@better-auth/oauth-provider 1.8.0-beta.0 → 1.8.0-beta.1

package/dist/{authorize-92EtLsBi.mjs → authorize-Dg976Ug0.mjs}

@@ -1,8 +1,8 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { A as getAcrValuesSupported, C as authorizationQuerySchema, D as STANDARD_CLAIMS, F as getRequestedUserInfoClaims, I as isValidOidcClaimsRequest, M as canSatisfyEssentialAcrRequest, N as claimsRequestParameterSchema, O as STANDARD_CLAIM_NAMES, P as filterClaimsRequestUserInfoClaims, S as SafeUrlSchema, T as clientRegistrationRequestSchema, _ as logStartupSeedFailure, a as tokenEndpoint, b as userInfoResource, c as normalizeClientCredentialsScopes, d as JWS_ALGORITHMS, f as assertIdentifierValid, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, i as invalidateRefreshFamily, j as resolveAuthenticationContext, k as getSupportedClaims, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as userInfoEndpoint, p as getResource, s as findToken, t as introspectEndpoint, u as getEndpointUrl, v as resolveResourcePolicy, w as clientJwksSchema, x as ResourceUriSchema, y as seedResourcesOnce } from "./introspect-CEo9Q06v.mjs";
-import { $ as validateOAuthProviderExtensions, A as storeClientSecret, E as removePromptFromQuery, F as validateClientCredentials, J as getSupportedGrantTypes, K as getExtensionInteractionRequest, L as verifyOAuthQueryParams, N as toResourceList, O as resolveSubjectIdentifier, Q as validateExtensionClientMetadata, R as applyOAuthProviderMetadataExtensions, S as parsePrompt, T as removeMaxAgeFromQuery, U as getClientDiscoveries, W as getExtensionClientMetadataFields, Y as hasExtensionClientMetadata, Z as isExtensionTokenEndpointAuthMethod, _ as mergeDiscoveryMetadata, a as decryptStoredClientSecret, b as parseBearerToken, c as extractClientCredentials, d as getConsentReferenceId, f as getJwtPlugin, g as isSessionFreshForSignedQuery, h as isPKCERequired, i as consentCovers, j as storeToken, k as searchParamsToQuery, l as findConsent, n as assertNotTrustedClient, o as deriveSectorIdentifier, q as getSupportedAuthMethods, r as clientAllowsGrant, s as destructureCredentials, t as applyFormParams, tt as stripReservedOAuthClientMetadataExtensions, u as getClient, w as readFormParams, x as parseClientMetadata } from "./utils-BMNe8Sg2.mjs";
+import { A as getAcrValuesSupported, C as authorizationQuerySchema, D as STANDARD_CLAIMS, F as getRequestedUserInfoClaims, I as isValidOidcClaimsRequest, M as canSatisfyEssentialAcrRequest, N as claimsRequestParameterSchema, O as STANDARD_CLAIM_NAMES, P as filterClaimsRequestUserInfoClaims, S as SafeUrlSchema, T as clientRegistrationRequestSchema, _ as logStartupSeedFailure, a as tokenEndpoint, b as userInfoResource, c as normalizeClientCredentialsScopes, d as JWS_ALGORITHMS, f as assertIdentifierValid, g as logEnforcePerClientResourcesResolution, h as isAudienceClaimAllowed, i as invalidateRefreshFamily, j as resolveAuthenticationContext, k as getSupportedClaims, l as validateClientCredentialsScopes, m as invalidateResourceCache, o as userInfoEndpoint, p as getResource, s as findToken, t as introspectEndpoint, u as getEndpointUrl, v as resolveResourcePolicy, w as clientJwksSchema, x as ResourceUriSchema, y as seedResourcesOnce } from "./introspect-DdmCPEHN.mjs";
+import { $ as validateOAuthProviderExtensions, A as storeClientSecret, E as removePromptFromQuery, F as validateClientCredentials, J as getSupportedGrantTypes, K as getExtensionInteractionRequest, L as verifyOAuthQueryParams, N as toResourceList, O as resolveSubjectIdentifier, Q as validateExtensionClientMetadata, R as applyOAuthProviderMetadataExtensions, S as parsePrompt, T as removeMaxAgeFromQuery, U as getClientDiscoveries, W as getExtensionClientMetadataFields, Y as hasExtensionClientMetadata, Z as isExtensionTokenEndpointAuthMethod, _ as mergeDiscoveryMetadata, a as decryptStoredClientSecret, b as parseBearerToken, c as extractClientCredentials, d as getConsentReferenceId, f as getJwtPlugin, g as isSessionFreshForSignedQuery, h as isPKCERequired, i as consentCovers, j as storeToken, k as searchParamsToQuery, l as findConsent, n as assertNotTrustedClient, o as deriveSectorIdentifier, q as getSupportedAuthMethods, r as clientAllowsGrant, s as destructureCredentials, t as applyFormParams, tt as stripReservedOAuthClientMetadataExtensions, u as getClient, w as readFormParams, x as parseClientMetadata } from "./utils-D-CUrvd1.mjs";
 import { a as setSignedOAuthQueryParameterNames, i as postLoginClearedParam, n as canonicalizeOAuthQueryParams, o as signedQueryIssuedAtParam, r as getSignedQueryIssuedAt } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-DeABnmP9.mjs";
+import { t as PACKAGE_VERSION } from "./version-BwHks7Wg.mjs";
 import { isBrowserFetchRequest } from "@better-auth/core/utils/fetch-metadata";
 import { isLoopbackHost, isLoopbackIP, isPublicRoutableHost } from "@better-auth/core/utils/host";
 import { appendQueryParams } from "@better-auth/core/utils/url";
@@ -1882,6 +1882,8 @@ async function registerEndpoint(ctx, opts) {
 		user: session.user,
 		session: session.session
 	}) : void 0);
+	const clientCredentialsScopes = normalizeClientCredentialsScopes(tokenAuthorization?.clientCredentialsScopes ?? []);
+	validateClientCredentialsScopes(clientCredentialsScopes, resolveRegistrationGrantTypes(registrationMetadata), registrationMetadata.token_endpoint_auth_method, opts);
 	const response = await createOAuthClientRegistration(ctx, opts, {
 		metadata: {
 			...registrationMetadata,
@@ -1890,7 +1892,8 @@ async function registerEndpoint(ctx, opts) {
 		registrationSource: "dynamic",
 		userId: referenceId ? void 0 : session?.session.userId,
 		referenceId,
-		requestedResources
+		requestedResources,
+		clientCredentialsScopes
 	});
 	ctx.setStatus(201);
 	return ctx.json(response);
@@ -2106,7 +2109,7 @@ async function persistOAuthClientRegistration(ctx, opts, input) {
 		user_id: owner?.referenceId ? void 0 : owner?.userId,
 		reference_id: owner?.referenceId
 	});
-	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.registrationSource === "managed" ? input.clientCredentialsScopes ?? [] : [];
+	schema.clientCredentialsScopes = input.registrationSource === "clientMetadataDocument" ? input.existingClient?.clientCredentialsScopes ?? [] : input.clientCredentialsScopes ?? [];
 	schema.clientDiscoveryId = input.registrationSource === "clientMetadataDocument" ? input.clientDiscoveryId : null;
 	schema.sectorIdentifier = deriveSectorIdentifier(clientId, body.redirect_uris);
 	if (input.registrationSource === "clientMetadataDocument" && body.application_type === void 0) schema.applicationType = null;

package/dist/client-resource.d.mts

@@ -1,4 +1,4 @@
-import { c as ResourceServerMetadata } from "./oauth-BlEuA8oD.mjs";
+import { c as ResourceServerMetadata } from "./oauth-CzT1PvAY.mjs";
 import { ResourceRequestInput, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";

package/dist/client-resource.mjs

@@ -1,5 +1,5 @@
-import { f as getJwtPlugin, p as getOAuthProviderPlugin } from "./utils-BMNe8Sg2.mjs";
-import { t as PACKAGE_VERSION } from "./version-DeABnmP9.mjs";
+import { f as getJwtPlugin, p as getOAuthProviderPlugin } from "./utils-D-CUrvd1.mjs";
+import { t as PACKAGE_VERSION } from "./version-BwHks7Wg.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { APIError } from "better-call";
 import { BetterAuthError } from "@better-auth/core/error";

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { g as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-mdkaIwmm.mjs";
+import { g as oauthDeviceAuthorization, r as oauthProvider } from "./oauth-DfH-ghKj.mjs";
 import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
 
 //#region src/client.d.ts

package/dist/client.mjs

@@ -1,5 +1,5 @@
 import { t as buildSignedOAuthQuery } from "./signed-query-Df1MNiSH.mjs";
-import { t as PACKAGE_VERSION } from "./version-DeABnmP9.mjs";
+import { t as PACKAGE_VERSION } from "./version-BwHks7Wg.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { deviceAuthorizationClient } from "better-auth/client/plugins";
 //#region src/client.ts

package/dist/{index-sGnh4IfY.d.mts → index-DVydGHlT.d.mts}

@@ -1,4 +1,4 @@
-import { J as Scope, K as Prompt, L as OAuthOptions, R as OAuthProviderApi, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, q as SchemaClient, rt as Awaitable, z as OAuthProviderExtension } from "./oauth-BlEuA8oD.mjs";
+import { J as Scope, K as Prompt, L as OAuthOptions, R as OAuthProviderApi, a as GrantType, l as TokenEndpointAuthMethod, n as AuthServerMetadata, q as SchemaClient, rt as Awaitable, z as OAuthProviderExtension } from "./oauth-CzT1PvAY.mjs";
 import { APIError } from "better-call";
 import { JWSAlgorithms, JwtOptions } from "better-auth/plugins";
 import { JWTPayload } from "jose";

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as OAuthClientMetadata, A as OAuthExtensionGrantHandler, B as OAuthRefreshToken, C as OAuthClientAuthenticationRequest, D as OAuthClientRegistrationResponse, E as OAuthClientMetadataExtensionInput, F as OAuthMetadataExtensionInput, G as OAuthUserInfoExtensionInput, H as OAuthResourceInput, I as OAuthOpaqueAccessToken, J as Scope, K as Prompt, L as OAuthOptions, M as OAuthInteractionQuery, N as OAuthInteractionRequest, O as OAuthClientResource, P as OAuthInteractionRequestHandler, Q as ClientRegistrationRequest, R as OAuthProviderApi, S as OAuthClientAuthenticationInput, T as OAuthClientAuthenticationStrategy, U as OAuthTokenIssueParams, V as OAuthResource, W as OAuthTokenResponse, X as StoredAuthorizationQuery, Y as StoreTokenType, Z as VerificationValue, _ as OAuthAuthenticationContext, a as GrantType, b as OAuthClaimExtensionInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, et as ResourceUriSchema, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, it as OAuthClientRegistrationMetadata, j as OAuthExtensionGrantHandlerInput, k as OAuthConsent, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, nt as oauthClientMetadataSchema, o as OAuthClient, p as ClientDiscovery, q as SchemaClient, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthAuthenticationContextOptions, w as OAuthClientAuthenticationResult, x as OAuthClientAdministrativeResponse, y as OAuthAuthorizationQuery, z as OAuthProviderExtension } from "./oauth-BlEuA8oD.mjs";
-import { c as OAuthEndpointRedirectContext, d as OAuthFieldErrorCodeMap, f as OAuthRedirectOnError, g as oauthDeviceAuthorization, h as OAuthDeviceAuthorizationOptions, l as OAuthErrorCode, m as DEVICE_CODE_GRANT_TYPE, n as getOAuthProviderState, o as getIssuer, r as oauthProvider, s as OAuthEndpointErrorResult, t as DEFAULT_OAUTH_SCOPES, u as OAuthFieldErrorCode } from "./oauth-mdkaIwmm.mjs";
-import { _ as oauthProviderOpenIdConfigMetadata, a as verifyOAuthQueryParams, c as OAuthTokenExchangeRequest, d as getOAuthProviderApi, f as createResourceServerChallenge, g as oauthProviderAuthServerMetadata, h as oauthAuthorizationServerMetadata, l as TOKEN_EXCHANGE_GRANT_TYPE, m as metadataResponse, o as ACCESS_TOKEN_TYPE, p as authServerMetadata, s as OAuthTokenExchangeOptions, t as consumeClientAssertion, u as oauthTokenExchange, v as oidcServerMetadata, y as extendOAuthProvider } from "./index-sGnh4IfY.mjs";
+import { $ as OAuthClientMetadata, A as OAuthExtensionGrantHandler, B as OAuthRefreshToken, C as OAuthClientAuthenticationRequest, D as OAuthClientRegistrationResponse, E as OAuthClientMetadataExtensionInput, F as OAuthMetadataExtensionInput, G as OAuthUserInfoExtensionInput, H as OAuthResourceInput, I as OAuthOpaqueAccessToken, J as Scope, K as Prompt, L as OAuthOptions, M as OAuthInteractionQuery, N as OAuthInteractionRequest, O as OAuthClientResource, P as OAuthInteractionRequestHandler, Q as ClientRegistrationRequest, R as OAuthProviderApi, S as OAuthClientAuthenticationInput, T as OAuthClientAuthenticationStrategy, U as OAuthTokenIssueParams, V as OAuthResource, W as OAuthTokenResponse, X as StoredAuthorizationQuery, Y as StoreTokenType, Z as VerificationValue, _ as OAuthAuthenticationContext, a as GrantType, b as OAuthClaimExtensionInput, c as ResourceServerMetadata, d as ActiveAccessTokenPayload, et as ResourceUriSchema, f as AuthorizePrompt, g as OAuthAuthenticatedClient, h as InitialAccessTokenAuthorization, i as Confirmation, it as OAuthClientRegistrationMetadata, j as OAuthExtensionGrantHandlerInput, k as OAuthConsent, l as TokenEndpointAuthMethod, m as ClientMetadataResourceFetch, n as AuthServerMetadata, nt as oauthClientMetadataSchema, o as OAuthClient, p as ClientDiscovery, q as SchemaClient, r as BearerMethodsSupported, s as OIDCMetadata, t as AuthMethod, u as TokenType, v as OAuthAuthenticationContextOptions, w as OAuthClientAuthenticationResult, x as OAuthClientAdministrativeResponse, y as OAuthAuthorizationQuery, z as OAuthProviderExtension } from "./oauth-CzT1PvAY.mjs";
+import { c as OAuthEndpointRedirectContext, d as OAuthFieldErrorCodeMap, f as OAuthRedirectOnError, g as oauthDeviceAuthorization, h as OAuthDeviceAuthorizationOptions, l as OAuthErrorCode, m as DEVICE_CODE_GRANT_TYPE, n as getOAuthProviderState, o as getIssuer, r as oauthProvider, s as OAuthEndpointErrorResult, t as DEFAULT_OAUTH_SCOPES, u as OAuthFieldErrorCode } from "./oauth-DfH-ghKj.mjs";
+import { _ as oauthProviderOpenIdConfigMetadata, a as verifyOAuthQueryParams, c as OAuthTokenExchangeRequest, d as getOAuthProviderApi, f as createResourceServerChallenge, g as oauthProviderAuthServerMetadata, h as oauthAuthorizationServerMetadata, l as TOKEN_EXCHANGE_GRANT_TYPE, m as metadataResponse, o as ACCESS_TOKEN_TYPE, p as authServerMetadata, s as OAuthTokenExchangeOptions, t as consumeClientAssertion, u as oauthTokenExchange, v as oidcServerMetadata, y as extendOAuthProvider } from "./index-DVydGHlT.mjs";
 export { ACCESS_TOKEN_TYPE, ActiveAccessTokenPayload, AuthMethod, AuthServerMetadata, AuthorizePrompt, BearerMethodsSupported, ClientDiscovery, ClientMetadataResourceFetch, ClientRegistrationRequest, Confirmation, DEFAULT_OAUTH_SCOPES, DEVICE_CODE_GRANT_TYPE, GrantType, InitialAccessTokenAuthorization, OAuthAuthenticatedClient, OAuthAuthenticationContext, OAuthAuthenticationContextOptions, OAuthAuthorizationQuery, OAuthClaimExtensionInput, OAuthClient, OAuthClientAdministrativeResponse, OAuthClientAuthenticationInput, OAuthClientAuthenticationRequest, OAuthClientAuthenticationResult, OAuthClientAuthenticationStrategy, OAuthClientMetadata, OAuthClientMetadataExtensionInput, OAuthClientRegistrationMetadata, OAuthClientRegistrationResponse, OAuthClientResource, OAuthConsent, OAuthDeviceAuthorizationOptions, OAuthEndpointErrorResult, OAuthEndpointRedirectContext, OAuthErrorCode, OAuthExtensionGrantHandler, OAuthExtensionGrantHandlerInput, OAuthFieldErrorCode, OAuthFieldErrorCodeMap, OAuthInteractionQuery, OAuthInteractionRequest, OAuthInteractionRequestHandler, OAuthMetadataExtensionInput, OAuthOpaqueAccessToken, OAuthOptions, OAuthProviderApi, OAuthProviderExtension, OAuthRedirectOnError, OAuthRefreshToken, OAuthResource, OAuthResourceInput, OAuthTokenExchangeOptions, OAuthTokenExchangeRequest, OAuthTokenIssueParams, OAuthTokenResponse, OAuthUserInfoExtensionInput, OIDCMetadata, Prompt, ResourceServerMetadata, ResourceUriSchema, SchemaClient, Scope, StoreTokenType, StoredAuthorizationQuery, TOKEN_EXCHANGE_GRANT_TYPE, TokenEndpointAuthMethod, TokenType, VerificationValue, authServerMetadata, consumeClientAssertion, createResourceServerChallenge, extendOAuthProvider, getIssuer, getOAuthProviderApi, getOAuthProviderState, metadataResponse, oauthAuthorizationServerMetadata, oauthClientMetadataSchema, oauthDeviceAuthorization, oauthProvider, oauthProviderAuthServerMetadata, oauthProviderOpenIdConfigMetadata, oauthTokenExchange, oidcServerMetadata, verifyOAuthQueryParams };

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { E as oauthClientMetadataSchema, r as getOAuthProviderApi, v as resolveResourcePolicy, x as ResourceUriSchema } from "./introspect-CEo9Q06v.mjs";
-import { C as parseScopes, H as extendOAuthProvider, I as validateClientScopes, L as verifyOAuthQueryParams, N as toResourceList, P as tokenError, i as consentCovers, l as findConsent, p as getOAuthProviderPlugin, u as getClient, v as normalizeClientAuthenticationParameters, w as readFormParams, y as normalizeTimestampValue } from "./utils-BMNe8Sg2.mjs";
-import { c as consumeClientAssertion, d as authServerMetadata, f as metadataResponse, g as oidcServerMetadata, h as oauthProviderOpenIdConfigMetadata, i as oauthProvider, m as oauthProviderAuthServerMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthAuthorizationServerMetadata, r as getOAuthProviderState, t as getIssuer } from "./authorize-92EtLsBi.mjs";
+import { E as oauthClientMetadataSchema, r as getOAuthProviderApi, v as resolveResourcePolicy, x as ResourceUriSchema } from "./introspect-DdmCPEHN.mjs";
+import { C as parseScopes, H as extendOAuthProvider, I as validateClientScopes, L as verifyOAuthQueryParams, N as toResourceList, P as tokenError, i as consentCovers, l as findConsent, p as getOAuthProviderPlugin, u as getClient, v as normalizeClientAuthenticationParameters, w as readFormParams, y as normalizeTimestampValue } from "./utils-D-CUrvd1.mjs";
+import { c as consumeClientAssertion, d as authServerMetadata, f as metadataResponse, g as oidcServerMetadata, h as oauthProviderOpenIdConfigMetadata, i as oauthProvider, m as oauthProviderAuthServerMetadata, n as DEFAULT_OAUTH_SCOPES, p as oauthAuthorizationServerMetadata, r as getOAuthProviderState, t as getIssuer } from "./authorize-Dg976Ug0.mjs";
 import { t as createResourceServerChallenge } from "./resource-challenge-Damwi0Or.mjs";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { isAPIError } from "better-auth/api";

package/dist/internal.d.mts

@@ -1,6 +1,6 @@
-import { J as Scope, L as OAuthOptions, at as OAuthClientRegistrationResult, ct as registerClientMetadataDocument, ot as RegisterClientMetadataDocumentInput, st as assertPublicRoutableHttpsUri } from "./oauth-BlEuA8oD.mjs";
-import { a as validatePublicClientJwks, i as PublicClientJwksValidationResult, p as createOAuthEndpoint } from "./oauth-mdkaIwmm.mjs";
-import { b as getExtensionClientMetadataFields, i as validateClientScopes, n as parseClientMetadata, r as toResourceList } from "./index-sGnh4IfY.mjs";
+import { J as Scope, L as OAuthOptions, at as OAuthClientRegistrationResult, ct as registerClientMetadataDocument, ot as RegisterClientMetadataDocumentInput, st as assertPublicRoutableHttpsUri } from "./oauth-CzT1PvAY.mjs";
+import { a as validatePublicClientJwks, i as PublicClientJwksValidationResult, p as createOAuthEndpoint } from "./oauth-DfH-ghKj.mjs";
+import { b as getExtensionClientMetadataFields, i as validateClientScopes, n as parseClientMetadata, r as toResourceList } from "./index-DVydGHlT.mjs";
 import { JWSAlgorithms } from "better-auth/plugins";
 import { Session, User } from "better-auth/types";
 import { AuthContext, GenericEndpointContext } from "@better-auth/core";

package/dist/internal.mjs

@@ -1,4 +1,4 @@
-import { A as getAcrValuesSupported, v as resolveResourcePolicy } from "./introspect-CEo9Q06v.mjs";
-import { I as validateClientScopes, N as toResourceList, W as getExtensionClientMetadataFields, et as isForbiddenCimdClientMetadataField, x as parseClientMetadata } from "./utils-BMNe8Sg2.mjs";
-import { a as assertPublicRoutableHttpsUri, l as validatePublicClientJwks, o as registerClientMetadataDocument, u as createOAuthEndpoint } from "./authorize-92EtLsBi.mjs";
+import { A as getAcrValuesSupported, v as resolveResourcePolicy } from "./introspect-DdmCPEHN.mjs";
+import { I as validateClientScopes, N as toResourceList, W as getExtensionClientMetadataFields, et as isForbiddenCimdClientMetadataField, x as parseClientMetadata } from "./utils-D-CUrvd1.mjs";
+import { a as assertPublicRoutableHttpsUri, l as validatePublicClientJwks, o as registerClientMetadataDocument, u as createOAuthEndpoint } from "./authorize-Dg976Ug0.mjs";
 export { assertPublicRoutableHttpsUri, createOAuthEndpoint, getAcrValuesSupported, getExtensionClientMetadataFields, isForbiddenCimdClientMetadataField, parseClientMetadata, registerClientMetadataDocument, resolveResourcePolicy, toResourceList, validateClientScopes, validatePublicClientJwks };

package/dist/{introspect-CEo9Q06v.mjs → introspect-DdmCPEHN.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-wcPFST8Q.mjs";
-import { B as collectExtensionIdTokenClaims, D as resolveSessionAuthTime, F as validateClientCredentials, G as getExtensionGrantHandler, I as validateClientScopes, J as getSupportedGrantTypes, M as toAudienceClaim, N as toResourceList, O as resolveSubjectIdentifier, V as collectExtensionUserInfoClaims, X as hasUserInfoClaimExtension, a as decryptStoredClientSecret, c as extractClientCredentials, f as getJwtPlugin, h as isPKCERequired, j as storeToken, m as getStoredToken, r as clientAllowsGrant, s as destructureCredentials, u as getClient, x as parseClientMetadata, y as normalizeTimestampValue, z as collectExtensionAccessTokenClaims } from "./utils-BMNe8Sg2.mjs";
+import { B as collectExtensionIdTokenClaims, D as resolveSessionAuthTime, F as validateClientCredentials, G as getExtensionGrantHandler, I as validateClientScopes, J as getSupportedGrantTypes, M as toAudienceClaim, N as toResourceList, O as resolveSubjectIdentifier, V as collectExtensionUserInfoClaims, X as hasUserInfoClaimExtension, a as decryptStoredClientSecret, c as extractClientCredentials, f as getJwtPlugin, h as isPKCERequired, j as storeToken, m as getStoredToken, r as clientAllowsGrant, s as destructureCredentials, u as getClient, x as parseClientMetadata, y as normalizeTimestampValue, z as collectExtensionAccessTokenClaims } from "./utils-D-CUrvd1.mjs";
 import { APIError } from "better-auth/api";
 import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from "better-auth/crypto";
 import { APIError as APIError$1 } from "better-call";

package/dist/{oauth-BlEuA8oD.d.mts → oauth-CzT1PvAY.d.mts}

@@ -1327,6 +1327,19 @@ interface InitialAccessTokenAuthorization {
    * client is stored with neither a `user_id` nor a `reference_id`).
    */
   referenceId?: string;
+  /**
+   * Scope ceiling for the `client_credentials` grant, such as the machine
+   * scopes an administrator approved when the token was issued. Return only
+   * scopes that approval covered: the token is the only proof of it.
+   *
+   * The client must register the `client_credentials` grant with a
+   * confidential authentication method, and every scope must be one the
+   * provider offers and not a user-delegated scope such as `openid`.
+   * Otherwise registration fails.
+   *
+   * @default []
+   */
+  clientCredentialsScopes?: string[];
 }
 interface OAuthOptions<Scopes extends readonly Scope[] = InternallySupportedScopes[]> {
   /**

package/dist/{oauth-mdkaIwmm.d.mts → oauth-DfH-ghKj.d.mts}

@@ -1,4 +1,4 @@
-import { D as OAuthClientRegistrationResponse, F as OAuthMetadataExtensionInput, J as Scope, K as Prompt, L as OAuthOptions, P as OAuthInteractionRequestHandler, V as OAuthResource, W as OAuthTokenResponse, a as GrantType, j as OAuthExtensionGrantHandlerInput, k as OAuthConsent, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, tt as clientRegistrationRequestSchema, u as TokenType, x as OAuthClientAdministrativeResponse } from "./oauth-BlEuA8oD.mjs";
+import { D as OAuthClientRegistrationResponse, F as OAuthMetadataExtensionInput, J as Scope, K as Prompt, L as OAuthOptions, P as OAuthInteractionRequestHandler, V as OAuthResource, W as OAuthTokenResponse, a as GrantType, j as OAuthExtensionGrantHandlerInput, k as OAuthConsent, l as TokenEndpointAuthMethod, n as AuthServerMetadata, o as OAuthClient, tt as clientRegistrationRequestSchema, u as TokenType, x as OAuthClientAdministrativeResponse } from "./oauth-CzT1PvAY.mjs";
 import * as _$better_call0 from "better-call";
 import { EndpointContext, EndpointOptions, StrictEndpoint } from "better-call";
 import * as z from "zod";

package/dist/{utils-BMNe8Sg2.mjs → utils-D-CUrvd1.mjs}

@@ -986,7 +986,7 @@ async function extractClientCredentials(ctx, opts, expectedAudience) {
 				confirmation: result.confirmation
 			};
 		}
-		const { verifyClientAssertion: verify } = await import("./authorize-92EtLsBi.mjs").then((n) => n.s);
+		const { verifyClientAssertion: verify } = await import("./authorize-Dg976Ug0.mjs").then((n) => n.s);
 		return {
 			kind: "pre_verified",
 			method: "private_key_jwt",

package/dist/{version-DeABnmP9.mjs → version-BwHks7Wg.mjs}

@@ -1,5 +1,5 @@
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.8.0-beta.0";
+const PACKAGE_VERSION = "1.8.0-beta.1";
 //#endregion
 export { PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/oauth-provider",
-  "version": "1.8.0-beta.0",
+  "version": "1.8.0-beta.1",
   "description": "An oauth provider plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -71,16 +71,16 @@
   "devDependencies": {
     "listhen": "^1.9.0",
     "tsdown": "0.21.10",
-    "@better-auth/core": "1.8.0-beta.0",
-    "@better-auth/memory-adapter": "1.8.0-beta.0",
-    "better-auth": "1.8.0-beta.0"
+    "@better-auth/core": "1.8.0-beta.1",
+    "@better-auth/memory-adapter": "1.8.0-beta.1",
+    "better-auth": "1.8.0-beta.1"
   },
   "peerDependencies": {
     "@better-auth/utils": "^0.4.2 || ^0.5.0",
     "@better-fetch/fetch": "1.3.2",
     "better-call": "1.4.2",
-    "@better-auth/core": "^1.8.0-beta.0",
-    "better-auth": "^1.8.0-beta.0"
+    "@better-auth/core": "^1.8.0-beta.1",
+    "better-auth": "^1.8.0-beta.1"
   },
   "scripts": {
     "build": "tsdown",