@hammadj/better-auth-core 1.5.0-beta.9

package/dist/error/codes.d.mts

@@ -0,0 +1,199 @@
+//#region src/error/codes.d.ts
+declare const BASE_ERROR_CODES: {
+  readonly USER_NOT_FOUND: {
+    code: "USER_NOT_FOUND";
+    message: "User not found";
+  };
+  readonly FAILED_TO_CREATE_USER: {
+    code: "FAILED_TO_CREATE_USER";
+    message: "Failed to create user";
+  };
+  readonly FAILED_TO_CREATE_SESSION: {
+    code: "FAILED_TO_CREATE_SESSION";
+    message: "Failed to create session";
+  };
+  readonly FAILED_TO_UPDATE_USER: {
+    code: "FAILED_TO_UPDATE_USER";
+    message: "Failed to update user";
+  };
+  readonly FAILED_TO_GET_SESSION: {
+    code: "FAILED_TO_GET_SESSION";
+    message: "Failed to get session";
+  };
+  readonly INVALID_PASSWORD: {
+    code: "INVALID_PASSWORD";
+    message: "Invalid password";
+  };
+  readonly INVALID_EMAIL: {
+    code: "INVALID_EMAIL";
+    message: "Invalid email";
+  };
+  readonly INVALID_EMAIL_OR_PASSWORD: {
+    code: "INVALID_EMAIL_OR_PASSWORD";
+    message: "Invalid email or password";
+  };
+  readonly INVALID_USER: {
+    code: "INVALID_USER";
+    message: "Invalid user";
+  };
+  readonly SOCIAL_ACCOUNT_ALREADY_LINKED: {
+    code: "SOCIAL_ACCOUNT_ALREADY_LINKED";
+    message: "Social account already linked";
+  };
+  readonly PROVIDER_NOT_FOUND: {
+    code: "PROVIDER_NOT_FOUND";
+    message: "Provider not found";
+  };
+  readonly INVALID_TOKEN: {
+    code: "INVALID_TOKEN";
+    message: "Invalid token";
+  };
+  readonly TOKEN_EXPIRED: {
+    code: "TOKEN_EXPIRED";
+    message: "Token expired";
+  };
+  readonly ID_TOKEN_NOT_SUPPORTED: {
+    code: "ID_TOKEN_NOT_SUPPORTED";
+    message: "id_token not supported";
+  };
+  readonly FAILED_TO_GET_USER_INFO: {
+    code: "FAILED_TO_GET_USER_INFO";
+    message: "Failed to get user info";
+  };
+  readonly USER_EMAIL_NOT_FOUND: {
+    code: "USER_EMAIL_NOT_FOUND";
+    message: "User email not found";
+  };
+  readonly EMAIL_NOT_VERIFIED: {
+    code: "EMAIL_NOT_VERIFIED";
+    message: "Email not verified";
+  };
+  readonly PASSWORD_TOO_SHORT: {
+    code: "PASSWORD_TOO_SHORT";
+    message: "Password too short";
+  };
+  readonly PASSWORD_TOO_LONG: {
+    code: "PASSWORD_TOO_LONG";
+    message: "Password too long";
+  };
+  readonly USER_ALREADY_EXISTS: {
+    code: "USER_ALREADY_EXISTS";
+    message: "User already exists.";
+  };
+  readonly USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: {
+    code: "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL";
+    message: "User already exists. Use another email.";
+  };
+  readonly EMAIL_CAN_NOT_BE_UPDATED: {
+    code: "EMAIL_CAN_NOT_BE_UPDATED";
+    message: "Email can not be updated";
+  };
+  readonly CREDENTIAL_ACCOUNT_NOT_FOUND: {
+    code: "CREDENTIAL_ACCOUNT_NOT_FOUND";
+    message: "Credential account not found";
+  };
+  readonly SESSION_EXPIRED: {
+    code: "SESSION_EXPIRED";
+    message: "Session expired. Re-authenticate to perform this action.";
+  };
+  readonly FAILED_TO_UNLINK_LAST_ACCOUNT: {
+    code: "FAILED_TO_UNLINK_LAST_ACCOUNT";
+    message: "You can't unlink your last account";
+  };
+  readonly ACCOUNT_NOT_FOUND: {
+    code: "ACCOUNT_NOT_FOUND";
+    message: "Account not found";
+  };
+  readonly USER_ALREADY_HAS_PASSWORD: {
+    code: "USER_ALREADY_HAS_PASSWORD";
+    message: "User already has a password. Provide that to delete the account.";
+  };
+  readonly CROSS_SITE_NAVIGATION_LOGIN_BLOCKED: {
+    code: "CROSS_SITE_NAVIGATION_LOGIN_BLOCKED";
+    message: "Cross-site navigation login blocked. This request appears to be a CSRF attack.";
+  };
+  readonly VERIFICATION_EMAIL_NOT_ENABLED: {
+    code: "VERIFICATION_EMAIL_NOT_ENABLED";
+    message: "Verification email isn't enabled";
+  };
+  readonly EMAIL_ALREADY_VERIFIED: {
+    code: "EMAIL_ALREADY_VERIFIED";
+    message: "Email is already verified";
+  };
+  readonly EMAIL_MISMATCH: {
+    code: "EMAIL_MISMATCH";
+    message: "Email mismatch";
+  };
+  readonly SESSION_NOT_FRESH: {
+    code: "SESSION_NOT_FRESH";
+    message: "Session is not fresh";
+  };
+  readonly LINKED_ACCOUNT_ALREADY_EXISTS: {
+    code: "LINKED_ACCOUNT_ALREADY_EXISTS";
+    message: "Linked account already exists";
+  };
+  readonly INVALID_ORIGIN: {
+    code: "INVALID_ORIGIN";
+    message: "Invalid origin";
+  };
+  readonly INVALID_CALLBACK_URL: {
+    code: "INVALID_CALLBACK_URL";
+    message: "Invalid callbackURL";
+  };
+  readonly INVALID_REDIRECT_URL: {
+    code: "INVALID_REDIRECT_URL";
+    message: "Invalid redirectURL";
+  };
+  readonly INVALID_ERROR_CALLBACK_URL: {
+    code: "INVALID_ERROR_CALLBACK_URL";
+    message: "Invalid errorCallbackURL";
+  };
+  readonly INVALID_NEW_USER_CALLBACK_URL: {
+    code: "INVALID_NEW_USER_CALLBACK_URL";
+    message: "Invalid newUserCallbackURL";
+  };
+  readonly MISSING_OR_NULL_ORIGIN: {
+    code: "MISSING_OR_NULL_ORIGIN";
+    message: "Missing or null Origin";
+  };
+  readonly CALLBACK_URL_REQUIRED: {
+    code: "CALLBACK_URL_REQUIRED";
+    message: "callbackURL is required";
+  };
+  readonly FAILED_TO_CREATE_VERIFICATION: {
+    code: "FAILED_TO_CREATE_VERIFICATION";
+    message: "Unable to create verification";
+  };
+  readonly FIELD_NOT_ALLOWED: {
+    code: "FIELD_NOT_ALLOWED";
+    message: "Field not allowed to be set";
+  };
+  readonly ASYNC_VALIDATION_NOT_SUPPORTED: {
+    code: "ASYNC_VALIDATION_NOT_SUPPORTED";
+    message: "Async validation is not supported";
+  };
+  readonly VALIDATION_ERROR: {
+    code: "VALIDATION_ERROR";
+    message: "Validation Error";
+  };
+  readonly MISSING_FIELD: {
+    code: "MISSING_FIELD";
+    message: "Field is required";
+  };
+  readonly METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED: {
+    code: "METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED";
+    message: "POST method requires deferSessionRefresh to be enabled in session config";
+  };
+  readonly BODY_MUST_BE_AN_OBJECT: {
+    code: "BODY_MUST_BE_AN_OBJECT";
+    message: "Body must be an object";
+  };
+  readonly PASSWORD_ALREADY_SET: {
+    code: "PASSWORD_ALREADY_SET";
+    message: "User already has a password set";
+  };
+};
+type APIErrorCode = keyof typeof BASE_ERROR_CODES;
+//#endregion
+export { APIErrorCode, BASE_ERROR_CODES };
+//# sourceMappingURL=codes.d.mts.map

package/dist/error/codes.mjs

@@ -0,0 +1,57 @@
+import { defineErrorCodes } from "../utils/error-codes.mjs";
+
+//#region src/error/codes.ts
+const BASE_ERROR_CODES = defineErrorCodes({
+	USER_NOT_FOUND: "User not found",
+	FAILED_TO_CREATE_USER: "Failed to create user",
+	FAILED_TO_CREATE_SESSION: "Failed to create session",
+	FAILED_TO_UPDATE_USER: "Failed to update user",
+	FAILED_TO_GET_SESSION: "Failed to get session",
+	INVALID_PASSWORD: "Invalid password",
+	INVALID_EMAIL: "Invalid email",
+	INVALID_EMAIL_OR_PASSWORD: "Invalid email or password",
+	INVALID_USER: "Invalid user",
+	SOCIAL_ACCOUNT_ALREADY_LINKED: "Social account already linked",
+	PROVIDER_NOT_FOUND: "Provider not found",
+	INVALID_TOKEN: "Invalid token",
+	TOKEN_EXPIRED: "Token expired",
+	ID_TOKEN_NOT_SUPPORTED: "id_token not supported",
+	FAILED_TO_GET_USER_INFO: "Failed to get user info",
+	USER_EMAIL_NOT_FOUND: "User email not found",
+	EMAIL_NOT_VERIFIED: "Email not verified",
+	PASSWORD_TOO_SHORT: "Password too short",
+	PASSWORD_TOO_LONG: "Password too long",
+	USER_ALREADY_EXISTS: "User already exists.",
+	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.",
+	EMAIL_CAN_NOT_BE_UPDATED: "Email can not be updated",
+	CREDENTIAL_ACCOUNT_NOT_FOUND: "Credential account not found",
+	SESSION_EXPIRED: "Session expired. Re-authenticate to perform this action.",
+	FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't unlink your last account",
+	ACCOUNT_NOT_FOUND: "Account not found",
+	USER_ALREADY_HAS_PASSWORD: "User already has a password. Provide that to delete the account.",
+	CROSS_SITE_NAVIGATION_LOGIN_BLOCKED: "Cross-site navigation login blocked. This request appears to be a CSRF attack.",
+	VERIFICATION_EMAIL_NOT_ENABLED: "Verification email isn't enabled",
+	EMAIL_ALREADY_VERIFIED: "Email is already verified",
+	EMAIL_MISMATCH: "Email mismatch",
+	SESSION_NOT_FRESH: "Session is not fresh",
+	LINKED_ACCOUNT_ALREADY_EXISTS: "Linked account already exists",
+	INVALID_ORIGIN: "Invalid origin",
+	INVALID_CALLBACK_URL: "Invalid callbackURL",
+	INVALID_REDIRECT_URL: "Invalid redirectURL",
+	INVALID_ERROR_CALLBACK_URL: "Invalid errorCallbackURL",
+	INVALID_NEW_USER_CALLBACK_URL: "Invalid newUserCallbackURL",
+	MISSING_OR_NULL_ORIGIN: "Missing or null Origin",
+	CALLBACK_URL_REQUIRED: "callbackURL is required",
+	FAILED_TO_CREATE_VERIFICATION: "Unable to create verification",
+	FIELD_NOT_ALLOWED: "Field not allowed to be set",
+	ASYNC_VALIDATION_NOT_SUPPORTED: "Async validation is not supported",
+	VALIDATION_ERROR: "Validation Error",
+	MISSING_FIELD: "Field is required",
+	METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED: "POST method requires deferSessionRefresh to be enabled in session config",
+	BODY_MUST_BE_AN_OBJECT: "Body must be an object",
+	PASSWORD_ALREADY_SET: "User already has a password set"
+});
+
+//#endregion
+export { BASE_ERROR_CODES };
+//# sourceMappingURL=codes.mjs.map

package/dist/error/codes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.mjs","names":[],"sources":["../../src/error/codes.ts"],"sourcesContent":["import { defineErrorCodes } from \"../utils/error-codes\";\n\nexport const BASE_ERROR_CODES = defineErrorCodes({\n\tUSER_NOT_FOUND: \"User not found\",\n\tFAILED_TO_CREATE_USER: \"Failed to create user\",\n\tFAILED_TO_CREATE_SESSION: \"Failed to create session\",\n\tFAILED_TO_UPDATE_USER: \"Failed to update user\",\n\tFAILED_TO_GET_SESSION: \"Failed to get session\",\n\tINVALID_PASSWORD: \"Invalid password\",\n\tINVALID_EMAIL: \"Invalid email\",\n\tINVALID_EMAIL_OR_PASSWORD: \"Invalid email or password\",\n\tINVALID_USER: \"Invalid user\",\n\tSOCIAL_ACCOUNT_ALREADY_LINKED: \"Social account already linked\",\n\tPROVIDER_NOT_FOUND: \"Provider not found\",\n\tINVALID_TOKEN: \"Invalid token\",\n\tTOKEN_EXPIRED: \"Token expired\",\n\tID_TOKEN_NOT_SUPPORTED: \"id_token not supported\",\n\tFAILED_TO_GET_USER_INFO: \"Failed to get user info\",\n\tUSER_EMAIL_NOT_FOUND: \"User email not found\",\n\tEMAIL_NOT_VERIFIED: \"Email not verified\",\n\tPASSWORD_TOO_SHORT: \"Password too short\",\n\tPASSWORD_TOO_LONG: \"Password too long\",\n\tUSER_ALREADY_EXISTS: \"User already exists.\",\n\tUSER_ALREADY_EXISTS_USE_ANOTHER_EMAIL:\n\t\t\"User already exists. Use another email.\",\n\tEMAIL_CAN_NOT_BE_UPDATED: \"Email can not be updated\",\n\tCREDENTIAL_ACCOUNT_NOT_FOUND: \"Credential account not found\",\n\tSESSION_EXPIRED: \"Session expired. Re-authenticate to perform this action.\",\n\tFAILED_TO_UNLINK_LAST_ACCOUNT: \"You can't unlink your last account\",\n\tACCOUNT_NOT_FOUND: \"Account not found\",\n\tUSER_ALREADY_HAS_PASSWORD:\n\t\t\"User already has a password. Provide that to delete the account.\",\n\tCROSS_SITE_NAVIGATION_LOGIN_BLOCKED:\n\t\t\"Cross-site navigation login blocked. This request appears to be a CSRF attack.\",\n\tVERIFICATION_EMAIL_NOT_ENABLED: \"Verification email isn't enabled\",\n\tEMAIL_ALREADY_VERIFIED: \"Email is already verified\",\n\tEMAIL_MISMATCH: \"Email mismatch\",\n\tSESSION_NOT_FRESH: \"Session is not fresh\",\n\tLINKED_ACCOUNT_ALREADY_EXISTS: \"Linked account already exists\",\n\tINVALID_ORIGIN: \"Invalid origin\",\n\tINVALID_CALLBACK_URL: \"Invalid callbackURL\",\n\tINVALID_REDIRECT_URL: \"Invalid redirectURL\",\n\tINVALID_ERROR_CALLBACK_URL: \"Invalid errorCallbackURL\",\n\tINVALID_NEW_USER_CALLBACK_URL: \"Invalid newUserCallbackURL\",\n\tMISSING_OR_NULL_ORIGIN: \"Missing or null Origin\",\n\tCALLBACK_URL_REQUIRED: \"callbackURL is required\",\n\tFAILED_TO_CREATE_VERIFICATION: \"Unable to create verification\",\n\tFIELD_NOT_ALLOWED: \"Field not allowed to be set\",\n\tASYNC_VALIDATION_NOT_SUPPORTED: \"Async validation is not supported\",\n\tVALIDATION_ERROR: \"Validation Error\",\n\tMISSING_FIELD: \"Field is required\",\n\tMETHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED:\n\t\t\"POST method requires deferSessionRefresh to be enabled in session config\",\n\tBODY_MUST_BE_AN_OBJECT: \"Body must be an object\",\n\tPASSWORD_ALREADY_SET: \"User already has a password set\",\n});\n\nexport type APIErrorCode = keyof typeof BASE_ERROR_CODES;\n"],"mappings":";;;AAEA,MAAa,mBAAmB,iBAAiB;CAChD,gBAAgB;CAChB,uBAAuB;CACvB,0BAA0B;CAC1B,uBAAuB;CACvB,uBAAuB;CACvB,kBAAkB;CAClB,eAAe;CACf,2BAA2B;CAC3B,cAAc;CACd,+BAA+B;CAC/B,oBAAoB;CACpB,eAAe;CACf,eAAe;CACf,wBAAwB;CACxB,yBAAyB;CACzB,sBAAsB;CACtB,oBAAoB;CACpB,oBAAoB;CACpB,mBAAmB;CACnB,qBAAqB;CACrB,uCACC;CACD,0BAA0B;CAC1B,8BAA8B;CAC9B,iBAAiB;CACjB,+BAA+B;CAC/B,mBAAmB;CACnB,2BACC;CACD,qCACC;CACD,gCAAgC;CAChC,wBAAwB;CACxB,gBAAgB;CAChB,mBAAmB;CACnB,+BAA+B;CAC/B,gBAAgB;CAChB,sBAAsB;CACtB,sBAAsB;CACtB,4BAA4B;CAC5B,+BAA+B;CAC/B,wBAAwB;CACxB,uBAAuB;CACvB,+BAA+B;CAC/B,mBAAmB;CACnB,gCAAgC;CAChC,kBAAkB;CAClB,eAAe;CACf,2CACC;CACD,wBAAwB;CACxB,sBAAsB;CACtB,CAAC"}

package/dist/error/index.d.mts

@@ -0,0 +1,20 @@
+import { APIErrorCode, BASE_ERROR_CODES } from "./codes.mjs";
+import { APIError as APIError$1 } from "better-call/error";
+
+//#region src/error/index.d.ts
+declare class BetterAuthError extends Error {
+  constructor(message: string, options?: {
+    cause?: unknown | undefined;
+  });
+}
+declare class APIError extends APIError$1 {
+  constructor(...args: ConstructorParameters<typeof APIError$1>);
+  static fromStatus(status: ConstructorParameters<typeof APIError$1>[0], body?: ConstructorParameters<typeof APIError$1>[1]): APIError;
+  static from(status: ConstructorParameters<typeof APIError$1>[0], error: {
+    code: string;
+    message: string;
+  }): APIError;
+}
+//#endregion
+export { APIError, type APIErrorCode, BASE_ERROR_CODES, BetterAuthError };
+//# sourceMappingURL=index.d.mts.map

package/dist/error/index.mjs

@@ -0,0 +1,30 @@
+import { BASE_ERROR_CODES } from "./codes.mjs";
+import { APIError as APIError$1 } from "better-call/error";
+
+//#region src/error/index.ts
+var BetterAuthError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "BetterAuthError";
+		this.message = message;
+		this.stack = "";
+	}
+};
+var APIError = class APIError extends APIError$1 {
+	constructor(...args) {
+		super(...args);
+	}
+	static fromStatus(status, body) {
+		return new APIError(status, body);
+	}
+	static from(status, error) {
+		return new APIError(status, {
+			message: error.message,
+			code: error.code
+		});
+	}
+};
+
+//#endregion
+export { APIError, BASE_ERROR_CODES, BetterAuthError };
+//# sourceMappingURL=index.mjs.map

package/dist/error/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["BaseAPIError"],"sources":["../../src/error/index.ts"],"sourcesContent":["import { APIError as BaseAPIError } from \"better-call/error\";\n\nexport class BetterAuthError extends Error {\n\tconstructor(message: string, options?: { cause?: unknown | undefined }) {\n\t\tsuper(message, options);\n\t\tthis.name = \"BetterAuthError\";\n\t\tthis.message = message;\n\t\tthis.stack = \"\";\n\t}\n}\n\nexport { type APIErrorCode, BASE_ERROR_CODES } from \"./codes\";\n\nexport class APIError extends BaseAPIError {\n\tconstructor(...args: ConstructorParameters<typeof BaseAPIError>) {\n\t\tsuper(...args);\n\t}\n\n\tstatic fromStatus(\n\t\tstatus: ConstructorParameters<typeof BaseAPIError>[0],\n\t\tbody?: ConstructorParameters<typeof BaseAPIError>[1],\n\t) {\n\t\treturn new APIError(status, body);\n\t}\n\n\tstatic from(\n\t\tstatus: ConstructorParameters<typeof BaseAPIError>[0],\n\t\terror: { code: string; message: string },\n\t) {\n\t\treturn new APIError(status, {\n\t\t\tmessage: error.message,\n\t\t\tcode: error.code,\n\t\t});\n\t}\n}\n"],"mappings":";;;;AAEA,IAAa,kBAAb,cAAqC,MAAM;CAC1C,YAAY,SAAiB,SAA2C;AACvE,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO;AACZ,OAAK,UAAU;AACf,OAAK,QAAQ;;;AAMf,IAAa,WAAb,MAAa,iBAAiBA,WAAa;CAC1C,YAAY,GAAG,MAAkD;AAChE,QAAM,GAAG,KAAK;;CAGf,OAAO,WACN,QACA,MACC;AACD,SAAO,IAAI,SAAS,QAAQ,KAAK;;CAGlC,OAAO,KACN,QACA,OACC;AACD,SAAO,IAAI,SAAS,QAAQ;GAC3B,SAAS,MAAM;GACf,MAAM,MAAM;GACZ,CAAC"}

package/dist/index.d.mts

@@ -0,0 +1,8 @@
+import { Awaitable, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection } from "./types/helper.mjs";
+import { BetterAuthCookie, BetterAuthCookies } from "./types/cookie.mjs";
+import { BetterAuthPlugin, HookEndpointContext } from "./types/plugin.mjs";
+import { BetterAuthAdvancedOptions, BetterAuthOptions, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, GenerateIdFn, StoreIdentifierOption } from "./types/init-options.mjs";
+import { AuthContext, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, GenericEndpointContext, InfoContext, InternalAdapter, PluginContext } from "./types/context.mjs";
+import { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore } from "./types/plugin-client.mjs";
+import { StandardSchemaV1 } from "./types/index.mjs";
+export { AuthContext, Awaitable, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };

package/dist/index.mjs

@@ -0,0 +1 @@
+export {  };

package/dist/oauth2/client-credentials-token.d.mts

@@ -0,0 +1,37 @@
+import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
+
+//#region src/oauth2/client-credentials-token.d.ts
+declare function createClientCredentialsTokenRequest({
+  options,
+  scope,
+  authentication,
+  resource
+}: {
+  options: ProviderOptions & {
+    clientSecret: string;
+  };
+  scope?: string | undefined;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): {
+  body: URLSearchParams;
+  headers: Record<string, any>;
+};
+declare function clientCredentialsToken({
+  options,
+  tokenEndpoint,
+  scope,
+  authentication,
+  resource
+}: {
+  options: ProviderOptions & {
+    clientSecret: string;
+  };
+  tokenEndpoint: string;
+  scope: string;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): Promise<OAuth2Tokens>;
+//#endregion
+export { clientCredentialsToken, createClientCredentialsTokenRequest };
+//# sourceMappingURL=client-credentials-token.d.mts.map

package/dist/oauth2/client-credentials-token.mjs

@@ -0,0 +1,55 @@
+import { betterFetch } from "@better-fetch/fetch";
+import { base64Url } from "@better-auth/utils/base64";
+
+//#region src/oauth2/client-credentials-token.ts
+function createClientCredentialsTokenRequest({ options, scope, authentication, resource }) {
+	const body = new URLSearchParams();
+	const headers = {
+		"content-type": "application/x-www-form-urlencoded",
+		accept: "application/json"
+	};
+	body.set("grant_type", "client_credentials");
+	scope && body.set("scope", scope);
+	if (resource) if (typeof resource === "string") body.append("resource", resource);
+	else for (const _resource of resource) body.append("resource", _resource);
+	if (authentication === "basic") {
+		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+		headers["authorization"] = `Basic ${base64Url.encode(`${primaryClientId}:${options.clientSecret}`)}`;
+	} else {
+		const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+		body.set("client_id", primaryClientId);
+		body.set("client_secret", options.clientSecret);
+	}
+	return {
+		body,
+		headers
+	};
+}
+async function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, resource }) {
+	const { body, headers } = createClientCredentialsTokenRequest({
+		options,
+		scope,
+		authentication,
+		resource
+	});
+	const { data, error } = await betterFetch(tokenEndpoint, {
+		method: "POST",
+		body,
+		headers
+	});
+	if (error) throw error;
+	const tokens = {
+		accessToken: data.access_token,
+		tokenType: data.token_type,
+		scopes: data.scope?.split(" ")
+	};
+	if (data.expires_in) {
+		const now = /* @__PURE__ */ new Date();
+		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
+	}
+	return tokens;
+}
+
+//#endregion
+export { clientCredentialsToken, createClientCredentialsTokenRequest };
+//# sourceMappingURL=client-credentials-token.mjs.map

package/dist/oauth2/client-credentials-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials-token.mjs","names":[],"sources":["../../src/oauth2/client-credentials-token.ts"],"sourcesContent":["import { base64Url } from \"@better-auth/utils/base64\";\nimport { betterFetch } from \"@better-fetch/fetch\";\nimport type { OAuth2Tokens, ProviderOptions } from \"./oauth-provider\";\n\nexport function createClientCredentialsTokenRequest({\n\toptions,\n\tscope,\n\tauthentication,\n\tresource,\n}: {\n\toptions: ProviderOptions & { clientSecret: string };\n\tscope?: string | undefined;\n\tauthentication?: (\"basic\" | \"post\") | undefined;\n\tresource?: (string | string[]) | undefined;\n}) {\n\tconst body = new URLSearchParams();\n\tconst headers: Record<string, any> = {\n\t\t\"content-type\": \"application/x-www-form-urlencoded\",\n\t\taccept: \"application/json\",\n\t};\n\n\tbody.set(\"grant_type\", \"client_credentials\");\n\tscope && body.set(\"scope\", scope);\n\tif (resource) {\n\t\tif (typeof resource === \"string\") {\n\t\t\tbody.append(\"resource\", resource);\n\t\t} else {\n\t\t\tfor (const _resource of resource) {\n\t\t\t\tbody.append(\"resource\", _resource);\n\t\t\t}\n\t\t}\n\t}\n\tif (authentication === \"basic\") {\n\t\tconst primaryClientId = Array.isArray(options.clientId)\n\t\t\t? options.clientId[0]\n\t\t\t: options.clientId;\n\t\tconst encodedCredentials = base64Url.encode(\n\t\t\t`${primaryClientId}:${options.clientSecret}`,\n\t\t);\n\t\theaders[\"authorization\"] = `Basic ${encodedCredentials}`;\n\t} else {\n\t\tconst primaryClientId = Array.isArray(options.clientId)\n\t\t\t? options.clientId[0]\n\t\t\t: options.clientId;\n\t\tbody.set(\"client_id\", primaryClientId);\n\t\tbody.set(\"client_secret\", options.clientSecret);\n\t}\n\n\treturn {\n\t\tbody,\n\t\theaders,\n\t};\n}\n\nexport async function clientCredentialsToken({\n\toptions,\n\ttokenEndpoint,\n\tscope,\n\tauthentication,\n\tresource,\n}: {\n\toptions: ProviderOptions & { clientSecret: string };\n\ttokenEndpoint: string;\n\tscope: string;\n\tauthentication?: (\"basic\" | \"post\") | undefined;\n\tresource?: (string | string[]) | undefined;\n}): Promise<OAuth2Tokens> {\n\tconst { body, headers } = createClientCredentialsTokenRequest({\n\t\toptions,\n\t\tscope,\n\t\tauthentication,\n\t\tresource,\n\t});\n\n\tconst { data, error } = await betterFetch<{\n\t\taccess_token: string;\n\t\texpires_in?: number | undefined;\n\t\ttoken_type?: string | undefined;\n\t\tscope?: string | undefined;\n\t}>(tokenEndpoint, {\n\t\tmethod: \"POST\",\n\t\tbody,\n\t\theaders,\n\t});\n\tif (error) {\n\t\tthrow error;\n\t}\n\tconst tokens: OAuth2Tokens = {\n\t\taccessToken: data.access_token,\n\t\ttokenType: data.token_type,\n\t\tscopes: data.scope?.split(\" \"),\n\t};\n\n\tif (data.expires_in) {\n\t\tconst now = new Date();\n\t\ttokens.accessTokenExpiresAt = new Date(\n\t\t\tnow.getTime() + data.expires_in * 1000,\n\t\t);\n\t}\n\n\treturn tokens;\n}\n"],"mappings":";;;;AAIA,SAAgB,oCAAoC,EACnD,SACA,OACA,gBACA,YAME;CACF,MAAM,OAAO,IAAI,iBAAiB;CAClC,MAAM,UAA+B;EACpC,gBAAgB;EAChB,QAAQ;EACR;AAED,MAAK,IAAI,cAAc,qBAAqB;AAC5C,UAAS,KAAK,IAAI,SAAS,MAAM;AACjC,KAAI,SACH,KAAI,OAAO,aAAa,SACvB,MAAK,OAAO,YAAY,SAAS;KAEjC,MAAK,MAAM,aAAa,SACvB,MAAK,OAAO,YAAY,UAAU;AAIrC,KAAI,mBAAmB,SAAS;EAC/B,MAAM,kBAAkB,MAAM,QAAQ,QAAQ,SAAS,GACpD,QAAQ,SAAS,KACjB,QAAQ;AAIX,UAAQ,mBAAmB,SAHA,UAAU,OACpC,GAAG,gBAAgB,GAAG,QAAQ,eAC9B;QAEK;EACN,MAAM,kBAAkB,MAAM,QAAQ,QAAQ,SAAS,GACpD,QAAQ,SAAS,KACjB,QAAQ;AACX,OAAK,IAAI,aAAa,gBAAgB;AACtC,OAAK,IAAI,iBAAiB,QAAQ,aAAa;;AAGhD,QAAO;EACN;EACA;EACA;;AAGF,eAAsB,uBAAuB,EAC5C,SACA,eACA,OACA,gBACA,YAOyB;CACzB,MAAM,EAAE,MAAM,YAAY,oCAAoC;EAC7D;EACA;EACA;EACA;EACA,CAAC;CAEF,MAAM,EAAE,MAAM,UAAU,MAAM,YAK3B,eAAe;EACjB,QAAQ;EACR;EACA;EACA,CAAC;AACF,KAAI,MACH,OAAM;CAEP,MAAM,SAAuB;EAC5B,aAAa,KAAK;EAClB,WAAW,KAAK;EAChB,QAAQ,KAAK,OAAO,MAAM,IAAI;EAC9B;AAED,KAAI,KAAK,YAAY;EACpB,MAAM,sBAAM,IAAI,MAAM;AACtB,SAAO,uBAAuB,IAAI,KACjC,IAAI,SAAS,GAAG,KAAK,aAAa,IAClC;;AAGF,QAAO"}

package/dist/oauth2/create-authorization-url.d.mts

@@ -0,0 +1,46 @@
+import { ProviderOptions } from "./oauth-provider.mjs";
+import "./index.mjs";
+
+//#region src/oauth2/create-authorization-url.d.ts
+declare function createAuthorizationURL({
+  id,
+  options,
+  authorizationEndpoint,
+  state,
+  codeVerifier,
+  scopes,
+  claims,
+  redirectURI,
+  duration,
+  prompt,
+  accessType,
+  responseType,
+  display,
+  loginHint,
+  hd,
+  responseMode,
+  additionalParams,
+  scopeJoiner
+}: {
+  id: string;
+  options: ProviderOptions;
+  redirectURI: string;
+  authorizationEndpoint: string;
+  state: string;
+  codeVerifier?: string | undefined;
+  scopes?: string[] | undefined;
+  claims?: string[] | undefined;
+  duration?: string | undefined;
+  prompt?: string | undefined;
+  accessType?: string | undefined;
+  responseType?: string | undefined;
+  display?: string | undefined;
+  loginHint?: string | undefined;
+  hd?: string | undefined;
+  responseMode?: string | undefined;
+  additionalParams?: Record<string, string> | undefined;
+  scopeJoiner?: string | undefined;
+}): Promise<URL>;
+//#endregion
+export { createAuthorizationURL };
+//# sourceMappingURL=create-authorization-url.d.mts.map

package/dist/oauth2/create-authorization-url.mjs

@@ -0,0 +1,43 @@
+import { generateCodeChallenge } from "./utils.mjs";
+
+//#region src/oauth2/create-authorization-url.ts
+async function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, hd, responseMode, additionalParams, scopeJoiner }) {
+	const url = new URL(options.authorizationEndpoint || authorizationEndpoint);
+	url.searchParams.set("response_type", responseType || "code");
+	const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
+	url.searchParams.set("client_id", primaryClientId);
+	url.searchParams.set("state", state);
+	if (scopes) url.searchParams.set("scope", scopes.join(scopeJoiner || " "));
+	url.searchParams.set("redirect_uri", options.redirectURI || redirectURI);
+	duration && url.searchParams.set("duration", duration);
+	display && url.searchParams.set("display", display);
+	loginHint && url.searchParams.set("login_hint", loginHint);
+	prompt && url.searchParams.set("prompt", prompt);
+	hd && url.searchParams.set("hd", hd);
+	accessType && url.searchParams.set("access_type", accessType);
+	responseMode && url.searchParams.set("response_mode", responseMode);
+	if (codeVerifier) {
+		const codeChallenge = await generateCodeChallenge(codeVerifier);
+		url.searchParams.set("code_challenge_method", "S256");
+		url.searchParams.set("code_challenge", codeChallenge);
+	}
+	if (claims) {
+		const claimsObj = claims.reduce((acc, claim) => {
+			acc[claim] = null;
+			return acc;
+		}, {});
+		url.searchParams.set("claims", JSON.stringify({ id_token: {
+			email: null,
+			email_verified: null,
+			...claimsObj
+		} }));
+	}
+	if (additionalParams) Object.entries(additionalParams).forEach(([key, value]) => {
+		url.searchParams.set(key, value);
+	});
+	return url;
+}
+
+//#endregion
+export { createAuthorizationURL };
+//# sourceMappingURL=create-authorization-url.mjs.map

package/dist/oauth2/create-authorization-url.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-authorization-url.mjs","names":[],"sources":["../../src/oauth2/create-authorization-url.ts"],"sourcesContent":["import type { ProviderOptions } from \"./index\";\nimport { generateCodeChallenge } from \"./utils\";\n\nexport async function createAuthorizationURL({\n\tid,\n\toptions,\n\tauthorizationEndpoint,\n\tstate,\n\tcodeVerifier,\n\tscopes,\n\tclaims,\n\tredirectURI,\n\tduration,\n\tprompt,\n\taccessType,\n\tresponseType,\n\tdisplay,\n\tloginHint,\n\thd,\n\tresponseMode,\n\tadditionalParams,\n\tscopeJoiner,\n}: {\n\tid: string;\n\toptions: ProviderOptions;\n\tredirectURI: string;\n\tauthorizationEndpoint: string;\n\tstate: string;\n\tcodeVerifier?: string | undefined;\n\tscopes?: string[] | undefined;\n\tclaims?: string[] | undefined;\n\tduration?: string | undefined;\n\tprompt?: string | undefined;\n\taccessType?: string | undefined;\n\tresponseType?: string | undefined;\n\tdisplay?: string | undefined;\n\tloginHint?: string | undefined;\n\thd?: string | undefined;\n\tresponseMode?: string | undefined;\n\tadditionalParams?: Record<string, string> | undefined;\n\tscopeJoiner?: string | undefined;\n}) {\n\tconst url = new URL(options.authorizationEndpoint || authorizationEndpoint);\n\turl.searchParams.set(\"response_type\", responseType || \"code\");\n\tconst primaryClientId = Array.isArray(options.clientId)\n\t\t? options.clientId[0]\n\t\t: options.clientId;\n\turl.searchParams.set(\"client_id\", primaryClientId);\n\turl.searchParams.set(\"state\", state);\n\tif (scopes) {\n\t\turl.searchParams.set(\"scope\", scopes.join(scopeJoiner || \" \"));\n\t}\n\turl.searchParams.set(\"redirect_uri\", options.redirectURI || redirectURI);\n\tduration && url.searchParams.set(\"duration\", duration);\n\tdisplay && url.searchParams.set(\"display\", display);\n\tloginHint && url.searchParams.set(\"login_hint\", loginHint);\n\tprompt && url.searchParams.set(\"prompt\", prompt);\n\thd && url.searchParams.set(\"hd\", hd);\n\taccessType && url.searchParams.set(\"access_type\", accessType);\n\tresponseMode && url.searchParams.set(\"response_mode\", responseMode);\n\tif (codeVerifier) {\n\t\tconst codeChallenge = await generateCodeChallenge(codeVerifier);\n\t\turl.searchParams.set(\"code_challenge_method\", \"S256\");\n\t\turl.searchParams.set(\"code_challenge\", codeChallenge);\n\t}\n\tif (claims) {\n\t\tconst claimsObj = claims.reduce(\n\t\t\t(acc, claim) => {\n\t\t\t\tacc[claim] = null;\n\t\t\t\treturn acc;\n\t\t\t},\n\t\t\t{} as Record<string, null>,\n\t\t);\n\t\turl.searchParams.set(\n\t\t\t\"claims\",\n\t\t\tJSON.stringify({\n\t\t\t\tid_token: { email: null, email_verified: null, ...claimsObj },\n\t\t\t}),\n\t\t);\n\t}\n\tif (additionalParams) {\n\t\tObject.entries(additionalParams).forEach(([key, value]) => {\n\t\t\turl.searchParams.set(key, value);\n\t\t});\n\t}\n\treturn url;\n}\n"],"mappings":";;;AAGA,eAAsB,uBAAuB,EAC5C,IACA,SACA,uBACA,OACA,cACA,QACA,QACA,aACA,UACA,QACA,YACA,cACA,SACA,WACA,IACA,cACA,kBACA,eAoBE;CACF,MAAM,MAAM,IAAI,IAAI,QAAQ,yBAAyB,sBAAsB;AAC3E,KAAI,aAAa,IAAI,iBAAiB,gBAAgB,OAAO;CAC7D,MAAM,kBAAkB,MAAM,QAAQ,QAAQ,SAAS,GACpD,QAAQ,SAAS,KACjB,QAAQ;AACX,KAAI,aAAa,IAAI,aAAa,gBAAgB;AAClD,KAAI,aAAa,IAAI,SAAS,MAAM;AACpC,KAAI,OACH,KAAI,aAAa,IAAI,SAAS,OAAO,KAAK,eAAe,IAAI,CAAC;AAE/D,KAAI,aAAa,IAAI,gBAAgB,QAAQ,eAAe,YAAY;AACxE,aAAY,IAAI,aAAa,IAAI,YAAY,SAAS;AACtD,YAAW,IAAI,aAAa,IAAI,WAAW,QAAQ;AACnD,cAAa,IAAI,aAAa,IAAI,cAAc,UAAU;AAC1D,WAAU,IAAI,aAAa,IAAI,UAAU,OAAO;AAChD,OAAM,IAAI,aAAa,IAAI,MAAM,GAAG;AACpC,eAAc,IAAI,aAAa,IAAI,eAAe,WAAW;AAC7D,iBAAgB,IAAI,aAAa,IAAI,iBAAiB,aAAa;AACnE,KAAI,cAAc;EACjB,MAAM,gBAAgB,MAAM,sBAAsB,aAAa;AAC/D,MAAI,aAAa,IAAI,yBAAyB,OAAO;AACrD,MAAI,aAAa,IAAI,kBAAkB,cAAc;;AAEtD,KAAI,QAAQ;EACX,MAAM,YAAY,OAAO,QACvB,KAAK,UAAU;AACf,OAAI,SAAS;AACb,UAAO;KAER,EAAE,CACF;AACD,MAAI,aAAa,IAChB,UACA,KAAK,UAAU,EACd,UAAU;GAAE,OAAO;GAAM,gBAAgB;GAAM,GAAG;GAAW,EAC7D,CAAC,CACF;;AAEF,KAAI,iBACH,QAAO,QAAQ,iBAAiB,CAAC,SAAS,CAAC,KAAK,WAAW;AAC1D,MAAI,aAAa,IAAI,KAAK,MAAM;GAC/B;AAEH,QAAO"}

package/dist/oauth2/index.d.mts

@@ -0,0 +1,8 @@
+import { OAuth2Tokens, OAuth2UserInfo, OAuthProvider, ProviderOptions } from "./oauth-provider.mjs";
+import { clientCredentialsToken, createClientCredentialsTokenRequest } from "./client-credentials-token.mjs";
+import { createAuthorizationURL } from "./create-authorization-url.mjs";
+import { createRefreshAccessTokenRequest, refreshAccessToken } from "./refresh-access-token.mjs";
+import { generateCodeChallenge, getOAuth2Tokens } from "./utils.mjs";
+import { createAuthorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
+import { getJwks, verifyAccessToken, verifyJwsAccessToken } from "./verify.mjs";
+export { type OAuth2Tokens, type OAuth2UserInfo, type OAuthProvider, type ProviderOptions, clientCredentialsToken, createAuthorizationCodeRequest, createAuthorizationURL, createClientCredentialsTokenRequest, createRefreshAccessTokenRequest, generateCodeChallenge, getJwks, getOAuth2Tokens, refreshAccessToken, validateAuthorizationCode, validateToken, verifyAccessToken, verifyJwsAccessToken };

package/dist/oauth2/index.mjs

@@ -0,0 +1,8 @@
+import { clientCredentialsToken, createClientCredentialsTokenRequest } from "./client-credentials-token.mjs";
+import { generateCodeChallenge, getOAuth2Tokens } from "./utils.mjs";
+import { createAuthorizationURL } from "./create-authorization-url.mjs";
+import { createRefreshAccessTokenRequest, refreshAccessToken } from "./refresh-access-token.mjs";
+import { createAuthorizationCodeRequest, validateAuthorizationCode, validateToken } from "./validate-authorization-code.mjs";
+import { getJwks, verifyAccessToken, verifyJwsAccessToken } from "./verify.mjs";
+
+export { clientCredentialsToken, createAuthorizationCodeRequest, createAuthorizationURL, createClientCredentialsTokenRequest, createRefreshAccessTokenRequest, generateCodeChallenge, getJwks, getOAuth2Tokens, refreshAccessToken, validateAuthorizationCode, validateToken, verifyAccessToken, verifyJwsAccessToken };