		});
+		return;
+	}
+	if (DANGEROUS_SCHEMES.includes(new URL(val).protocol)) ctx.addIssue({
+		code: "custom",
+		message: "resource cannot use javascript:, data:, or vbscript: scheme"
+	});
+});
+const authorizationPromptTokenSchema = z.enum([
+	"none",
+	"consent",
+	"login",
+	"create",
+	"select_account"
+]);
+const authorizationPromptSchema = z.string().superRefine((value, ctx) => {
+	const promptTokens = value.split(" ").map((token) => token.trim()).filter(Boolean);
+	const promptSet = /* @__PURE__ */ new Set();
+	if (!promptTokens.length) {
+		ctx.addIssue({
+			code: "custom",
+			message: "prompt must include at least one value"
+		});
+		return;
+	}
+	for (const token of promptTokens) {
+		const result = authorizationPromptTokenSchema.safeParse(token);
+		if (!result.success) {
+			ctx.addIssue({
+				code: "custom",
+				message: `unsupported prompt value: ${token}`
+			});
+			continue;
+		}
+		promptSet.add(result.data);
+	}
+	if (promptSet.has("none") && promptSet.size > 1) ctx.addIssue({
+		code: "custom",
+		message: "prompt=none cannot be combined with other prompt values"
+	});
+});
+/** Canonical RFC 7517 JWK Set metadata for an OAuth client. */
+const clientJwksSchema = z.object({ keys: z.array(z.record(z.string(), z.unknown())).min(1) });
+const maxAgeSchema = z.union([z.number(), z.string().trim().min(1)]).transform((value, ctx) => {
+	const maxAge = typeof value === "number" ? value : Number(value);
+	if (!Number.isInteger(maxAge) || maxAge < 0) {
+		ctx.addIssue({
+			code: "custom",
+			message: "max_age must be a non-negative integer"
+		});
+		return z.NEVER;
+	}
+	return maxAge;
+});
+const dpopJktSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/, "dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint");
+/**
+* Runtime schema for OAuthAuthorizationQuery.
+* Uses passthrough to tolerate fields added by future extensions (PAR, FPA, etc.)
+*/
+const authorizationQuerySchema = z.object({
+	response_type: z.string().pipe(z.enum(["code"])).optional(),
+	request: z.string().optional(),
+	request_uri: z.string().optional(),
+	redirect_uri: SafeUrlSchema.optional(),
+	scope: z.string().optional(),
+	state: z.string().optional(),
+	client_id: z.string().min(1, "client_id is required"),
+	prompt: authorizationPromptSchema.optional(),
+	display: z.string().optional(),
+	ui_locales: z.string().optional(),
+	max_age: maxAgeSchema.optional(),
+	acr_values: z.string().optional(),
+	login_hint: z.string().optional(),
+	id_token_hint: z.string().optional(),
+	code_challenge: z.string().optional(),
+	code_challenge_method: z.string().pipe(z.enum(["S256"])).optional(),
+	nonce: z.string().optional(),
+	claims: claimsRequestInputSchema.optional(),
+	dpop_jkt: dpopJktSchema.optional(),
+	resource: z.union([ResourceUriSchema, z.array(ResourceUriSchema).min(1)]).optional()
+}).passthrough();
+const storedAuthorizationQuerySchema = authorizationQuerySchema.extend({
+	redirect_uri: SafeUrlSchema.optional(),
+	claims: claimsRequestParameterSchema.optional()
+});
+/**
+* Runtime schema for the authorization code verification value.
+* Validates structure on deserialization from the JSON blob stored in the DB.
+* Uses passthrough so future fields (e.g. from authorization challenge) don't break parsing.
+*/
+const verificationValueSchema = z.object({
+	type: z.literal("authorization_code"),
+	query: storedAuthorizationQuerySchema,
+	sessionId: z.string(),
+	userId: z.string(),
+	referenceId: z.string().optional(),
+	authTime: z.number().optional(),
+	resource: z.array(z.string()).optional()
+}).passthrough();
+/**
+* Request body accepted at `POST /oauth2/register` (RFC 7591 §2 client
+* metadata). This is the single source of truth for the registration contract:
+* the endpoint validates against it and {@link ClientRegistrationRequest} is
+* inferred from it, so the type a `validateInitialAccessToken` callback receives
+* always matches what is actually validated. `grant_types` and
+* `token_endpoint_auth_method` are open strings because extensions can register
+* custom values. Server-assigned fields (`client_id`, `client_secret`, the
+* issued/expiry timestamps) and internal state (`disabled`, `reference_id`) are
+* never part of a registration request.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7591#section-2
+*/
+const clientRegistrationRequestSchema = z.object({
+	redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
+	scope: z.string().optional(),
+	client_name: z.string().refine((value) => value.trim().length > 0, "client_name cannot be empty").optional(),
+	client_uri: z.string().optional(),
+	logo_uri: z.string().optional(),
+	contacts: z.array(z.string().min(1)).min(1).optional(),
+	tos_uri: z.string().optional(),
+	policy_uri: z.string().optional(),
+	software_id: z.string().optional(),
+	software_version: z.string().optional(),
+	software_statement: z.string().optional(),
+	post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
+	backchannel_logout_uri: SafeUrlSchema.optional(),
+	backchannel_logout_session_required: z.boolean().optional(),
+	token_endpoint_auth_method: z.string().trim().min(1).optional(),
+	jwks: clientJwksSchema.optional(),
+	jwks_uri: z.string().optional(),
+	grant_types: z.array(z.string().trim().min(1)).min(1).optional(),
+	response_types: z.array(z.enum(["code"])).optional(),
+	application_type: z.enum(["web", "native"]).optional(),
+	subject_type: z.enum(["public", "pairwise"]).optional(),
+	dpop_bound_access_tokens: z.boolean().optional(),
+	resources: z.array(ResourceUriSchema).optional(),
+	skip_consent: z.never({ error: "skip_consent cannot be set during dynamic client registration" }).optional()
+});
+/**
+* Complete OAuth client metadata document schema shared by registration and
+* verified client-discovery integrations.
+*
+* Unlike {@link clientRegistrationRequestSchema}, a metadata document carries
+* its own identifier and may contain the server-assigned secret fields that a
+* discovery profile must explicitly prohibit. Keeping those fields in the
+* parsed shape lets profile validation distinguish a forbidden value from an
+* unknown extension without unsafe casts or ad-hoc allowlists.
+*/
+const oauthClientMetadataSchema = clientRegistrationRequestSchema.omit({ skip_consent: true }).extend({
+	client_id: z.string().refine((value) => value.trim().length > 0, "client_id cannot be empty"),
+	client_secret: z.string().optional(),
+	client_secret_expires_at: z.number().int().nonnegative().optional(),
+	client_id_issued_at: z.number().int().nonnegative().optional()
+}).loose();
+//#endregion
 //#region src/resources.ts
 /**
 * Source-of-truth list of asymmetric JWS algorithms supported by the JWT
@@ -317,18 +498,10 @@ async function checkIdentifier(opts, identifier) {
 		};
 		return { ok: true };
 	}
-	let url;
-	try {
-		url = new URL(identifier);
-	} catch {
-		return {
-			ok: false,
-			reason: `resource identifier ${identifier} must be an absolute URI (RFC 8707 §2)`
-		};
-	}
-	if (url.hash) return {
+	const parsed = ResourceUriSchema.safeParse(identifier);
+	if (!parsed.success) return {
 		ok: false,
-		reason: `resource identifier ${identifier} must not contain a URI fragment (RFC 8707 §2)`
+		reason: `resource identifier ${identifier} is invalid: ${parsed.error.issues[0]?.message ?? "not an absolute URI"}`
 	};
 	return { ok: true };
 }
@@ -654,10 +827,10 @@ function invalidateResourceCache(identifier) {
 * Looks up an {@link OAuthResource} by `identifier`, consulting the in-process
 * cache when the identifier is in {@link OAuthOptions.cachedResources}.
 *
-* Triggers the lazy seed via {@link seedResourcesOnce} on first call — this
-* is the safety net for deployments where migrations run after plugin init
-* (so seeding at init couldn't see the table yet). The seed is idempotent
-* and coalesced, so the cost is paid only once per process.
+* Triggers the lazy seed via {@link seedResourcesOnce} on first call — the
+* retry path when the startup seed failed (database unreachable, or
+* migrations run after plugin init). The seed is idempotent and coalesced,
+* so the cost is paid only once per process.
 *
 * Returns a defensive copy so callers can't mutate cached state.
 *
@@ -748,29 +921,56 @@ function buildSeedUpdate(input, mode, now) {
 }
 /**
 * Pattern matched against adapter errors to detect the "table not yet
-* created" case — i.e. migrations haven't been run. When matched, the
-* caller treats the seed as deferred (will retry on first resource access).
+* created" case — i.e. migrations or `auth generate` haven't run. Only
+* used to keep the expected startup seed failure quiet.
 *
 * Covers SQLite ("no such table"), Postgres ("relation X does not exist"),
-* and MySQL ("Table X does not exist" / contracted form).
+* MySQL ("Table X does not exist" / contracted form), and the Drizzle and
+* Prisma adapters' missing-model errors.
+*/
+const MISSING_TABLE_PATTERN = /no such table|relation.*does not exist|table.*does(?: not|n'?t) exist|model.*(?:does not exist|was not found in the schema)/i;
+/**
+* Logs a failed startup seed. Missing tables are expected before migrations
+* and stay quiet; anything else is an error worth seeing.
+*
+* @internal
 */
-const MISSING_TABLE_PATTERN = /no such table|relation.*does not exist|table.*does(?: not|n[''']?t) exist/i;
+function logStartupSeedFailure(ctx, error) {
+	let missingTable = false;
+	let current = error;
+	for (let depth = 0; current && !missingTable && depth < 5; depth++) {
+		missingTable = MISSING_TABLE_PATTERN.test(current instanceof Error ? current.message : String(current));
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	if (missingTable) {
+		ctx.logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
+		return;
+	}
+	ctx.logger.error("oauth-provider: could not seed `resources` at startup; retrying on first resource access.", error);
+}
 /**
-* Per-adapter state for the lazy-seed path. A module-level boolean would let
-* one Better Auth instance suppress seeding for every later instance in the same
-* process. Endpoint `AuthContext` objects are not guaranteed to be stable across
-* requests, so keying by the adapter keeps one seed state per backing store.
+* Lazy-seed state per adapter and plugin options. A module-level boolean would
+* let one Better Auth instance suppress seeding for every later instance in the
+* same process. Endpoint `AuthContext` objects are not guaranteed to be stable
+* across requests, so the adapter identifies the backing store, and the options
+* object separates instances that share an adapter but configure different
+* `resources`.
 */
 let seedStates = /* @__PURE__ */ new WeakMap();
-function getSeedState(ctx) {
-	const key = ctx.adapter;
-	const existing = seedStates.get(key);
+function getSeedState(ctx, opts) {
+	const adapterKey = ctx.adapter;
+	let byOptions = seedStates.get(adapterKey);
+	if (!byOptions) {
+		byOptions = /* @__PURE__ */ new WeakMap();
+		seedStates.set(adapterKey, byOptions);
+	}
+	const existing = byOptions.get(opts);
 	if (existing) return existing;
 	const created = {
 		completed: false,
 		promise: null
 	};
-	seedStates.set(key, created);
+	byOptions.set(opts, created);
 	return created;
 }
 /**
@@ -790,13 +990,11 @@ function getSeedState(ctx) {
 *
 * Race-safety: the `identifier` column carries a UNIQUE constraint, so two
 * processes booting simultaneously can each attempt the insert — one wins,
-* the other catches the constraint error and treats it as a no-op.
+* the other re-reads the row and treats the failed insert as a no-op.
 *
-* Migration ordering: at plugin `init` time, tables may not exist yet
-* (Better Auth's test harness, and many deployment setups, run migrations
-* after auth construction). Seeding tolerates "no such table" errors and
-* defers — the lazy {@link seedResourcesOnce} path picks up the work on
-* the first resource access.
+* Throws on storage errors, including a missing table. Callers go through
+* {@link seedResourcesOnce}, which resets so the next resource access
+* retries (e.g. after migrations run).
 *
 * Idempotent: safe to call multiple times.
 *
@@ -819,69 +1017,45 @@ async function seedResources(ctx, opts) {
 			const { signingAlgorithm: _, ...rest } = input;
 			input = rest;
 		}
-		let existing;
-		try {
-			existing = await ctx.adapter.findOne({
+		const where = [{
+			field: "identifier",
+			value: input.identifier
+		}];
+		const existing = await ctx.adapter.findOne({
+			model: modelName,
+			where
+		});
+		const now = /* @__PURE__ */ new Date();
+		if (!existing) try {
+			await ctx.adapter.create({
 				model: modelName,
-				where: [{
-					field: "identifier",
-					value: input.identifier
-				}]
+				data: buildSeedRow(input, now)
 			});
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (MISSING_TABLE_PATTERN.test(message)) {
-				logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
-				return;
-			}
-			throw err;
-		}
-		const now = /* @__PURE__ */ new Date();
-		if (!existing) {
-			try {
-				await ctx.adapter.create({
-					model: modelName,
-					data: buildSeedRow(input, now)
-				});
-			} catch (err) {
-				const message = err instanceof Error ? err.message : String(err);
-				if (/unique|duplicate|UNIQUE/i.test(message)) {
-					logger.debug(`oauth-provider: resource ${input.identifier} already inserted by a concurrent process — skipping.`);
-					continue;
-				}
-				if (MISSING_TABLE_PATTERN.test(message)) {
-					logger.debug("oauth-provider: oauthResource table not yet created; deferring resource seed to first access.");
-					return;
-				}
-				throw err;
-			}
 			continue;
+		} catch (err) {
+			if (!await ctx.adapter.findOne({
+				model: modelName,
+				where
+			}).catch(() => null)) throw err;
 		}
 		if (mode === "insertOnly") continue;
 		await ctx.adapter.update({
 			model: modelName,
-			where: [{
-				field: "identifier",
-				value: input.identifier
-			}],
+			where,
 			update: buildSeedUpdate(input, mode, now)
 		});
 	}
 }
 /**
-* Idempotent, coalesced wrapper around {@link seedResources} for the
-* lazy-seed path. Safe to call from every resource lookup — the first call
-* runs the seed, concurrent calls await the same promise, and subsequent
-* calls become no-ops.
-*
-* The endpoint context shape (`{ context: AuthContext }`) is what
-* `getResource` receives, so this is a convenience overload that unwraps
-* for callers.
+* Idempotent, coalesced wrapper around {@link seedResources}, called from
+* plugin `init` and from every resource lookup. The first call runs the
+* seed, concurrent calls await the same promise, and calls after a success
+* are no-ops. A failure resets the state so the next call retries.
 *
 * @internal
 */
 async function seedResourcesOnce(ctx, opts) {
-	const state = getSeedState(ctx);
+	const state = getSeedState(ctx, opts);
 	if (state.completed === true) return;
 	if (state.promise !== null) return state.promise;
 	state.promise = seedResources(ctx, opts).then(() => {
@@ -944,187 +1118,6 @@ function validateClientCredentialsScopes(scopes, grantTypes, tokenEndpointAuthMe
 	});
 }
 //#endregion
-//#region src/types/zod.ts
-const DANGEROUS_SCHEMES = [
-	"javascript:",
-	"data:",
-	"vbscript:"
-];
-/**
-* Validates an RFC 8707 resource indicator. The value must be an absolute URI
-* with no fragment (RFC 8707 §2). Unlike a redirect URI it is not restricted to
-* HTTPS, because a resource server identifier may use any absolute URI scheme;
-* configured OAuth resources are the authoritative control over
-* which resources a token may target.
-*/
-const ResourceUriSchema = z.string().superRefine((val, ctx) => {
-	if (!URL.canParse(val)) {
-		ctx.addIssue({
-			code: "custom",
-			message: "resource must be an absolute URI",
-			fatal: true
-		});
-		return z.NEVER;
-	}
-	if (val.includes("#")) {
-		ctx.addIssue({
-			code: "custom",
-			message: "resource must not contain a fragment"
-		});
-		return;
-	}
-	if (DANGEROUS_SCHEMES.includes(new URL(val).protocol)) ctx.addIssue({
-		code: "custom",
-		message: "resource cannot use javascript:, data:, or vbscript: scheme"
-	});
-});
-const authorizationPromptTokenSchema = z.enum([
-	"none",
-	"consent",
-	"login",
-	"create",
-	"select_account"
-]);
-const authorizationPromptSchema = z.string().superRefine((value, ctx) => {
-	const promptTokens = value.split(" ").map((token) => token.trim()).filter(Boolean);
-	const promptSet = /* @__PURE__ */ new Set();
-	if (!promptTokens.length) {
-		ctx.addIssue({
-			code: "custom",
-			message: "prompt must include at least one value"
-		});
-		return;
-	}
-	for (const token of promptTokens) {
-		const result = authorizationPromptTokenSchema.safeParse(token);
-		if (!result.success) {
-			ctx.addIssue({
-				code: "custom",
-				message: `unsupported prompt value: ${token}`
-			});
-			continue;
-		}
-		promptSet.add(result.data);
-	}
-	if (promptSet.has("none") && promptSet.size > 1) ctx.addIssue({
-		code: "custom",
-		message: "prompt=none cannot be combined with other prompt values"
-	});
-});
-/** Canonical RFC 7517 JWK Set metadata for an OAuth client. */
-const clientJwksSchema = z.object({ keys: z.array(z.record(z.string(), z.unknown())).min(1) });
-const maxAgeSchema = z.union([z.number(), z.string().trim().min(1)]).transform((value, ctx) => {
-	const maxAge = typeof value === "number" ? value : Number(value);
-	if (!Number.isInteger(maxAge) || maxAge < 0) {
-		ctx.addIssue({
-			code: "custom",
-			message: "max_age must be a non-negative integer"
-		});
-		return z.NEVER;
-	}
-	return maxAge;
-});
-const dpopJktSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/, "dpop_jkt must be a base64url-encoded SHA-256 JWK thumbprint");
-/**
-* Runtime schema for OAuthAuthorizationQuery.
-* Uses passthrough to tolerate fields added by future extensions (PAR, FPA, etc.)
-*/
-const authorizationQuerySchema = z.object({
-	response_type: z.string().pipe(z.enum(["code"])).optional(),
-	request: z.string().optional(),
-	request_uri: z.string().optional(),
-	redirect_uri: SafeUrlSchema.optional(),
-	scope: z.string().optional(),
-	state: z.string().optional(),
-	client_id: z.string().min(1, "client_id is required"),
-	prompt: authorizationPromptSchema.optional(),
-	display: z.string().optional(),
-	ui_locales: z.string().optional(),
-	max_age: maxAgeSchema.optional(),
-	acr_values: z.string().optional(),
-	login_hint: z.string().optional(),
-	id_token_hint: z.string().optional(),
-	code_challenge: z.string().optional(),
-	code_challenge_method: z.string().pipe(z.enum(["S256"])).optional(),
-	nonce: z.string().optional(),
-	claims: claimsRequestInputSchema.optional(),
-	dpop_jkt: dpopJktSchema.optional(),
-	resource: z.union([ResourceUriSchema, z.array(ResourceUriSchema).min(1)]).optional()
-}).passthrough();
-const storedAuthorizationQuerySchema = authorizationQuerySchema.extend({
-	redirect_uri: SafeUrlSchema.optional(),
-	claims: claimsRequestParameterSchema.optional()
-});
-/**
-* Runtime schema for the authorization code verification value.
-* Validates structure on deserialization from the JSON blob stored in the DB.
-* Uses passthrough so future fields (e.g. from authorization challenge) don't break parsing.
-*/
-const verificationValueSchema = z.object({
-	type: z.literal("authorization_code"),
-	query: storedAuthorizationQuerySchema,
-	sessionId: z.string(),
-	userId: z.string(),
-	referenceId: z.string().optional(),
-	authTime: z.number().optional(),
-	resource: z.array(z.string()).optional()
-}).passthrough();
-/**
-* Request body accepted at `POST /oauth2/register` (RFC 7591 §2 client
-* metadata). This is the single source of truth for the registration contract:
-* the endpoint validates against it and {@link ClientRegistrationRequest} is
-* inferred from it, so the type a `validateInitialAccessToken` callback receives
-* always matches what is actually validated. `grant_types` and
-* `token_endpoint_auth_method` are open strings because extensions can register
-* custom values. Server-assigned fields (`client_id`, `client_secret`, the
-* issued/expiry timestamps) and internal state (`disabled`, `reference_id`) are
-* never part of a registration request.
-*
-* @see https://datatracker.ietf.org/doc/html/rfc7591#section-2
-*/
-const clientRegistrationRequestSchema = z.object({
-	redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
-	scope: z.string().optional(),
-	client_name: z.string().refine((value) => value.trim().length > 0, "client_name cannot be empty").optional(),
-	client_uri: z.string().optional(),
-	logo_uri: z.string().optional(),
-	contacts: z.array(z.string().min(1)).min(1).optional(),
-	tos_uri: z.string().optional(),
-	policy_uri: z.string().optional(),
-	software_id: z.string().optional(),
-	software_version: z.string().optional(),
-	software_statement: z.string().optional(),
-	post_logout_redirect_uris: z.array(SafeUrlSchema).min(1).optional(),
-	backchannel_logout_uri: SafeUrlSchema.optional(),
-	backchannel_logout_session_required: z.boolean().optional(),
-	token_endpoint_auth_method: z.string().trim().min(1).optional(),
-	jwks: clientJwksSchema.optional(),
-	jwks_uri: z.string().optional(),
-	grant_types: z.array(z.string().trim().min(1)).min(1).optional(),
-	response_types: z.array(z.enum(["code"])).optional(),
-	application_type: z.enum(["web", "native"]).optional(),
-	subject_type: z.enum(["public", "pairwise"]).optional(),
-	dpop_bound_access_tokens: z.boolean().optional(),
-	resources: z.array(ResourceUriSchema).optional(),
-	skip_consent: z.never({ error: "skip_consent cannot be set during dynamic client registration" }).optional()
-});
-/**
-* Complete OAuth client metadata document schema shared by registration and
-* verified client-discovery integrations.
-*
-* Unlike {@link clientRegistrationRequestSchema}, a metadata document carries
-* its own identifier and may contain the server-assigned secret fields that a
-* discovery profile must explicitly prohibit. Keeping those fields in the
-* parsed shape lets profile validation distinguish a forbidden value from an
-* unknown extension without unsafe casts or ad-hoc allowlists.
-*/
-const oauthClientMetadataSchema = clientRegistrationRequestSchema.omit({ skip_consent: true }).extend({
-	client_id: z.string().refine((value) => value.trim().length > 0, "client_id cannot be empty"),
-	client_secret: z.string().optional(),
-	client_secret_expires_at: z.number().int().nonnegative().optional(),
-	client_id_issued_at: z.number().int().nonnegative().optional()
-}).loose();
-//#endregion
 //#region src/userinfo.ts
 /**
 * Builds the standard OIDC claims (OIDC Core §5.1) for the UserInfo response.
@@ -2548,4 +2541,4 @@ async function introspectEndpoint(ctx, opts) {
 	}
 }
 //#endregion
-export { filterClaimsRequestUserInfoClaims as A, resolveResourcePolicy as C, getSupportedClaims as D, STANDARD_CLAIM_NAMES as E, isValidOidcClaimsRequest as M, canSatisfyEssentialAcrRequest as O, logEnforcePerClientResourcesResolution as S, STANDARD_CLAIMS as T, assertIdentifierValid as _, invalidateRefreshFamily as a, invalidateResourceCache as b, ResourceUriSchema as c, clientJwksSchema as d, clientRegistrationRequestSchema as f, JWS_ALGORITHMS as g, validateClientCredentialsScopes as h, getOAuthProviderApi as i, getRequestedUserInfoClaims as j, claimsRequestParameterSchema as k, SafeUrlSchema as l, normalizeClientCredentialsScopes as m, introspect_exports as n, tokenEndpoint as o, oauthClientMetadataSchema as p, decodeRefreshToken as r, userInfoEndpoint as s, introspectEndpoint as t, authorizationQuerySchema as u, extractRepeatedResourceFromForm as v, seedResources as w, isAudienceClaimAllowed as x, getResource as y };
+export { claimsRequestParameterSchema as A, clientJwksSchema as C, STANDARD_CLAIM_NAMES as D, STANDARD_CLAIMS as E, getRequestedUserInfoClaims as M, isValidOidcClaimsRequest as N, getSupportedClaims as O, authorizationQuerySchema as S, oauthClientMetadataSchema as T, logStartupSeedFailure as _, invalidateRefreshFamily as a, ResourceUriSchema as b, normalizeClientCredentialsScopes as c, assertIdentifierValid as d, extractRepeatedResourceFromForm as f, logEnforcePerClientResourcesResolution as g, isAudienceClaimAllowed as h, getOAuthProviderApi as i, filterClaimsRequestUserInfoClaims as j, canSatisfyEssentialAcrRequest as k, validateClientCredentialsScopes as l, invalidateResourceCache as m, introspect_exports as n, tokenEndpoint as o, getResource as p, decodeRefreshToken as r, userInfoEndpoint as s, introspectEndpoint as t, JWS_ALGORITHMS as u, resolveResourcePolicy as v, clientRegistrationRequestSchema as w, SafeUrlSchema as x, seedResourcesOnce as y };

package/dist/{oauth-C_7TvkRL.d.mts → oauth-C_RnL2nt.d.mts}

@@ -1429,6 +1429,27 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @default true
    */
   clientRegistrationRequirePKCE?: boolean;
+  /**
+   * Default `application_type` for dynamic client registrations that omit the
+   * field.
+   *
+   * - `"web"`: the OIDC Registration §2 default. Omitted `application_type` is
+   *   treated as `web`, so custom-scheme redirect URIs are rejected.
+   * - `"native"`: omitted `application_type` is treated as `native`.
+   * - `"infer"`: omitted `application_type` is treated as `native` when any
+   *   `redirect_uris` entry uses a non-http(s) scheme; otherwise `web`. Every
+   *   redirect URI is then validated against the native rules. Lets native MCP
+   *   clients that omit `application_type` (for example Cursor, which also
+   *   registers https and loopback callbacks) register without loosening
+   *   web-client redirect policy.
+   *
+   * An `application_type` the client actually sends is never overridden.
+   * Applies only to dynamic client registration; managed clients and Client ID
+   * Metadata Documents are unaffected.
+   *
+   * @default "web"
+   */
+  clientRegistrationDefaultApplicationType?: "web" | "native" | "infer";
   /**
    * How long a dynamically created confidential client
    * should last for.
@@ -1480,6 +1501,16 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
     action: "create" | "read" | "update" | "delete" | "list" | "rotate" | "configure-client-credentials-scopes";
     user?: User & Record<string, unknown>;
     session?: Session & Record<string, unknown>;
+    /**
+     * The `client_id` from the request, for actions on an existing client.
+     * Absent for `create`, `list`, and scope configuration during creation.
+     * The client may not exist, and this value does not establish ownership.
+     * Client CRUD enforces ownership except when `adminUpdateOAuthClient`
+     * changes only `client_credentials_scopes`: the `update` and
+     * `configure-client-credentials-scopes` decisions can authorize access
+     * to another owner's client.
+     */
+    clientId?: string;
   }) => Awaitable<boolean | undefined>;
   /**
    * Grant types supported by the token endpoint

package/dist/{oauth-Dtt-caL2.d.mts → oauth-pKAoqtlo.d.mts}

@@ -1,4 +1,4 @@
-import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-C_7TvkRL.mjs";
+import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-C_RnL2nt.mjs";
 import * as _$better_call0 from "better-call";
 import * as z from "zod";
 import * as _$jose from "jose";
@@ -1785,6 +1785,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         jwks_uri: z.ZodOptional<z.ZodString>;
         grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
         client_credentials_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
         response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
           code: "code";
         }>>>;
@@ -2280,6 +2281,7 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
           client_secret_expires_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
           skip_consent: z.ZodOptional<z.ZodBoolean>;
           enable_end_session: z.ZodOptional<z.ZodBoolean>;
+          disabled: z.ZodOptional<z.ZodBoolean>;
           dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
           metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>;

package/dist/{utils-D6Hp4Qd_.mjs → utils-CGIZS-Da.mjs}

@@ -712,7 +712,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-K1WHCNih.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-C95F-9E1.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-C2j2jEFL.mjs → version-BPS0os17.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.7";
+const PACKAGE_VERSION = "1.7.8";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.7",
+  "version": "1.7.8",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.7",
-    "@better-auth/memory-adapter": "1.7.7",
-    "better-auth": "1.7.7"
+    "@better-auth/core": "1.7.8",
+    "@better-auth/memory-adapter": "1.7.8",
+    "better-auth": "1.7.8"
   },
   "peerDependencies": {
-    "@better-auth/utils": "0.4.2",
+    "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
-    "better-call": "1.4.0",
-    "@better-auth/core": "^1.7.7",
-    "better-auth": "^1.7.7"
+    "better-call": "1.4.2",
+    "@better-auth/core": "^1.7.8",
+    "better-auth": "^1.7.8"
   },
   "scripts": {
     "build": "tsdown",