@better-auth/oauth-provider 1.7.9 → 1.7.11

package/dist/{authorize-D8r6mvZx.mjs → authorize-CtCi8mAs.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as claimsRequestParameterSchema, C as clientJwksSchema, D as STANDARD_CLAIM_NAMES, E as STANDARD_CLAIMS, M as getRequestedUserInfoClaims, N as isValidOidcClaimsRequest, O as getSupportedClaims, S as authorizationQuerySchema, _ as logStartupSeedFailure, a as invalidateRefreshFamily, b as ResourceUriSchema, c as normalizeClientCredentialsScopes, d as assertIdentifierValid, f as extractRepeatedResourceFromForm, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, j as filterClaimsRequestUserInfoClaims, k as canSatisfyEssentialAcrRequest, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as tokenEndpoint, p as getResource, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as JWS_ALGORITHMS, v as resolveResourcePolicy, w as clientRegistrationRequestSchema, x as SafeUrlSchema, y as seedResourcesOnce } from "./introspect-7WCMPe5Z.mjs";
-import { B as validateOAuthProviderExtensions, C as storeToken, E as validateClientCredentials, I as getSupportedAuthMethods, L as getSupportedGrantTypes, O as verifyOAuthQueryParams, P as getClientDiscoveries, S as storeClientSecret, T as toResourceList, _ as removeMaxAgeFromQuery, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, d as mergeDiscoveryMetadata, g as parsePrompt, h as parseClientMetadata, i as extractClientCredentials, k as applyOAuthProviderMetadataExtensions, l as isPKCERequired, m as parseBearerToken, n as decryptStoredClientSecret, o as getJwtPlugin, r as destructureCredentials, t as clientAllowsGrant, u as isSessionFreshForSignedQuery, v as removePromptFromQuery, x as searchParamsToQuery, z as isExtensionTokenEndpointAuthMethod } from "./utils-DKU5wblX.mjs";
+import { A as canSatisfyEssentialAcrRequest, C as authorizationQuerySchema, D as STANDARD_CLAIMS, M as filterClaimsRequestUserInfoClaims, N as getRequestedUserInfoClaims, O as STANDARD_CLAIM_NAMES, P as isValidOidcClaimsRequest, S as SafeUrlSchema, T as clientRegistrationRequestSchema, _ as logEnforcePerClientResourcesResolution, a as invalidateRefreshFamily, b as seedResourcesOnce, c as normalizeClientCredentialsScopes, d as JWS_ALGORITHMS, f as assertIdentifierValid, g as isAudienceClaimAllowed, h as invalidateResourceCache, j as claimsRequestParameterSchema, k as getSupportedClaims, l as validateClientCredentialsScopes, m as getResource, o as tokenEndpoint, p as extractRepeatedResourceFromForm, r as decodeRefreshToken, s as userInfoEndpoint, t as introspectEndpoint, u as getEndpointUrl, v as logStartupSeedFailure, w as clientJwksSchema, x as ResourceUriSchema, y as resolveResourcePolicy } from "./introspect-B-5vOvYK.mjs";
+import { A as validateClientCredentials, B as getSupportedAuthMethods, D as storeToken, E as storeClientSecret, M as verifyOAuthQueryParams, N as applyOAuthProviderMetadataExtensions, R as getClientDiscoveries, S as removePromptFromQuery, T as searchParamsToQuery, U as isExtensionTokenEndpointAuthMethod, V as getSupportedGrantTypes, W as validateOAuthProviderExtensions, a as extractClientCredentials, b as parsePrompt, c as getConsentReferenceId, d as getStoredToken, f as isInvalidJwtError, h as mergeDiscoveryMetadata, i as destructureCredentials, k as toResourceList, l as getJwtPlugin, m as isSessionFreshForSignedQuery, n as clientAllowsGrant, o as findConsent, p as isPKCERequired, r as decryptStoredClientSecret, s as getClient, t as assertNotTrustedClient, v as parseBearerToken, w as resolveSubjectIdentifier, x as removeMaxAgeFromQuery, y as parseClientMetadata } from "./utils-vIo_wPv5.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-DVUrz-nv.mjs";
+import { t as PACKAGE_VERSION } from "./version-DtVKOwOn.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { appendQueryParams } from "@better-auth/core/utils/url";
@@ -17,8 +17,8 @@ import { deleteSessionCookie, parseSetCookieHeader } from "better-auth/cookies";
 import { mergeSchema } from "better-auth/db";
 import { CLIENT_ASSERTION_TYPE, DPOP_SIGNING_ALGORITHMS, PRIVATE_KEY_JWT_SIGNING_ALGORITHMS } from "@better-auth/core/oauth2";
 import { createHash } from "@better-auth/utils/hash";
+import { compactVerify, createLocalJWKSet, decodeJwt, decodeProtectedHeader, errors, jwtVerify } from "jose";
 import { getJwks, stripAccessTokenAuthorizationScheme } from "better-auth/oauth2";
-import { compactVerify, createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
 import { isNativePrivateUseRedirectUri } from "@better-auth/core/utils/redirect-uri";
 import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
 import { encodeDeterministicId } from "@better-auth/core/db/internal";
@@ -64,28 +64,12 @@ async function consentEndpoint(ctx, opts, authorize) {
 		ctx.query = searchParamsToQuery(query);
 		return await authorize(ctx);
 	}
-	const referenceId = await opts.postLogin?.consentReferenceId?.({
+	const referenceId = await getConsentReferenceId(opts, {
 		user: session?.user,
 		session: session?.session,
 		scopes: requestedScopes ?? originalRequestedScopes
 	});
-	const foundConsent = await ctx.context.adapter.findOne({
-		model: "oauthConsent",
-		where: [
-			{
-				field: "clientId",
-				value: clientId
-			},
-			{
-				field: "userId",
-				value: session?.user.id
-			},
-			...referenceId ? [{
-				field: "referenceId",
-				value: referenceId
-			}] : []
-		]
-	});
+	const foundConsent = await findConsent(ctx, clientId, session?.user.id, referenceId);
 	const iat = Math.floor(Date.now() / 1e3);
 	const resource = query.getAll("resource");
 	const consent = {
@@ -1032,6 +1016,17 @@ function validatePublicClientJwks(input) {
 		jwks: { keys }
 	};
 }
+/**
+* Throws `invalid_client_metadata` unless `jwks` is a public JWK Set that
+* {@link validatePublicClientJwks} accepts.
+*/
+function assertValidClientJwks(jwks) {
+	const result = validatePublicClientJwks(jwks);
+	if (!result.valid) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client_metadata",
+		error_description: result.error
+	});
+}
 //#endregion
 //#region src/client-metadata.ts
 const OAUTH_CLIENT_RECORD_FIELD_NAMES = Object.freeze(Object.keys({
@@ -1492,8 +1487,20 @@ async function consumeClientAssertion(ctx, opts, params) {
 * Validates: signature, iss=client_id, sub=client_id, aud=the endpoint serving
 * the assertion or the normalized OP issuer, exp, assertion max lifetime,
 * jti uniqueness (replay prevention).
+*
+* Returns the client record the signature was checked against, so a caller that
+* mutates the client can guard its write on exactly that snapshot.
+*
+* With `endpointAudienceOnly`, the issuer is not an accepted audience, so only
+* an assertion whose `aud` includes `expectedAudience` verifies. Endpoints that
+* change client credentials use it, so an assertion minted for the token
+* endpoint or the issuer cannot be redirected to them.
+*
+* `assertClient` runs on the looked-up client before any key is fetched or the
+* jti is consumed, so a caller can refuse a client it does not serve without
+* spending the assertion or reaching out to a `jwks_uri`.
 */
-async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertionType, clientIdHint, expectedAudience) {
+async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertionType, clientIdHint, expectedAudience, options) {
 	if (clientAssertionType !== CLIENT_ASSERTION_TYPE) throw new APIError$1("BAD_REQUEST", {
 		error_description: "unsupported client_assertion_type",
 		error: "invalid_client"
@@ -1531,7 +1538,7 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 	});
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError$1("BAD_REQUEST", {
-		error_description: "unknown client",
+		error_description: "client not found",
 		error: "invalid_client"
 	});
 	if (client.disabled) throw new APIError$1("BAD_REQUEST", {
@@ -1542,10 +1549,11 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 		error_description: "client is not registered for private_key_jwt authentication",
 		error: "invalid_client"
 	});
+	options?.assertClient?.(client);
 	const jwks = await fetchClientJwks(ctx, opts, client);
 	const endpointAudience = expectedAudience ?? `${ctx.context.baseURL}/oauth2/token`;
 	const issuerAudience = getIssuer(ctx, opts);
-	const acceptedAudiences = [...new Set([endpointAudience, issuerAudience])];
+	const acceptedAudiences = options?.endpointAudienceOnly ? [endpointAudience] : [...new Set([endpointAudience, issuerAudience])];
 	const verifyOpts = {
 		issuer: clientId,
 		subject: clientId,
@@ -1581,7 +1589,10 @@ async function verifyClientAssertion(ctx, opts, clientAssertion, clientAssertion
 		payload,
 		expectedAudience: acceptedAudience
 	});
-	return { clientId };
+	return {
+		clientId,
+		client
+	};
 }
 //#endregion
 //#region src/utils/initial-access-token.ts
@@ -1659,6 +1670,21 @@ function resolveRegistrationResponseTypes(client, grantTypes) {
 	if (client.response_types) return client.response_types;
 	return grantTypes.includes("authorization_code") ? ["code"] : void 0;
 }
+/**
+* The requested grants this server supports. Clients such as MCP connectors
+* send one grant union to every server, so a metadata document or a dynamic
+* registration may list grants this server does not issue. Throws when the
+* request shares no grant with the server.
+*/
+function resolveMutuallySupportedGrantTypes(opts, grantTypes) {
+	const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
+	const mutualGrantTypes = grantTypes.filter((grantType) => supportedGrantTypes.has(grantType));
+	if (mutualGrantTypes.length === 0) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client_metadata",
+		error_description: `no mutually supported grant_type among ${grantTypes.join(", ")}`
+	});
+	return mutualGrantTypes;
+}
 function applyOAuthClientRegistrationDefaults(client, defaultApplicationType = "web") {
 	const grantTypes = resolveRegistrationGrantTypes(client);
 	return {
@@ -1684,15 +1710,15 @@ function isNonHttpRedirectUri(redirectUri) {
 /**
 * Server-owned default for dynamic registrations that omit `application_type`.
 * `"infer"` classifies as native when any redirect URI uses a non-http(s)
-* scheme, because a web client can never register one. Every URI is then
-* validated against the native rules. A sent `application_type` is never
-* overridden because `applyOAuthClientRegistrationDefaults` only fills the
-* absent field.
+* scheme or http on an exact loopback host, because a web client can never
+* register either. Every URI is then validated against the native rules. A
+* sent `application_type` is never overridden because
+* `applyOAuthClientRegistrationDefaults` only fills the absent field.
 */
 function resolveDynamicRegistrationDefaultApplicationType(opts, client) {
 	const configured = opts.clientRegistrationDefaultApplicationType ?? "web";
 	if (configured !== "infer") return configured;
-	return (client.redirect_uris ?? []).some(isNonHttpRedirectUri) ? "native" : "web";
+	return (client.redirect_uris ?? []).some((uri) => isNonHttpRedirectUri(uri) || isExactLoopbackHttpRedirectUri(uri)) ? "native" : "web";
 }
 function invalidRedirectUri(description) {
 	throw new APIError("BAD_REQUEST", {
@@ -1710,6 +1736,10 @@ function getRawHttpHostname(redirectUri) {
 	}
 	return (hostAndPort.split(":")[0] ?? "").toLowerCase();
 }
+function isExactLoopbackHttpRedirectUri(redirectUri) {
+	const hostname = getRawHttpHostname(redirectUri);
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
 function assertDynamicRegistrationResourcesAllowed(opts, requestedResources) {
 	const allowedResources = new Set([...opts.clientRegistrationDefaultResources ?? [], ...opts.clientRegistrationAllowedResources ?? []]);
 	for (const identifier of requestedResources) if (!allowedResources.has(identifier)) throw new APIError("BAD_REQUEST", {
@@ -1745,8 +1775,6 @@ function validateClientRedirectUri(redirectUri, applicationType) {
 	const isHttps = url.protocol === "https:";
 	if (/^localhost\.+$/i.test(url.hostname)) invalidRedirectUri(`redirect URI localhost must not include trailing dots: ${redirectUri}`);
 	const isRedirectLoopback = isLoopbackIP(url.hostname) || url.hostname === "localhost";
-	const rawHttpHostname = getRawHttpHostname(redirectUri);
-	const isAllowedNativeHttpLoopback = rawHttpHostname === "localhost" || rawHttpHostname === "127.0.0.1" || rawHttpHostname === "[::1]";
 	if (applicationType === "web") {
 		if (!isHttps || isRedirectLoopback) invalidRedirectUri(`web clients require https redirect URIs on non-loopback hosts: ${redirectUri}`);
 		return;
@@ -1756,18 +1784,11 @@ function validateClientRedirectUri(redirectUri, applicationType) {
 		return;
 	}
 	if (isHttp) {
-		if (!isAllowedNativeHttpLoopback) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);
+		if (!isExactLoopbackHttpRedirectUri(redirectUri)) invalidRedirectUri(`native clients may use http only on the exact loopback hosts localhost, 127.0.0.1, or [::1]: ${redirectUri}`);
 		return;
 	}
 	if (!isNativePrivateUseRedirectUri(url)) invalidRedirectUri(`native private-use redirect URI schemes must not use a reserved scheme; they must be an authority-free reverse-domain URI or a custom-scheme URI with a host and a path: ${redirectUri}`);
 }
-function assertValidRegistrationJwks(jwks) {
-	const result = validatePublicClientJwks(jwks);
-	if (!result.valid) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: result.error
-	});
-}
 async function registerEndpoint(ctx, opts) {
 	const body = ctx.body;
 	if (!opts.allowDynamicClientRegistration) throw new APIError("FORBIDDEN", {
@@ -1781,8 +1802,15 @@ async function registerEndpoint(ctx, opts) {
 		"WWW-Authenticate": "Bearer",
 		...NO_STORE_HEADERS
 	});
+	const grantTypes = body.grant_types?.length ? resolveMutuallySupportedGrantTypes(opts, body.grant_types) : body.grant_types;
+	const droppedAuthorizationCode = body.grant_types?.includes("authorization_code") && !grantTypes?.includes("authorization_code");
+	const metadata = {
+		...body,
+		grant_types: grantTypes,
+		response_types: droppedAuthorizationCode ? void 0 : body.response_types
+	};
 	if (!session && !isTokenAuthorized) {
-		if (body.grant_types?.includes("client_credentials")) throw new APIError("BAD_REQUEST", {
+		if (metadata.grant_types?.includes("client_credentials")) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
 			error_description: "client_credentials grant requires authenticated registration"
 		});
@@ -1794,7 +1822,7 @@ async function registerEndpoint(ctx, opts) {
 		session: session.session
 	}) : void 0);
 	const response = await createOAuthClientRegistration(ctx, opts, {
-		metadata: body,
+		metadata,
 		registrationSource: "dynamic",
 		userId: referenceId ? void 0 : session?.session.userId,
 		referenceId,
@@ -1827,16 +1855,14 @@ async function checkOAuthClient(client, opts, settings) {
 		error_description: "Redirect URIs are required for authorization_code and implicit grant types"
 	});
 	for (const uri of clientWithDefaults.redirect_uris ?? []) validateClientRedirectUri(uri, applicationType ?? (isClientMetadataDocument ? "native" : "web"));
-	const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
-	if (isClientMetadataDocument) {
-		if (!grantTypes.some((grantType) => supportedGrantTypes.has(grantType))) throw new APIError("BAD_REQUEST", {
+	if (isClientMetadataDocument) resolveMutuallySupportedGrantTypes(opts, grantTypes);
+	else {
+		const supportedGrantTypes = new Set(getSupportedGrantTypes(opts));
+		for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
 			error: "invalid_client_metadata",
-			error_description: `no mutually supported grant_type among ${grantTypes.join(", ")}`
+			error_description: `unsupported grant_type ${grantType}`
 		});
-	} else for (const grantType of grantTypes) if (!supportedGrantTypes.has(grantType)) throw new APIError("BAD_REQUEST", {
-		error: "invalid_client_metadata",
-		error_description: `unsupported grant_type ${grantType}`
-	});
+	}
 	if (grantTypes.includes("authorization_code") && !responseTypes?.includes("code")) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
 		error_description: "When 'authorization_code' grant type is used, 'code' response type must be included"
@@ -1916,7 +1942,7 @@ async function checkOAuthClient(client, opts, settings) {
 				error_description: "jwks_uri must be a valid URL"
 			});
 		}
-		if (clientWithDefaults.jwks) assertValidRegistrationJwks(clientWithDefaults.jwks);
+		if (clientWithDefaults.jwks) assertValidClientJwks(clientWithDefaults.jwks);
 	}
 	if (tokenEndpointAuthMethod === "private_key_jwt" && !clientWithDefaults.jwks && !clientWithDefaults.jwks_uri) throw new APIError("BAD_REQUEST", {
 		error: "invalid_client_metadata",
@@ -2007,7 +2033,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 		user_id: owner?.referenceId ? void 0 : owner?.userId,
 		reference_id: owner?.referenceId
 	});
-	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
+	schema.clientCredentialsScopes = input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
 	schema.clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
 	if (input.registrationSource === "clientMetadataDocument" && body.application_type === void 0) schema.applicationType = null;
 	const requestedResources = input.registrationSource === "clientMetadataDocument" ? [] : input.requestedResources ?? [];
@@ -2022,6 +2048,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 		let storedClient;
 		let created = false;
 		if (existingClient) {
+			const { clientCredentialsScopes: _ceiling, disabled: _disabled, skipConsent: _skipConsent, enableEndSession: _enableEndSession, ...refreshed } = schema;
 			const updatedClient = await adapter.update({
 				model: clientModel,
 				where: [{
@@ -2032,10 +2059,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 					value: clientDiscoveryId
 				}],
 				update: {
-					...schema,
-					disabled: existingClient.disabled,
-					skipConsent: existingClient.skipConsent,
-					enableEndSession: existingClient.enableEndSession,
+					...refreshed,
 					createdAt: existingClient.createdAt,
 					updatedAt: /* @__PURE__ */ new Date(iat * 1e3)
 				}
@@ -2421,10 +2445,7 @@ async function deleteClientEndpoint(ctx, opts) {
 	await assertClientPrivileges(ctx, session, opts, "delete", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
-		error_description: "trusted clients must be updated manually",
-		error: "invalid_client"
-	});
+	assertNotTrustedClient(opts, clientId);
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
@@ -2448,10 +2469,7 @@ async function updateClientEndpoint(ctx, opts, settings) {
 	await assertClientPrivileges(ctx, session, opts, "update", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
-		error_description: "trusted clients must be updated manually",
-		error: "invalid_client"
-	});
+	assertNotTrustedClient(opts, clientId);
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
@@ -2519,10 +2537,7 @@ async function rotateClientSecretEndpoint(ctx, opts) {
 	await assertClientPrivileges(ctx, session, opts, "rotate", ctx.body.client_id);
 	if (!session) throw new APIError("UNAUTHORIZED");
 	const clientId = ctx.body.client_id;
-	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("INTERNAL_SERVER_ERROR", {
-		error_description: "trusted clients must be updated manually",
-		error: "invalid_client"
-	});
+	assertNotTrustedClient(opts, clientId);
 	const client = await getClient(ctx, opts, clientId);
 	if (!client) throw new APIError("NOT_FOUND", {
 		error_description: "client not found",
@@ -2559,6 +2574,57 @@ async function rotateClientSecretEndpoint(ctx, opts) {
 		clientSecret: (opts.prefix?.clientSecret ?? "") + clientSecret
 	});
 }
+/**
+* The write is guarded on the exact key set the assertion was verified against.
+* A concurrent rotation changes that value, so the stale request loses instead
+* of overwriting a newer key set.
+*
+* @see https://datatracker.ietf.org/doc/html/rfc7523#section-3
+*/
+async function rotateClientKeysEndpoint(ctx, opts) {
+	if (!opts.allowClientKeyRotation) throw new APIError("FORBIDDEN", {
+		error: "access_denied",
+		error_description: "Client key rotation is disabled"
+	});
+	const { body } = ctx;
+	assertValidClientJwks(body.jwks);
+	const { client } = await verifyClientAssertion(ctx, opts, body.client_assertion, body.client_assertion_type, void 0, getEndpointUrl({
+		context: ctx.context,
+		request: void 0
+	}, "/oauth2/client/rotate-keys"), {
+		endpointAudienceOnly: true,
+		assertClient: (candidate) => assertRotatable(opts, candidate)
+	});
+	if (!await ctx.context.adapter.incrementOne({
+		model: "oauthClient",
+		where: [{
+			field: "clientId",
+			value: client.clientId
+		}, {
+			field: "jwks",
+			value: client.jwks
+		}],
+		increment: {},
+		set: {
+			jwks: JSON.stringify(body.jwks),
+			updatedAt: /* @__PURE__ */ new Date()
+		}
+	})) throw new APIError("CONFLICT", {
+		error: "invalid_request",
+		error_description: "client keys changed while rotating; retry with a fresh client assertion"
+	});
+	return {
+		client_id: client.clientId,
+		jwks: body.jwks
+	};
+}
+function assertRotatable(opts, client) {
+	assertNotTrustedClient(opts, client.clientId);
+	if (client.clientDiscoveryId || client.jwksUri || !client.jwks) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client",
+		error_description: "client keys are not stored inline; rotate them where the client publishes them"
+	});
+}
 //#endregion
 //#region src/oauthClient/index.ts
 const tokenEndpointAuthMethodSchema = z.string().trim().min(1);
@@ -3003,6 +3069,29 @@ const rotateClientSecret = (opts) => createAuthEndpoint("/oauth2/client/rotate-s
 }, async (ctx) => {
 	return rotateClientSecretEndpoint(ctx, opts);
 });
+/**
+* Replaces a `private_key_jwt` client's own signing keys. The client proves it
+* holds a current key with a client assertion, so no session is needed.
+*/
+const rotateClientKeys = (opts) => createOAuthEndpoint("/oauth2/client/rotate-keys", {
+	method: "POST",
+	body: z.object({
+		client_assertion: z.string(),
+		client_assertion_type: z.string(),
+		jwks: clientJwksSchema
+	}),
+	errorCodesByField: {
+		client_assertion: "invalid_client",
+		client_assertion_type: "invalid_client",
+		jwks: "invalid_client_metadata"
+	},
+	metadata: {
+		noStore: true,
+		openapi: { description: "Replaces the signing keys of a private_key_jwt client. The request is authenticated by a client assertion signed with one of the client's current keys and addressed to this endpoint. Keys left out of the new set stop verifying at once." }
+	}
+}, async (ctx) => {
+	return rotateClientKeysEndpoint(ctx, opts);
+});
 const deleteOAuthClient = (opts) => createAuthEndpoint("/oauth2/delete-client", {
 	method: "POST",
 	use: [sessionMiddleware],
@@ -3468,29 +3557,30 @@ const adminUnlinkClientResource = (opts) => createAuthEndpoint("/admin/oauth2/re
 * introspection and userinfo.
 */
 async function revokeJwtAccessToken(ctx, opts, token) {
-	const jwtPlugin = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context);
-	const jwtPluginOptions = jwtPlugin?.options;
+	if (opts.disableJwtPlugin) throw new APIError$1("BAD_REQUEST", {
+		error_description: "JWT access tokens are disabled",
+		error: "invalid_request"
+	});
+	const jwtPlugin = getJwtPlugin(ctx.context);
+	const jwtPluginOptions = jwtPlugin.options;
+	let jwtPayload;
 	try {
-		const verified = await jwtVerify(token, createLocalJWKSet(await getJwks(token, {
+		jwtPayload = (await jwtVerify(token, createLocalJWKSet(await getJwks(token, {
 			jwksFetch: jwtPluginOptions?.jwks?.remoteUrl ? jwtPluginOptions.jwks.remoteUrl : async () => {
-				return (await jwtPlugin?.endpoints.getJwks(ctx))?.response;
+				return (await jwtPlugin.endpoints.getJwks(ctx))?.response;
 			},
 			jwksCacheKey: jwtPlugin
-		})), { issuer: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL });
-		const userInfoAudience = `${ctx.context.baseURL}/oauth2/userinfo`;
-		if (!verified.payload.azp || !await isAudienceClaimAllowed(ctx, opts, verified.payload.aud, [userInfoAudience])) return null;
+		})), { issuer: jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL })).payload;
 	} catch (error) {
-		if (error instanceof Error) {
-			if (error.name === "TypeError" || error.name === "JWSInvalid") throw new APIError$1("BAD_REQUEST", {
-				error_description: "invalid JWT signature",
-				error: "invalid_request"
-			});
-			else if (error.name === "JWTExpired") return null;
-			else if (error.name === "JWTInvalid") return null;
-			throw error;
-		}
-		throw new Error(error);
+		if (error instanceof errors.JWTExpired || error instanceof errors.JWTInvalid) return null;
+		if (error instanceof TypeError || isInvalidJwtError(error)) throw new APIError$1("BAD_REQUEST", {
+			error_description: "invalid JWT signature",
+			error: "invalid_request"
+		});
+		throw error;
 	}
+	const userInfoAudience = `${ctx.context.baseURL}/oauth2/userinfo`;
+	if (!jwtPayload.azp || !await isAudienceClaimAllowed(ctx, opts, jwtPayload.aud, [userInfoAudience])) return null;
 	throw new APIError$1("BAD_REQUEST", {
 		error_description: "JWT access tokens are self-contained and cannot be revoked server-side",
 		error: "unsupported_token_type"
@@ -4443,6 +4533,10 @@ const oauthProvider = (options) => {
 		onRequest: handleIssuerMetadataRequest,
 		init: async (ctx) => {
 			if (ctx.options.secondaryStorage && ctx.options.session?.storeSessionInDatabase !== true) throw new BetterAuthError("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");
+			if (opts.allowClientKeyRotation) {
+				const gap = ctx.adapter.id === "memory" ? "the memory adapter" : ctx.options.advanced?.database?.generateId === "serial" ? "`advanced.database.generateId: \"serial\"`" : void 0;
+				if (gap) throw new BetterAuthError(`\`allowClientKeyRotation\` requires single-use client assertions, which ${gap} does not enforce`);
+			}
 			await seedResourcesOnce(ctx, opts).catch((error) => logStartupSeedFailure(ctx, error));
 			logEnforcePerClientResourcesResolution(opts);
 			if (!opts.disableJwtPlugin) {
@@ -4579,12 +4673,19 @@ const oauthProvider = (options) => {
 						description: "Consent processed successfully",
 						content: { "application/json": { schema: {
 							type: "object",
-							properties: { redirect_uri: {
-								type: "string",
-								format: "uri",
-								description: "The URI to redirect to, either with an authorization code or an error"
-							} },
-							required: ["redirect_uri"]
+							properties: {
+								redirect: {
+									type: "boolean",
+									description: "Always true. Indicates the caller should redirect to `url`.",
+									enum: [true]
+								},
+								url: {
+									type: "string",
+									format: "uri-reference",
+									description: "The absolute or relative URI to redirect to next."
+								}
+							},
+							required: ["redirect", "url"]
 						} } }
 					} }
 				} }
@@ -4603,15 +4704,22 @@ const oauthProvider = (options) => {
 				metadata: { openapi: {
 					description: "Continues OAuth2 authorization flow",
 					responses: { "200": {
-						description: "Consent processed successfully",
+						description: "Authorization flow continued successfully",
 						content: { "application/json": { schema: {
 							type: "object",
-							properties: { redirect_uri: {
-								type: "string",
-								format: "uri",
-								description: "The URI to redirect to, either with an authorization code or an error"
-							} },
-							required: ["redirect_uri"]
+							properties: {
+								redirect: {
+									type: "boolean",
+									description: "Always true. Indicates the caller should redirect to `url`.",
+									enum: [true]
+								},
+								url: {
+									type: "string",
+									format: "uri-reference",
+									description: "The absolute or relative URI to redirect to next."
+								}
+							},
+							required: ["redirect", "url"]
 						} } }
 					} }
 				} }
@@ -5257,6 +5365,7 @@ const oauthProvider = (options) => {
 			adminUpdateOAuthClient: adminUpdateOAuthClient(opts),
 			updateOAuthClient: updateOAuthClient(opts),
 			rotateClientSecret: rotateClientSecret(opts),
+			rotateClientKeys: rotateClientKeys(opts),
 			deleteOAuthClient: deleteOAuthClient(opts),
 			getOAuthConsent: getOAuthConsent(opts),
 			getOAuthConsents: getOAuthConsents(opts),
@@ -5297,6 +5406,11 @@ const oauthProvider = (options) => {
 				window: opts.rateLimit?.register?.window ?? 60,
 				max: opts.rateLimit?.register?.max ?? 5
 			}] : [],
+			...opts.rateLimit?.rotateClientKeys !== false ? [{
+				pathMatcher: (path) => path === "/oauth2/client/rotate-keys",
+				window: opts.rateLimit?.rotateClientKeys?.window ?? 60,
+				max: opts.rateLimit?.rotateClientKeys?.max ?? 5
+			}] : [],
 			...opts.rateLimit?.userinfo !== false ? [{
 				pathMatcher: (path) => path === "/oauth2/userinfo",
 				window: opts.rateLimit?.userinfo?.window ?? 60,
@@ -5606,7 +5720,7 @@ async function authorizeEndpoint(ctx, opts, settings) {
 	if (promptSet?.has("select_account") && !opts.selectAccount?.page) return handleRedirect(ctx, getErrorURL(ctx, `unsupported_prompt_select_account`, "unsupported prompt type"));
 	if (!(query.response_type === "code")) return handleRedirect(ctx, getErrorURL(ctx, "unsupported_response_type", "unsupported response type"));
 	const client = await getClient(ctx, opts, query.client_id);
-	if (!client) return handleRedirect(ctx, getErrorURL(ctx, "invalid_client", "client_id is required"));
+	if (!client) return handleRedirect(ctx, getErrorURL(ctx, "invalid_client", "client not found"));
 	if (client.disabled) return handleRedirect(ctx, getErrorURL(ctx, "client_disabled", "client is disabled"));
 	if (!clientAllowsGrant(client, "authorization_code")) return handleRedirect(ctx, getErrorURL(ctx, "unauthorized_client", "client is not authorized to use the authorization_code grant"));
 	const registeredUris = client.redirectUris ?? [];
@@ -5712,7 +5826,7 @@ async function authorizeEndpoint(ctx, opts, settings) {
 		}
 	}
 	if (promptSet?.has("consent")) return redirectWithPromptCode(ctx, opts, "consent", { sessionId: session.session.id });
-	const referenceId = await opts.postLogin?.consentReferenceId?.({
+	const referenceId = await getConsentReferenceId(opts, {
 		user: session.user,
 		session: session.session,
 		scopes: requestedScopes
@@ -5726,23 +5840,7 @@ async function authorizeEndpoint(ctx, opts, settings) {
 		referenceId,
 		resource: requestedResources
 	});
-	const consent = await ctx.context.adapter.findOne({
-		model: "oauthConsent",
-		where: [
-			{
-				field: "clientId",
-				value: client.clientId
-			},
-			{
-				field: "userId",
-				value: session.user.id
-			},
-			...referenceId ? [{
-				field: "referenceId",
-				value: referenceId
-			}] : []
-		]
-	});
+	const consent = await findConsent(ctx, client.clientId, session.user.id, referenceId);
 	if (!consent || !requestedScopes.every((val) => consent.scopes.includes(val)) || !requestedUserInfoClaims.every((claim) => (consent.requestedUserInfoClaims ?? []).includes(claim))) {
 		if (promptNone) return redirectWithPromptNoneError(ctx, opts, query, "consent_required", "End-User consent is required");
 		return redirectWithPromptCode(ctx, opts, "consent", { sessionId: session.session.id });

package/dist/client-jwks-DY2QBrsl.d.mts

@@ -0,0 +1,25 @@
+import { o as OAuthClient } from "./oauth-DXiqbRzK.mjs";
+import { JSONWebKeySet } from "jose";
+
+//#region src/client-jwks.d.ts
+/** A client's inline public JWK Set, as registration and key rotation accept it. */
+type ClientJwks = NonNullable<OAuthClient["jwks"]>;
+type PublicClientJwksValidationResult = {
+  valid: true;
+  jwks: JSONWebKeySet;
+} | {
+  valid: false;
+  error: "jwks must be an RFC 7517 JWK Set object with a non-empty keys array" | "jwks must contain only public asymmetric keys" | "jwks keys must be supported public JWKs with required key parameters" | "jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve";
+};
+/**
+ * Validates an OAuth client's public asymmetric JWK set.
+ *
+ * This boundary accepts only the RFC 7517 `{ keys: [...] }` representation.
+ * It performs no I/O and returns the validated set for downstream JOSE
+ * verification.
+ *
+ * @internal
+ */
+declare function validatePublicClientJwks(input: unknown): PublicClientJwksValidationResult;
+//#endregion
+export { PublicClientJwksValidationResult as n, validatePublicClientJwks as r, ClientJwks as t };

package/dist/client-resource.d.mts

@@ -1,6 +1,6 @@
-import { c as ResourceServerMetadata } from "./oauth-DAMtT2vg.mjs";
-import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
+import { c as ResourceServerMetadata } from "./oauth-DXiqbRzK.mjs";
 import { JWTPayload, JWTVerifyOptions } from "jose";
+import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { BetterAuthOptions } from "better-auth/types";
 
 //#region src/client-resource.d.ts

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { o as getJwtPlugin, s as getOAuthProviderPlugin } from "./utils-DKU5wblX.mjs";
-import { t as PACKAGE_VERSION } from "./version-DVUrz-nv.mjs";
+import { l as getJwtPlugin, u as getOAuthProviderPlugin } from "./utils-vIo_wPv5.mjs";
+import { t as PACKAGE_VERSION } from "./version-DtVKOwOn.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-BWgg8X-A.mjs";
+import { p as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-ChlxgY8l.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-DVUrz-nv.mjs";
+import { t as PACKAGE_VERSION } from "./version-DtVKOwOn.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-DAMtT2vg.mjs";
-import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-BWgg8X-A.mjs";
+import { A as OAuthOpaqueAccessToken, B as Prompt, C as OAuthClientAuthenticationStrategy, D as OAuthExtensionGrantHandler, E as OAuthConsent, F as OAuthResource, G as VerificationValue, H as Scope, I as OAuthResourceInput, J as ResourceUriSchema, K as ClientRegistrationRequest, L as OAuthTokenIssueParams, M as OAuthProviderApi, N as OAuthProviderExtension, O as OAuthExtensionGrantHandlerInput, P as OAuthRefreshToken, R as OAuthTokenResponse, S as OAuthClientAuthenticationResult, T as OAuthClientResource, U as StoreTokenType, V as SchemaClient, W as StoredAuthorizationQuery, Y as oauthClientMetadataSchema, _ as OAuthAuthorizationQuery, a as GrantType, b as OAuthClientAuthenticationInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, o as OAuthClient, p as ClientDiscovery, q as OAuthClientMetadata, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthClaimExtensionInput, w as OAuthClientRegistrationResponse, x as OAuthClientAuthenticationRequest, y as OAuthClientAdministrativeResponse, z as OAuthUserInfoExtensionInput } from "./oauth-DXiqbRzK.mjs";
+import { a as OAuthEndpointErrorResult, c as OAuthFieldErrorCode, d as DEVICE_CODE_GRANT_TYPE, f as OAuthDeviceAuthorizationOptions, i as getIssuer, l as OAuthFieldErrorCodeMap, n as getOAuthProviderState, o as OAuthEndpointRedirectContext, p as oauthDeviceAuthorization, r as oauthProvider, s as OAuthErrorCode, t as DEFAULT_OAUTH_SCOPES, u as OAuthRedirectOnError } from "./oauth-ChlxgY8l.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { T as oauthClientMetadataSchema, b as ResourceUriSchema, f as extractRepeatedResourceFromForm, i as getOAuthProviderApi, v as resolveResourcePolicy } from "./introspect-7WCMPe5Z.mjs";
-import { D as validateClientScopes, N as extendOAuthProvider, O as verifyOAuthQueryParams, T as toResourceList, a as getClient, f as normalizeClientAuthenticationParameters, s as getOAuthProviderPlugin, w as toAudienceClaim } from "./utils-DKU5wblX.mjs";
-import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-D8r6mvZx.mjs";
+import { E as oauthClientMetadataSchema, i as getOAuthProviderApi, p as extractRepeatedResourceFromForm, x as ResourceUriSchema, y as resolveResourcePolicy } from "./introspect-B-5vOvYK.mjs";
+import { L as extendOAuthProvider, M as verifyOAuthQueryParams, O as toAudienceClaim, g as normalizeClientAuthenticationParameters, j as validateClientScopes, k as toResourceList, s as getClient, u as getOAuthProviderPlugin } from "./utils-vIo_wPv5.mjs";
+import { d as metadataResponse, f as oauthAuthorizationServerMetadata, h as oidcServerMetadata, i as oauthProvider, m as oauthProviderOpenIdConfigMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthProviderAuthServerMetadata, r as getOAuthProviderState, s as consumeClientAssertion, t as getIssuer, u as authServerMetadata } from "./authorize-CtCi8mAs.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-auth/api";
 import * as z from "zod";
@@ -52,14 +52,14 @@ async function exchangeOAuthDeviceCode(input) {
 	const body = ctx.body;
 	const deviceCode = body?.device_code;
 	if (!deviceCode) tokenError("BAD_REQUEST", "invalid_request", "device_code is required");
-	const { authorizationContext: { client, confirmation, scopes }, redemptionContext: resources, user } = await redeemDeviceCode({
+	const authentication = await provider.authenticateClient({ requireCredentials: false });
+	const { authorizationContext: { client, confirmation, scopes }, claimedDeviceCode, redemptionContext: resources, user } = await redeemDeviceCode({
 		ctx,
 		deviceCode,
 		authorizeRedemption: async (record) => {
 			if (!record.oauthClientId) tokenError("BAD_REQUEST", "invalid_grant", "invalid device code");
 			if (body?.client_id && record.oauthClientId !== body.client_id) tokenError("BAD_REQUEST", "invalid_grant", "Client ID mismatch");
 			const scopes = parseScopes(record.scope);
-			const authentication = await provider.authenticateClient({ requireCredentials: false });
 			if (record.oauthClientId !== authentication.client.clientId) tokenError("BAD_REQUEST", "invalid_grant", "Client ID mismatch");
 			validateClientScopes(authentication.client, scopes);
 			return {
@@ -94,6 +94,7 @@ async function exchangeOAuthDeviceCode(input) {
 		scopes,
 		user,
 		resources,
+		originalResources: claimedDeviceCode.resources ?? void 0,
 		confirmation
 	});
 }

package/dist/internal.d.mts

@@ -1,26 +1,7 @@
-import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-DAMtT2vg.mjs";
-import { JSONWebKeySet } from "jose";
+import { H as Scope, V as SchemaClient, j as OAuthOptions, o as OAuthClient } from "./oauth-DXiqbRzK.mjs";
+import { n as PublicClientJwksValidationResult, r as validatePublicClientJwks } from "./client-jwks-DY2QBrsl.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
 
-//#region src/client-jwks.d.ts
-type PublicClientJwksValidationResult = {
-  valid: true;
-  jwks: JSONWebKeySet;
-} | {
-  valid: false;
-  error: "jwks must be an RFC 7517 JWK Set object with a non-empty keys array" | "jwks must contain only public asymmetric keys" | "jwks keys must be supported public JWKs with required key parameters" | "jwks key alg must be supported for private_key_jwt and compatible with its key type and signing curve";
-};
-/**
- * Validates an OAuth client's public asymmetric JWK set.
- *
- * This boundary accepts only the RFC 7517 `{ keys: [...] }` representation.
- * It performs no I/O and returns the validated set for downstream JOSE
- * verification.
- *
- * @internal
- */
-declare function validatePublicClientJwks(input: unknown): PublicClientJwksValidationResult;
-//#endregion
 //#region src/client-metadata.d.ts
 declare function isForbiddenCimdClientMetadataField(field: string): boolean;
 //#endregion

package/dist/internal.mjs

@@ -1,2 +1,2 @@
-import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-D8r6mvZx.mjs";
+import { a as registerClientMetadataDocument, c as isForbiddenCimdClientMetadataField, l as validatePublicClientJwks } from "./authorize-CtCi8mAs.mjs";
 export { isForbiddenCimdClientMetadataField, registerClientMetadataDocument, validatePublicClientJwks };

package/dist/{introspect-7WCMPe5Z.mjs → introspect-B-5vOvYK.mjs}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as collectExtensionAccessTokenClaims, C as storeToken, E as validateClientCredentials, F as getExtensionGrantHandler, L as getSupportedGrantTypes, M as collectExtensionUserInfoClaims, R as hasUserInfoClaimExtension, T as toResourceList, a as getClient, b as resolveSubjectIdentifier, c as getStoredToken, h as parseClientMetadata, i as extractClientCredentials, j as collectExtensionIdTokenClaims, l as isPKCERequired, n as decryptStoredClientSecret, o as getJwtPlugin, p as normalizeTimestampValue, r as destructureCredentials, t as clientAllowsGrant, w as toAudienceClaim, y as resolveSessionAuthTime } from "./utils-DKU5wblX.mjs";
+import { A as validateClientCredentials, C as resolveSessionAuthTime, D as storeToken, F as collectExtensionIdTokenClaims, H as hasUserInfoClaimExtension, I as collectExtensionUserInfoClaims, O as toAudienceClaim, P as collectExtensionAccessTokenClaims, V as getSupportedGrantTypes, _ as normalizeTimestampValue, a as extractClientCredentials, d as getStoredToken, f as isInvalidJwtError, i as destructureCredentials, j as validateClientScopes, k as toResourceList, l as getJwtPlugin, n as clientAllowsGrant, p as isPKCERequired, r as decryptStoredClientSecret, s as getClient, w as resolveSubjectIdentifier, y as parseClientMetadata, z as getExtensionGrantHandler } from "./utils-vIo_wPv5.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";
 import { logger } from "@better-auth/core/env";
 import * as z from "zod";
+import { SignJWT, base64url, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 import { createDpopReplayStore, enforceDpopBinding, generateCodeChallenge, getConfirmationJkt, getDpopJktFromPayload, getJwks, isDpopBindingError, isDpopProofError, parseAccessTokenAuthorization, stripAccessTokenAuthorizationScheme, verifyDpopProof } from "better-auth/oauth2";
-import { SignJWT, base64url, createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 import { SafeUrlSchema } from "@better-auth/core/utils/redirect-uri";
 import { resolveSigningKey, signJWT, toExpJWT } from "better-auth/plugins";
 //#region src/authentication-context.ts
@@ -1084,14 +1084,21 @@ function getDpopProofJwt(ctx) {
 	return ctx.headers?.get("dpop") ?? void 0;
 }
 /**
-* The endpoint's public URL, built from `baseURL`, which clients use as the
-* DPoP `htu`. Not `request.url`: proxies and dev servers can rewrite its host.
+* The endpoint's public URL, which clients use as the DPoP `htu`: the origin
+* and base path of `baseURL` (not `request.url`, whose host proxies and dev
+* servers can rewrite) plus the request's own path below the base path, so
+* route params and a trailing slash match what the client called. `path` is
+* used when there is no HTTP request, such as an `auth.api` call.
 */
 function getEndpointUrl(ctx, path) {
 	const { baseURL } = ctx.context;
 	let end = baseURL.length;
 	while (end > 0 && baseURL[end - 1] === "/") end--;
-	return `${baseURL.slice(0, end)}${path}`;
+	const base = baseURL.slice(0, end);
+	if (!ctx.request || !base) return `${base}${path}`;
+	const basePath = new URL(base).pathname.replace(/\/$/, "");
+	const requestPath = new URL(ctx.request.url).pathname;
+	return `${base}${requestPath.startsWith(`${basePath}/`) ? requestPath.slice(basePath.length) : path}`;
 }
 //#endregion
 //#region src/oauthClient/client-credentials.ts
@@ -1971,6 +1978,10 @@ async function handleAuthorizationCodeGrant(ctx, opts) {
 		error_description: "Either code_verifier or client_secret is required",
 		error: "invalid_request"
 	});
+	/** Verify Client (RFC 6749 §5.2: an unknown or unauthenticated client is
+	* `invalid_client`, so resolve it before the code lookup can report
+	* `invalid_grant` and before a one-time code is consumed). */
+	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, void 0, preVerified, "authorization_code", authMethod);
 	/** Get and check Verification Value */
 	const { verificationValue, effectiveResources, authorizedResources, authorizationCodeId } = await checkVerificationValue(ctx, opts, code, client_id, redirect_uri, resources);
 	const scopes = verificationValue.query.scope?.split(" ");
@@ -1978,8 +1989,7 @@ async function handleAuthorizationCodeGrant(ctx, opts) {
 		error_description: "verification scope unset",
 		error: "invalid_scope"
 	});
-	/** Verify Client */
-	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, scopes, preVerified, "authorization_code", authMethod);
+	validateClientScopes(client, scopes);
 	if (isPKCERequired(client, {
 		scopes: (verificationValue.query?.scope)?.split(" ") || [],
 		nonce: verificationValue.query?.nonce
@@ -1996,17 +2006,17 @@ async function handleAuthorizationCodeGrant(ctx, opts) {
 	const pkceUsedInAuth = !!verificationValue.query?.code_challenge;
 	const pkceUsedInToken = !!code_verifier;
 	if (pkceUsedInAuth || pkceUsedInToken) {
-		if (pkceUsedInAuth && !pkceUsedInToken) throw new APIError("UNAUTHORIZED", {
+		if (pkceUsedInAuth && !pkceUsedInToken) throw new APIError("BAD_REQUEST", {
 			error_description: "code_verifier required because PKCE was used in authorization",
 			error: "invalid_request"
 		});
-		if (!pkceUsedInAuth && pkceUsedInToken) throw new APIError("UNAUTHORIZED", {
+		if (!pkceUsedInAuth && pkceUsedInToken) throw new APIError("BAD_REQUEST", {
 			error_description: "code_verifier provided but PKCE was not used in authorization",
 			error: "invalid_request"
 		});
-		if ((verificationValue.query?.code_challenge_method === "S256" ? await generateCodeChallenge(code_verifier) : void 0) !== verificationValue.query?.code_challenge) throw new APIError("UNAUTHORIZED", {
+		if ((verificationValue.query?.code_challenge_method === "S256" ? await generateCodeChallenge(code_verifier) : void 0) !== verificationValue.query?.code_challenge) throw new APIError("BAD_REQUEST", {
 			error_description: "code verification failed",
-			error: "invalid_request"
+			error: "invalid_grant"
 		});
 	}
 	/** Get user */
@@ -2109,6 +2119,10 @@ async function handleRefreshTokenGrant(ctx, opts) {
 		error_description: "Missing a required refresh_token for refresh_token grant",
 		error: "invalid_request"
 	});
+	/** Verify Client (RFC 6749 §5.2: an unknown or unauthenticated client is
+	* `invalid_client`, so resolve it before the refresh token lookup can
+	* report `invalid_grant`). */
+	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, void 0, preVerified, "refresh_token", authMethod);
 	const decodedRefresh = await decodeRefreshToken(opts, refresh_token);
 	const refreshToken = await ctx.context.adapter.findOne({
 		model: "oauthRefreshToken",
@@ -2142,7 +2156,7 @@ async function handleRefreshTokenGrant(ctx, opts) {
 			error: "invalid_scope"
 		});
 	}
-	const client = await validateClientCredentials(ctx, opts, client_id, client_secret, requestedScopes ?? scopes, preVerified, "refresh_token", authMethod);
+	validateClientScopes(client, requestedScopes ?? scopes);
 	if (refreshToken.revoked) {
 		if (isWithinRefreshTokenReuseInterval(refreshToken)) {
 			const replay = await getRefreshTokenRotationReplay(ctx, refreshToken, await resolveRefreshTokenRotationReplayRequest(ctx, opts, {
@@ -2235,29 +2249,29 @@ async function isIntrospectionAuthorized(ctx, opts, params) {
 * @returns RFC7662 introspection format
 */
 async function validateJwtAccessToken(ctx, opts, token, clientId) {
-	const jwtPlugin = opts.disableJwtPlugin ? void 0 : getJwtPlugin(ctx.context);
-	const jwtPluginOptions = jwtPlugin?.options;
+	if (opts.disableJwtPlugin) throw new APIError$1("BAD_REQUEST", {
+		error_description: "JWT access tokens are disabled",
+		error: "invalid_request"
+	});
+	const jwtPlugin = getJwtPlugin(ctx.context);
+	const jwtPluginOptions = jwtPlugin.options;
 	const userInfoAud = `${ctx.context.baseURL ?? ""}/oauth2/userinfo`;
 	const expectedIssuer = jwtPluginOptions?.jwt?.issuer ?? ctx.context.baseURL;
 	let jwtPayload;
 	try {
 		jwtPayload = (await jwtVerify(token, createLocalJWKSet(await getJwks(token, {
 			jwksFetch: jwtPluginOptions?.jwks?.remoteUrl ? jwtPluginOptions.jwks.remoteUrl : async () => {
-				return (await jwtPlugin?.endpoints.getJwks(ctx))?.response;
+				return (await jwtPlugin.endpoints.getJwks(ctx))?.response;
 			},
 			jwksCacheKey: jwtPlugin
 		})), { issuer: expectedIssuer })).payload;
 	} catch (error) {
-		if (error instanceof Error) {
-			if (error.name === "TypeError" || error.name === "JWSInvalid") throw new APIError$1("BAD_REQUEST", {
-				error_description: "invalid JWT signature",
-				error: "invalid_request"
-			});
-			else if (error.name === "JWTExpired") return { active: false };
-			else if (error.name === "JWTInvalid") return { active: false };
-			throw error;
-		}
-		throw new Error(error);
+		if (error instanceof errors.JWTExpired || error instanceof errors.JWTInvalid) return { active: false };
+		if (error instanceof TypeError || isInvalidJwtError(error)) throw new APIError$1("BAD_REQUEST", {
+			error_description: "invalid JWT signature",
+			error: "invalid_request"
+		});
+		throw error;
 	}
 	const rawAud = jwtPayload.aud;
 	if (!await isAudienceClaimAllowed(ctx, opts, rawAud, [userInfoAud])) return { active: false };
@@ -2548,4 +2562,4 @@ async function introspectEndpoint(ctx, opts) {
 	}
 }
 //#endregion
-export { claimsRequestParameterSchema as A, clientJwksSchema as C, STANDARD_CLAIM_NAMES as D, STANDARD_CLAIMS as E, getRequestedUserInfoClaims as M, isValidOidcClaimsRequest as N, getSupportedClaims as O, authorizationQuerySchema as S, oauthClientMetadataSchema as T, logStartupSeedFailure as _, invalidateRefreshFamily as a, ResourceUriSchema as b, normalizeClientCredentialsScopes as c, assertIdentifierValid as d, extractRepeatedResourceFromForm as f, logEnforcePerClientResourcesResolution as g, isAudienceClaimAllowed as h, getOAuthProviderApi as i, filterClaimsRequestUserInfoClaims as j, canSatisfyEssentialAcrRequest as k, validateClientCredentialsScopes as l, invalidateResourceCache as m, introspect_exports as n, tokenEndpoint as o, getResource as p, decodeRefreshToken as r, userInfoEndpoint as s, introspectEndpoint as t, JWS_ALGORITHMS as u, resolveResourcePolicy as v, clientRegistrationRequestSchema as w, SafeUrlSchema as x, seedResourcesOnce as y };
+export { canSatisfyEssentialAcrRequest as A, authorizationQuerySchema as C, STANDARD_CLAIMS as D, oauthClientMetadataSchema as E, filterClaimsRequestUserInfoClaims as M, getRequestedUserInfoClaims as N, STANDARD_CLAIM_NAMES as O, isValidOidcClaimsRequest as P, SafeUrlSchema as S, clientRegistrationRequestSchema as T, logEnforcePerClientResourcesResolution as _, invalidateRefreshFamily as a, seedResourcesOnce as b, normalizeClientCredentialsScopes as c, JWS_ALGORITHMS as d, assertIdentifierValid as f, isAudienceClaimAllowed as g, invalidateResourceCache as h, getOAuthProviderApi as i, claimsRequestParameterSchema as j, getSupportedClaims as k, validateClientCredentialsScopes as l, getResource as m, introspect_exports as n, tokenEndpoint as o, extractRepeatedResourceFromForm as p, decodeRefreshToken as r, userInfoEndpoint as s, introspectEndpoint as t, getEndpointUrl as u, logStartupSeedFailure as v, clientJwksSchema as w, ResourceUriSchema as x, resolveResourcePolicy as y };

package/dist/{oauth-BWgg8X-A.d.mts → oauth-ChlxgY8l.d.mts}

@@ -1,4 +1,5 @@
-import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-DAMtT2vg.mjs";
+import { B as Prompt, E as OAuthConsent, F as OAuthResource, H as Scope, O as OAuthExtensionGrantHandlerInput, R as OAuthTokenResponse, a as GrantType, j as OAuthOptions, k as OAuthMetadataExtensionInput, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, u as TokenType, w as OAuthClientRegistrationResponse, y as OAuthClientAdministrativeResponse } from "./oauth-DXiqbRzK.mjs";
+import { t as ClientJwks } from "./client-jwks-DY2QBrsl.mjs";
 import * as _$better_call0 from "better-call";
 import * as z from "zod";
 import * as _$jose from "jose";
@@ -919,7 +920,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                   schema: {
                     type: "object";
                     properties: {
-                      redirect_uri: {
+                      redirect: {
+                        type: string;
+                        description: string;
+                        enum: boolean[];
+                      };
+                      url: {
                         type: string;
                         format: string;
                         description: string;
@@ -979,7 +985,12 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
                   schema: {
                     type: "object";
                     properties: {
-                      redirect_uri: {
+                      redirect: {
+                        type: string;
+                        description: string;
+                        enum: boolean[];
+                      };
+                      url: {
                         type: string;
                         format: string;
                         description: string;
@@ -2386,6 +2397,30 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
         };
       };
     }, OAuthClient>;
+    rotateClientKeys: _$better_call0.StrictEndpoint<"/oauth2/client/rotate-keys", {
+      method: "POST";
+      body: z.ZodObject<{
+        client_assertion: z.ZodString;
+        client_assertion_type: z.ZodString;
+        jwks: z.ZodObject<{
+          keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>;
+      }, z.core.$strip>;
+      errorCodesByField: {
+        client_assertion: "invalid_client";
+        client_assertion_type: "invalid_client";
+        jwks: "invalid_client_metadata";
+      };
+      metadata: {
+        noStore: boolean;
+        openapi: {
+          description: string;
+        };
+      };
+    }, {
+      client_id: string;
+      jwks: ClientJwks;
+    }>;
     deleteOAuthClient: _$better_call0.StrictEndpoint<"/oauth2/delete-client", {
       method: "POST";
       use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
@@ -3144,6 +3179,10 @@ declare const oauthProvider: <O extends OAuthOptions<Scope[]>>(options: O) => {
     pathMatcher: (path: string) => path is "/oauth2/register";
     window: number;
     max: number;
+  } | {
+    pathMatcher: (path: string) => path is "/oauth2/client/rotate-keys";
+    window: number;
+    max: number;
   } | {
     pathMatcher: (path: string) => path is "/oauth2/userinfo";
     window: number;

package/dist/{oauth-DAMtT2vg.d.mts → oauth-DXiqbRzK.d.mts}

@@ -1316,6 +1316,21 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * @default 300 (5 minutes)
    */
   assertionMaxLifetime?: number;
+  /**
+   * Lets a confidential `private_key_jwt` client replace its own inline `jwks`
+   * at `POST /oauth2/client/rotate-keys`, authenticated by a client assertion
+   * signed with one of its current keys. No user session is involved.
+   *
+   * Clients that publish their keys at a `jwks_uri` rotate them there, so they
+   * cannot use this endpoint.
+   *
+   * Each rotation assertion must be single-use, so the provider refuses to
+   * start with this enabled on the memory adapter or with
+   * `advanced.database.generateId: "serial"`, neither of which enforces it.
+   *
+   * @default false
+   */
+  allowClientKeyRotation?: boolean;
   /**
    * Allows /oauth2/public-client-prelogin endpoint to be
    * requestable prior to login via a valid oauth_query.
@@ -1434,14 +1449,16 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    * field.
    *
    * - `"web"`: the OIDC Registration §2 default. Omitted `application_type` is
-   *   treated as `web`, so custom-scheme redirect URIs are rejected.
+   *   treated as `web`, so custom-scheme and loopback redirect URIs are
+   *   rejected.
    * - `"native"`: omitted `application_type` is treated as `native`.
    * - `"infer"`: omitted `application_type` is treated as `native` when any
-   *   `redirect_uris` entry uses a non-http(s) scheme; otherwise `web`. Every
-   *   redirect URI is then validated against the native rules. Lets native MCP
-   *   clients that omit `application_type` (for example Cursor, which also
-   *   registers https and loopback callbacks) register without loosening
-   *   web-client redirect policy.
+   *   `redirect_uris` entry uses a non-http(s) scheme or is `http` on
+   *   `localhost`, `127.0.0.1`, or `[::1]`; otherwise `web`. Every redirect URI
+   *   of an inferred native client is then validated against the native rules.
+   *   Lets native MCP clients that omit `application_type` (for example Cursor,
+   *   or older Claude Code releases with an `http://127.0.0.1` callback)
+   *   register without loosening web-client redirect policy.
    *
    * An `application_type` the client actually sends is never overridden.
    * Applies only to dynamic client registration; managed clients and Client ID
@@ -1626,7 +1643,8 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
      */
     page: string;
     /**
-     * A value to tie to the consent reference_id.
+     * A value to tie to the consent reference_id. Consent is stored
+     * per reference; `undefined` or `""` uses consent given without one.
      *
      * Note that YOU must fail in this function if the requested
      * scope doesn't have a reference id and it should.
@@ -1937,6 +1955,7 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
    *   introspect: { window: 60, max: 100 },
    *   revoke: { window: 60, max: 30 },
    *   register: { window: 60, max: 5 },
+   *   rotateClientKeys: { window: 60, max: 5 },
    *   userinfo: { window: 60, max: 60 },
    * }
    * ```
@@ -1982,6 +2001,14 @@ interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScop
       window: number;
       max: number;
     } | false;
+    /**
+     * Rate limit for /oauth2/client/rotate-keys endpoint
+     * @default { window: 60, max: 5 }
+     */
+    rotateClientKeys?: {
+      window: number;
+      max: number;
+    } | false;
     /**
      * Rate limit for /oauth2/userinfo endpoint
      * @default { window: 60, max: 60 }

package/dist/{utils-DKU5wblX.mjs → utils-vIo_wPv5.mjs}

@@ -6,6 +6,7 @@ import { BetterAuthError } from "@better-auth/core/error";
 import { CLIENT_ASSERTION_TYPE, decodeBasicCredentials } from "@better-auth/core/oauth2";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
+import { errors } from "jose";
 //#region src/extensions.ts
 const DEFAULT_GRANT_TYPES = [
 	"authorization_code",
@@ -294,6 +295,21 @@ const getJwtPlugin = (ctx) => {
 	if (!plugin) throw new BetterAuthError("jwt_config");
 	return plugin;
 };
+const joseInfrastructureErrorCodes = new Set([
+	errors.JWKSTimeout.code,
+	errors.JWKSInvalid.code,
+	errors.JWKSMultipleMatchingKeys.code
+]);
+/**
+* Whether a JWT verification error comes from the token itself (malformed,
+* bad signature, unsupported alg, unknown kid, failed claim checks), as
+* opposed to a key set failure that should still surface as a server error.
+*
+* @internal
+*/
+function isInvalidJwtError(error) {
+	return error instanceof errors.JOSEError && !joseInfrastructureErrorCodes.has(error.code);
+}
 /**
 * Normalizes timestamp-like values returned by adapters.
 *
@@ -371,6 +387,16 @@ async function verifyOAuthQueryParams(oauth_query, secret) {
 	return sigs.length === 1 && !!sig && constantTimeEqual(sig, verifySig) && /* @__PURE__ */ new Date(exp * 1e3) >= /* @__PURE__ */ new Date();
 }
 /**
+* Rejects changes to a client listed in `cachedTrustedClients`. Cached trusted
+* clients are immutable through the client management endpoints.
+*/
+function assertNotTrustedClient(opts, clientId) {
+	if (opts.cachedTrustedClients?.has(clientId)) throw new APIError("BAD_REQUEST", {
+		error: "invalid_client",
+		error_description: "trusted clients must be updated manually"
+	});
+}
+/**
 * Get a client by ID, checking trusted clients first, then database
 */
 async function getClient(ctx, options, clientId) {
@@ -640,7 +666,7 @@ function throwInvalidClient(errorDescription, authentication) {
 */
 async function validateClientCredentials(ctx, options, clientId, clientSecret, scopes, preVerified, grantType, authMethod) {
 	const client = await getClient(ctx, options, clientId);
-	if (!client) throwInvalidClient("missing client", { method: authMethod });
+	if (!client) throwInvalidClient("client not found", { method: authMethod });
 	if (client.disabled) throwInvalidClient("client is disabled", { method: authMethod });
 	const registeredAuthMethod = client.tokenEndpointAuthMethod ?? "client_secret_basic";
 	if (authMethod && registeredAuthMethod !== authMethod) throwInvalidClient(`client registered for ${registeredAuthMethod} cannot use ${authMethod}`, { method: authMethod });
@@ -712,7 +738,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-D8r6mvZx.mjs").then((n) => n.o);
+		const { verifyClientAssertion: verify } = await import("./authorize-CtCi8mAs.mjs").then((n) => n.o);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",
@@ -791,6 +817,51 @@ async function resolveSubjectIdentifier(userId, client, opts) {
 	return userId;
 }
 /**
+* Resolves `postLogin.consentReferenceId`, treating an empty value as no reference.
+*
+* @internal
+*/
+async function getConsentReferenceId(opts, context) {
+	return await opts.postLogin?.consentReferenceId?.(context) || void 0;
+}
+/**
+* Finds the consent stored for exactly this reference. Without a reference,
+* only consent stored without one (missing, null, or empty) matches.
+*
+* @internal
+*/
+async function findConsent(ctx, clientId, userId, referenceId) {
+	const where = [{
+		field: "clientId",
+		value: clientId
+	}, {
+		field: "userId",
+		value: userId
+	}];
+	if (referenceId) return ctx.context.adapter.findOne({
+		model: "oauthConsent",
+		where: [...where, {
+			field: "referenceId",
+			value: referenceId
+		}]
+	});
+	const pageSize = 100;
+	for (let offset = 0;; offset += pageSize) {
+		const consents = await ctx.context.adapter.findMany({
+			model: "oauthConsent",
+			where,
+			limit: pageSize,
+			offset,
+			sortBy: {
+				field: "id",
+				direction: "asc"
+			}
+		});
+		const consent = consents.find((row) => !row.referenceId);
+		if (consent || consents.length < pageSize) return consent ?? null;
+	}
+}
+/**
 * Converts URLSearchParams to a plain object, preserving
 * multi-valued keys as arrays instead of discarding duplicates.
 */
@@ -849,4 +920,4 @@ function isPKCERequired(client, request) {
 	return false;
 }
 //#endregion
-export { collectExtensionAccessTokenClaims as A, validateOAuthProviderExtensions as B, storeToken as C, validateClientScopes as D, validateClientCredentials as E, getExtensionGrantHandler as F, getSupportedAuthMethods as I, getSupportedGrantTypes as L, collectExtensionUserInfoClaims as M, extendOAuthProvider as N, verifyOAuthQueryParams as O, getClientDiscoveries as P, hasUserInfoClaimExtension as R, storeClientSecret as S, toResourceList as T, removeMaxAgeFromQuery as _, getClient as a, resolveSubjectIdentifier as b, getStoredToken as c, mergeDiscoveryMetadata as d, normalizeClientAuthenticationParameters as f, parsePrompt as g, parseClientMetadata as h, extractClientCredentials as i, collectExtensionIdTokenClaims as j, applyOAuthProviderMetadataExtensions as k, isPKCERequired as l, parseBearerToken as m, decryptStoredClientSecret as n, getJwtPlugin as o, normalizeTimestampValue as p, destructureCredentials as r, getOAuthProviderPlugin as s, clientAllowsGrant as t, isSessionFreshForSignedQuery as u, removePromptFromQuery as v, toAudienceClaim as w, searchParamsToQuery as x, resolveSessionAuthTime as y, isExtensionTokenEndpointAuthMethod as z };
+export { validateClientCredentials as A, getSupportedAuthMethods as B, resolveSessionAuthTime as C, storeToken as D, storeClientSecret as E, collectExtensionIdTokenClaims as F, hasUserInfoClaimExtension as H, collectExtensionUserInfoClaims as I, extendOAuthProvider as L, verifyOAuthQueryParams as M, applyOAuthProviderMetadataExtensions as N, toAudienceClaim as O, collectExtensionAccessTokenClaims as P, getClientDiscoveries as R, removePromptFromQuery as S, searchParamsToQuery as T, isExtensionTokenEndpointAuthMethod as U, getSupportedGrantTypes as V, validateOAuthProviderExtensions as W, normalizeTimestampValue as _, extractClientCredentials as a, parsePrompt as b, getConsentReferenceId as c, getStoredToken as d, isInvalidJwtError as f, normalizeClientAuthenticationParameters as g, mergeDiscoveryMetadata as h, destructureCredentials as i, validateClientScopes as j, toResourceList as k, getJwtPlugin as l, isSessionFreshForSignedQuery as m, clientAllowsGrant as n, findConsent as o, isPKCERequired as p, decryptStoredClientSecret as r, getClient as s, assertNotTrustedClient as t, getOAuthProviderPlugin as u, parseBearerToken as v, resolveSubjectIdentifier as w, removeMaxAgeFromQuery as x, parseClientMetadata as y, getExtensionGrantHandler as z };

package/dist/{version-DVUrz-nv.mjs → version-DtVKOwOn.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.7.9";
+const PACKAGE_VERSION = "1.7.11";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.7.9",
+  "version": "1.7.11",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.7.9",
-    "@better-auth/memory-adapter": "1.7.9",
-    "better-auth": "1.7.9"
+    "@better-auth/core": "1.7.11",
+    "@better-auth/memory-adapter": "1.7.11",
+    "better-auth": "1.7.11"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "better-call": "1.4.2",
-    "@better-auth/core": "^1.7.9",
-    "better-auth": "^1.7.9"
+    "@better-auth/core": "^1.7.11",
+    "better-auth": "^1.7.11"
   },
   "scripts": {
     "build": "tsdown",