better-auth 1.3.9-beta.2 → 1.3.9-beta.4

package/dist/plugins/email-otp/index.d.cts

@@ -1,10 +1,9 @@
 import * as better_call from 'better-call';
-import { h as AuthContext, U as User, H as HookEndpointContext } from '../../shared/better-auth.DGuotwA1.cjs';
+import { h as AuthContext, U as User, H as HookEndpointContext } from '../../shared/better-auth.6crrbXrP.cjs';
 import * as z from 'zod/v4';
 import 'kysely';
 import '../../shared/better-auth.DTtXpZYr.cjs';
-import '../../shared/better-auth.CTMmErGI.cjs';
-import 'jose';
+import '../../shared/better-auth.BaMSx6K3.cjs';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';

package/dist/plugins/email-otp/index.d.mts

@@ -1,10 +1,9 @@
 import * as better_call from 'better-call';
-import { h as AuthContext, U as User, H as HookEndpointContext } from '../../shared/better-auth.f-bUldRg.mjs';
+import { h as AuthContext, U as User, H as HookEndpointContext } from '../../shared/better-auth.YK5LQtFt.mjs';
 import * as z from 'zod/v4';
 import 'kysely';
 import '../../shared/better-auth.DTtXpZYr.mjs';
-import '../../shared/better-auth.ZUo2dMO3.mjs';
-import 'jose';
+import '../../shared/better-auth.DR57bygo.mjs';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';

package/dist/plugins/email-otp/index.d.ts

@@ -1,10 +1,9 @@
 import * as better_call from 'better-call';
-import { h as AuthContext, U as User, H as HookEndpointContext } from '../../shared/better-auth.DU2vRHKI.js';
+import { h as AuthContext, U as User, H as HookEndpointContext } from '../../shared/better-auth.S3lnSz8Y.js';
 import * as z from 'zod/v4';
 import 'kysely';
 import '../../shared/better-auth.DTtXpZYr.js';
-import '../../shared/better-auth.mA4L_-fq.js';
-import 'jose';
+import '../../shared/better-auth.B5FL4Q2B.js';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';

package/dist/plugins/email-otp/index.mjs

@@ -1,6 +1,6 @@
 import * as z from 'zod/v4';
 import { APIError } from 'better-call';
-import '../../shared/better-auth.B3CPLvGC.mjs';
+import '../../shared/better-auth.CSEecXfV.mjs';
 import { a as createAuthEndpoint, c as createAuthMiddleware } from '../../shared/better-auth.DV5EHeYG.mjs';
 import { s as setSessionCookie } from '../../shared/better-auth.UfVWArIB.mjs';
 import '../../shared/better-auth.Dcv8PS7T.mjs';
@@ -14,13 +14,12 @@ import { base64Url } from '@better-auth/utils/base64';
 import { g as generateRandomString } from '../../shared/better-auth.B4Qoxdgc.mjs';
 import '@better-fetch/fetch';
 import 'jose';
-import '@noble/ciphers/chacha';
-import '@noble/ciphers/utils';
-import '@noble/ciphers/webcrypto';
-import '@noble/hashes/scrypt';
+import '@noble/ciphers/chacha.js';
+import '@noble/ciphers/utils.js';
+import '@noble/hashes/scrypt.js';
 import '@better-auth/utils';
 import '@better-auth/utils/hex';
-import '@noble/hashes/utils';
+import '@noble/hashes/utils.js';
 import '../../shared/better-auth.CuS_eDdK.mjs';
 import '../../shared/better-auth.DdzSJf-n.mjs';
 import 'jose/errors';

package/dist/plugins/generic-oauth/index.cjs

@@ -4,7 +4,7 @@ const fetch = require('@better-fetch/fetch');
 const betterCall = require('better-call');
 const jose = require('jose');
 const z = require('zod/v4');
-const socialProviders_index = require('../../shared/better-auth.Dc0nj0we.cjs');
+const socialProviders_index = require('../../shared/better-auth.BlsHS68J.cjs');
 const session = require('../../shared/better-auth.CLv80Pwz.cjs');
 const cookies_index = require('../../shared/better-auth.D5q0JUiv.cjs');
 require('../../shared/better-auth.gN3g-znU.cjs');
@@ -12,13 +12,12 @@ require('../../shared/better-auth.B6fIklBU.cjs');
 require('../../shared/better-auth.B3274wGK.cjs');
 require('@better-auth/utils/hash');
 require('@better-auth/utils/base64');
-require('@noble/ciphers/chacha');
-require('@noble/ciphers/utils');
-require('@noble/ciphers/webcrypto');
-require('@noble/hashes/scrypt');
+require('@noble/ciphers/chacha.js');
+require('@noble/ciphers/utils.js');
+require('@noble/hashes/scrypt.js');
 require('@better-auth/utils');
 require('@better-auth/utils/hex');
-require('@noble/hashes/utils');
+require('@noble/hashes/utils.js');
 require('../../shared/better-auth.CYeOI8C-.cjs');
 require('../../shared/better-auth.C1hdVENX.cjs');
 require('../../crypto/index.cjs');

package/dist/plugins/generic-oauth/index.d.cts

@@ -1,9 +1,8 @@
 import * as better_call from 'better-call';
-import { O as OAuth2Tokens, a as OAuth2UserInfo, b as OAuthProvider, P as ProviderOptions } from '../../shared/better-auth.CTMmErGI.cjs';
-import { U as User, h as AuthContext } from '../../shared/better-auth.DGuotwA1.cjs';
+import { O as OAuth2Tokens, a as OAuth2UserInfo, b as OAuthProvider, P as ProviderOptions } from '../../shared/better-auth.BaMSx6K3.cjs';
+import { U as User, h as AuthContext } from '../../shared/better-auth.6crrbXrP.cjs';
 import * as z from 'zod/v4';
 import '../../shared/better-auth.DTtXpZYr.cjs';
-import 'jose';
 import 'kysely';
 import 'zod/v4/core';
 import 'zod';

package/dist/plugins/generic-oauth/index.d.mts

@@ -1,9 +1,8 @@
 import * as better_call from 'better-call';
-import { O as OAuth2Tokens, a as OAuth2UserInfo, b as OAuthProvider, P as ProviderOptions } from '../../shared/better-auth.ZUo2dMO3.mjs';
-import { U as User, h as AuthContext } from '../../shared/better-auth.f-bUldRg.mjs';
+import { O as OAuth2Tokens, a as OAuth2UserInfo, b as OAuthProvider, P as ProviderOptions } from '../../shared/better-auth.DR57bygo.mjs';
+import { U as User, h as AuthContext } from '../../shared/better-auth.YK5LQtFt.mjs';
 import * as z from 'zod/v4';
 import '../../shared/better-auth.DTtXpZYr.mjs';
-import 'jose';
 import 'kysely';
 import 'zod/v4/core';
 import 'zod';

package/dist/plugins/generic-oauth/index.d.ts

@@ -1,9 +1,8 @@
 import * as better_call from 'better-call';
-import { O as OAuth2Tokens, a as OAuth2UserInfo, b as OAuthProvider, P as ProviderOptions } from '../../shared/better-auth.mA4L_-fq.js';
-import { U as User, h as AuthContext } from '../../shared/better-auth.DU2vRHKI.js';
+import { O as OAuth2Tokens, a as OAuth2UserInfo, b as OAuthProvider, P as ProviderOptions } from '../../shared/better-auth.B5FL4Q2B.js';
+import { U as User, h as AuthContext } from '../../shared/better-auth.S3lnSz8Y.js';
 import * as z from 'zod/v4';
 import '../../shared/better-auth.DTtXpZYr.js';
-import 'jose';
 import 'kysely';
 import 'zod/v4/core';
 import 'zod';

package/dist/plugins/generic-oauth/index.mjs

@@ -2,7 +2,7 @@ import { betterFetch } from '@better-fetch/fetch';
 import { APIError } from 'better-call';
 import { decodeJwt } from 'jose';
 import * as z from 'zod/v4';
-import { g as generateState, c as createAuthorizationURL, p as parseState, v as validateAuthorizationCode, j as handleOAuthUserInfo, r as refreshAccessToken } from '../../shared/better-auth.B3CPLvGC.mjs';
+import { g as generateState, c as createAuthorizationURL, p as parseState, v as validateAuthorizationCode, j as handleOAuthUserInfo, r as refreshAccessToken } from '../../shared/better-auth.CSEecXfV.mjs';
 import { a as createAuthEndpoint, s as sessionMiddleware, B as BASE_ERROR_CODES } from '../../shared/better-auth.DV5EHeYG.mjs';
 import { s as setSessionCookie } from '../../shared/better-auth.UfVWArIB.mjs';
 import '../../shared/better-auth.Dcv8PS7T.mjs';
@@ -10,13 +10,12 @@ import '../../shared/better-auth.CMQ3rA-I.mjs';
 import '../../shared/better-auth.BjBlybv-.mjs';
 import '@better-auth/utils/hash';
 import '@better-auth/utils/base64';
-import '@noble/ciphers/chacha';
-import '@noble/ciphers/utils';
-import '@noble/ciphers/webcrypto';
-import '@noble/hashes/scrypt';
+import '@noble/ciphers/chacha.js';
+import '@noble/ciphers/utils.js';
+import '@noble/hashes/scrypt.js';
 import '@better-auth/utils';
 import '@better-auth/utils/hex';
-import '@noble/hashes/utils';
+import '@noble/hashes/utils.js';
 import '../../shared/better-auth.B4Qoxdgc.mjs';
 import '../../shared/better-auth.CW6D9eSx.mjs';
 import '../../crypto/index.mjs';

package/dist/plugins/haveibeenpwned/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 const betterCall = require('better-call');
-require('../../shared/better-auth.Dc0nj0we.cjs');
+require('../../shared/better-auth.BlsHS68J.cjs');
 require('../../shared/better-auth.CLv80Pwz.cjs');
 require('zod/v4');
 require('../../shared/better-auth.B6fIklBU.cjs');
@@ -14,14 +14,13 @@ const hash = require('@better-auth/utils/hash');
 const fetch = require('@better-fetch/fetch');
 require('../../shared/better-auth.C1hdVENX.cjs');
 require('../../crypto/index.cjs');
-require('@noble/ciphers/chacha');
-require('@noble/ciphers/utils');
-require('@noble/ciphers/webcrypto');
+require('@noble/ciphers/chacha.js');
+require('@noble/ciphers/utils.js');
 require('jose');
-require('@noble/hashes/scrypt');
+require('@noble/hashes/scrypt.js');
 require('@better-auth/utils');
 require('@better-auth/utils/hex');
-require('@noble/hashes/utils');
+require('@noble/hashes/utils.js');
 require('../../shared/better-auth.ANpbi45u.cjs');
 require('../../shared/better-auth.CYeOI8C-.cjs');
 require('@better-auth/utils/random');

package/dist/plugins/haveibeenpwned/index.d.cts

@@ -1,10 +1,9 @@
-import { h as AuthContext, k as checkPassword } from '../../shared/better-auth.DGuotwA1.cjs';
+import { h as AuthContext, k as checkPassword } from '../../shared/better-auth.6crrbXrP.cjs';
 import 'kysely';
 import 'better-call';
 import 'zod/v4';
 import '../../shared/better-auth.DTtXpZYr.cjs';
-import '../../shared/better-auth.CTMmErGI.cjs';
-import 'jose';
+import '../../shared/better-auth.BaMSx6K3.cjs';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -1,10 +1,9 @@
-import { h as AuthContext, k as checkPassword } from '../../shared/better-auth.f-bUldRg.mjs';
+import { h as AuthContext, k as checkPassword } from '../../shared/better-auth.YK5LQtFt.mjs';
 import 'kysely';
 import 'better-call';
 import 'zod/v4';
 import '../../shared/better-auth.DTtXpZYr.mjs';
-import '../../shared/better-auth.ZUo2dMO3.mjs';
-import 'jose';
+import '../../shared/better-auth.DR57bygo.mjs';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';

package/dist/plugins/haveibeenpwned/index.d.ts

@@ -1,10 +1,9 @@
-import { h as AuthContext, k as checkPassword } from '../../shared/better-auth.DU2vRHKI.js';
+import { h as AuthContext, k as checkPassword } from '../../shared/better-auth.S3lnSz8Y.js';
 import 'kysely';
 import 'better-call';
 import 'zod/v4';
 import '../../shared/better-auth.DTtXpZYr.js';
-import '../../shared/better-auth.mA4L_-fq.js';
-import 'jose';
+import '../../shared/better-auth.B5FL4Q2B.js';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';

package/dist/plugins/haveibeenpwned/index.mjs

@@ -1,5 +1,5 @@
 import { APIError } from 'better-call';
-import '../../shared/better-auth.B3CPLvGC.mjs';
+import '../../shared/better-auth.CSEecXfV.mjs';
 import '../../shared/better-auth.DV5EHeYG.mjs';
 import 'zod/v4';
 import '../../shared/better-auth.CMQ3rA-I.mjs';
@@ -12,14 +12,13 @@ import { createHash } from '@better-auth/utils/hash';
 import { betterFetch } from '@better-fetch/fetch';
 import '../../shared/better-auth.CW6D9eSx.mjs';
 import '../../crypto/index.mjs';
-import '@noble/ciphers/chacha';
-import '@noble/ciphers/utils';
-import '@noble/ciphers/webcrypto';
+import '@noble/ciphers/chacha.js';
+import '@noble/ciphers/utils.js';
 import 'jose';
-import '@noble/hashes/scrypt';
+import '@noble/hashes/scrypt.js';
 import '@better-auth/utils';
 import '@better-auth/utils/hex';
-import '@noble/hashes/utils';
+import '@noble/hashes/utils.js';
 import '../../shared/better-auth.DdzSJf-n.mjs';
 import '../../shared/better-auth.B4Qoxdgc.mjs';
 import '@better-auth/utils/random';

package/dist/plugins/index.cjs

@@ -1,15 +1,15 @@
 'use strict';
 
-const organization = require('../shared/better-auth.DFJOJkY1.cjs');
+const organization = require('../shared/better-auth.CtgUZb45.cjs');
 const plugins_twoFactor_index = require('./two-factor/index.cjs');
 const plugins_username_index = require('./username/index.cjs');
 const plugins_bearer_index = require('./bearer/index.cjs');
 const session = require('../shared/better-auth.CLv80Pwz.cjs');
-const socialProviders_index = require('../shared/better-auth.Dc0nj0we.cjs');
+const socialProviders_index = require('../shared/better-auth.BlsHS68J.cjs');
 const plugins_magicLink_index = require('./magic-link/index.cjs');
 const plugins_phoneNumber_index = require('./phone-number/index.cjs');
 const plugins_anonymous_index = require('./anonymous/index.cjs');
-const admin = require('../shared/better-auth.TZOo7890.cjs');
+const admin = require('../shared/better-auth.BVUwL7ru.cjs');
 const plugins_genericOauth_index = require('./generic-oauth/index.cjs');
 const plugins_jwt_index = require('./jwt/index.cjs');
 const plugins_multiSession_index = require('./multi-session/index.cjs');
@@ -18,9 +18,9 @@ const plugins_oneTap_index = require('./one-tap/index.cjs');
 const plugins_oauthProxy_index = require('./oauth-proxy/index.cjs');
 const plugins_customSession_index = require('./custom-session/index.cjs');
 const plugins_openApi_index = require('./open-api/index.cjs');
-const plugins_oidcProvider_index = require('../shared/better-auth.DtZRMuXL.cjs');
+const plugins_oidcProvider_index = require('../shared/better-auth.CRFFLEbh.cjs');
 const plugins_captcha_index = require('./captcha/index.cjs');
-const plugins_oneTimeToken_index = require('../shared/better-auth.DTV9hYzN.cjs');
+const plugins_oneTimeToken_index = require('../shared/better-auth.CdLjcJ6z.cjs');
 const plugins_haveibeenpwned_index = require('./haveibeenpwned/index.cjs');
 const z = require('zod/v4');
 const betterCall = require('better-call');
@@ -32,34 +32,33 @@ const url = require('../shared/better-auth.DRmln2Nr.cjs');
 require('@better-auth/utils/binary');
 const cookies_index = require('../shared/better-auth.D5q0JUiv.cjs');
 require('../shared/better-auth.gN3g-znU.cjs');
-require('../shared/better-auth.BWzwHY8m.cjs');
+require('../shared/better-auth.DPsIzckY.cjs');
 require('./organization/access/index.cjs');
 require('@better-auth/utils/random');
 const hash = require('@better-auth/utils/hash');
-require('@noble/ciphers/chacha');
-require('@noble/ciphers/utils');
-require('@noble/ciphers/webcrypto');
+require('@noble/ciphers/chacha.js');
+require('@noble/ciphers/utils.js');
 const jose = require('jose');
-require('@noble/hashes/scrypt');
+require('@noble/hashes/scrypt.js');
 const utils = require('@better-auth/utils');
 require('@better-auth/utils/hex');
-require('@noble/hashes/utils');
+require('@noble/hashes/utils.js');
 const random = require('../shared/better-auth.CYeOI8C-.cjs');
 require('kysely');
 require('@better-auth/utils/otp');
 require('./admin/access/index.cjs');
 require('@better-fetch/fetch');
 require('zod');
-require('@noble/hashes/sha3');
+require('@noble/hashes/sha3.js');
 const plugins_deviceAuthorization_index = require('./device-authorization/index.cjs');
 const plugins_siwe_index = require('./siwe/index.cjs');
 const client = require('../shared/better-auth.DnER2-iT.cjs');
-const sign = require('../shared/better-auth.BvYLXwvp.cjs');
+const sign = require('../shared/better-auth.CMwM5enp.cjs');
 const client$1 = require('../shared/better-auth.BMgeJg3r.cjs');
 require('../shared/better-auth.C1hdVENX.cjs');
 require('../shared/better-auth.ANpbi45u.cjs');
 require('../shared/better-auth.DhsGZ30Q.cjs');
-require('../shared/better-auth.B1yOWNP8.cjs');
+require('../shared/better-auth.DEKJQy4E.cjs');
 require('../shared/better-auth.CpS2FLSa.cjs');
 require('../crypto/index.cjs');
 require('../shared/better-auth.CDXNofOe.cjs');
@@ -1066,7 +1065,7 @@ const withMcpAuth = (auth, handler) => {
     const session = await auth.api.getMcpSession({
       headers: req.headers
     });
-    const wwwAuthenticateValue = `Bearer resource_metadata=${baseURL}/api/auth/.well-known/oauth-protected-resource`;
+    const wwwAuthenticateValue = `Bearer resource_metadata="${baseURL}/.well-known/oauth-protected-resource"`;
     if (!session) {
       return Response.json(
         {
@@ -1081,7 +1080,9 @@ const withMcpAuth = (auth, handler) => {
         {
           status: 401,
           headers: {
-            "WWW-Authenticate": wwwAuthenticateValue
+            "WWW-Authenticate": wwwAuthenticateValue,
+            // we also add this headers otherwise browser based clients will not be able to read the `www-authenticate` header
+            "Access-Control-Expose-Headers": "WWW-Authenticate"
           }
         }
       );

package/dist/plugins/index.d.cts

@@ -3,8 +3,8 @@ export { adminAc, defaultAc, defaultRoles, defaultStatements, memberAc, ownerAc
 export { TWO_FACTOR_ERROR_CODES, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor, twoFactor, twoFactorClient } from './two-factor/index.cjs';
 export { USERNAME_ERROR_CODES, UsernameOptions, username } from './username/index.cjs';
 export { bearer } from './bearer/index.cjs';
-import { G as GenericEndpointContext, B as BetterAuthOptions, h as AuthContext } from '../shared/better-auth.DGuotwA1.cjs';
-export { z as AuthEndpoint, D as AuthMiddleware, v as AuthPluginSchema, r as BetterAuthPlugin, I as InferOptionSchema, t as InferPluginErrorCodes, y as createAuthEndpoint, x as createAuthMiddleware, w as optionsMiddleware } from '../shared/better-auth.DGuotwA1.cjs';
+import { G as GenericEndpointContext, B as BetterAuthOptions, h as AuthContext } from '../shared/better-auth.6crrbXrP.cjs';
+export { z as AuthEndpoint, D as AuthMiddleware, v as AuthPluginSchema, r as BetterAuthPlugin, I as InferOptionSchema, t as InferPluginErrorCodes, y as createAuthEndpoint, x as createAuthMiddleware, w as optionsMiddleware } from '../shared/better-auth.6crrbXrP.cjs';
 export { H as HIDE_METADATA } from '../shared/better-auth.DEHJp1rk.cjs';
 export { magicLink } from './magic-link/index.cjs';
 export { PhoneNumberOptions, UserWithPhoneNumber, phoneNumber } from './phone-number/index.cjs';
@@ -21,7 +21,7 @@ export { OpenAPIOptions, Path, generator, openAPI } from './open-api/index.cjs';
 import { OIDCOptions, OIDCMetadata, OAuthAccessToken } from './oidc-provider/index.cjs';
 export { AuthorizationQuery, Client, CodeVerificationValue, TokenBody, getClient, getMetadata, oidcProvider } from './oidc-provider/index.cjs';
 export { captcha } from './captcha/index.cjs';
-export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher } from '../shared/better-auth.llWU4_4y.cjs';
+export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher } from '../shared/better-auth.UcasWcPe.cjs';
 export { HaveIBeenPwnedOptions, haveIBeenPwned } from './haveibeenpwned/index.cjs';
 export { oneTimeToken } from './one-time-token/index.cjs';
 import * as better_call from 'better-call';
@@ -32,13 +32,13 @@ import './access/index.cjs';
 import '../shared/better-auth.DTtXpZYr.cjs';
 import '@better-fetch/fetch';
 import 'kysely';
-import '../shared/better-auth.CTMmErGI.cjs';
-import 'jose';
+import '../shared/better-auth.BaMSx6K3.cjs';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';
 import 'bun:sqlite';
 import 'node:sqlite';
+import 'jose';
 
 interface MCPOptions {
     loginPage: string;
@@ -267,7 +267,7 @@ declare const mcp: (options: MCPOptions) => {
                     redirect_uris: string[];
                     token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post" | undefined;
                     grant_types?: ("authorization_code" | "password" | "refresh_token" | "implicit" | "client_credentials" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[] | undefined;
-                    response_types?: ("token" | "code")[] | undefined;
+                    response_types?: ("code" | "token")[] | undefined;
                     client_name?: string | undefined;
                     client_uri?: string | undefined;
                     logo_uri?: string | undefined;
@@ -323,8 +323,8 @@ declare const mcp: (options: MCPOptions) => {
                         "urn:ietf:params:oauth:grant-type:saml2-bearer": "urn:ietf:params:oauth:grant-type:saml2-bearer";
                     }>>>>;
                     response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-                        token: "token";
                         code: "code";
+                        token: "token";
                     }>>>>;
                     client_name: z.ZodOptional<z.ZodString>;
                     client_uri: z.ZodOptional<z.ZodString>;

package/dist/plugins/index.d.mts

@@ -3,8 +3,8 @@ export { adminAc, defaultAc, defaultRoles, defaultStatements, memberAc, ownerAc
 export { TWO_FACTOR_ERROR_CODES, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor, twoFactor, twoFactorClient } from './two-factor/index.mjs';
 export { USERNAME_ERROR_CODES, UsernameOptions, username } from './username/index.mjs';
 export { bearer } from './bearer/index.mjs';
-import { G as GenericEndpointContext, B as BetterAuthOptions, h as AuthContext } from '../shared/better-auth.f-bUldRg.mjs';
-export { z as AuthEndpoint, D as AuthMiddleware, v as AuthPluginSchema, r as BetterAuthPlugin, I as InferOptionSchema, t as InferPluginErrorCodes, y as createAuthEndpoint, x as createAuthMiddleware, w as optionsMiddleware } from '../shared/better-auth.f-bUldRg.mjs';
+import { G as GenericEndpointContext, B as BetterAuthOptions, h as AuthContext } from '../shared/better-auth.YK5LQtFt.mjs';
+export { z as AuthEndpoint, D as AuthMiddleware, v as AuthPluginSchema, r as BetterAuthPlugin, I as InferOptionSchema, t as InferPluginErrorCodes, y as createAuthEndpoint, x as createAuthMiddleware, w as optionsMiddleware } from '../shared/better-auth.YK5LQtFt.mjs';
 export { H as HIDE_METADATA } from '../shared/better-auth.DEHJp1rk.mjs';
 export { magicLink } from './magic-link/index.mjs';
 export { PhoneNumberOptions, UserWithPhoneNumber, phoneNumber } from './phone-number/index.mjs';
@@ -21,7 +21,7 @@ export { OpenAPIOptions, Path, generator, openAPI } from './open-api/index.mjs';
 import { OIDCOptions, OIDCMetadata, OAuthAccessToken } from './oidc-provider/index.mjs';
 export { AuthorizationQuery, Client, CodeVerificationValue, TokenBody, getClient, getMetadata, oidcProvider } from './oidc-provider/index.mjs';
 export { captcha } from './captcha/index.mjs';
-export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher } from '../shared/better-auth.Df1_Wu_1.mjs';
+export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher } from '../shared/better-auth.eYki6XKk.mjs';
 export { HaveIBeenPwnedOptions, haveIBeenPwned } from './haveibeenpwned/index.mjs';
 export { oneTimeToken } from './one-time-token/index.mjs';
 import * as better_call from 'better-call';
@@ -32,13 +32,13 @@ import './access/index.mjs';
 import '../shared/better-auth.DTtXpZYr.mjs';
 import '@better-fetch/fetch';
 import 'kysely';
-import '../shared/better-auth.ZUo2dMO3.mjs';
-import 'jose';
+import '../shared/better-auth.DR57bygo.mjs';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';
 import 'bun:sqlite';
 import 'node:sqlite';
+import 'jose';
 
 interface MCPOptions {
     loginPage: string;
@@ -267,7 +267,7 @@ declare const mcp: (options: MCPOptions) => {
                     redirect_uris: string[];
                     token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post" | undefined;
                     grant_types?: ("authorization_code" | "password" | "refresh_token" | "implicit" | "client_credentials" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[] | undefined;
-                    response_types?: ("token" | "code")[] | undefined;
+                    response_types?: ("code" | "token")[] | undefined;
                     client_name?: string | undefined;
                     client_uri?: string | undefined;
                     logo_uri?: string | undefined;
@@ -323,8 +323,8 @@ declare const mcp: (options: MCPOptions) => {
                         "urn:ietf:params:oauth:grant-type:saml2-bearer": "urn:ietf:params:oauth:grant-type:saml2-bearer";
                     }>>>>;
                     response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-                        token: "token";
                         code: "code";
+                        token: "token";
                     }>>>>;
                     client_name: z.ZodOptional<z.ZodString>;
                     client_uri: z.ZodOptional<z.ZodString>;

package/dist/plugins/index.d.ts

@@ -3,8 +3,8 @@ export { adminAc, defaultAc, defaultRoles, defaultStatements, memberAc, ownerAc
 export { TWO_FACTOR_ERROR_CODES, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor, twoFactor, twoFactorClient } from './two-factor/index.js';
 export { USERNAME_ERROR_CODES, UsernameOptions, username } from './username/index.js';
 export { bearer } from './bearer/index.js';
-import { G as GenericEndpointContext, B as BetterAuthOptions, h as AuthContext } from '../shared/better-auth.DU2vRHKI.js';
-export { z as AuthEndpoint, D as AuthMiddleware, v as AuthPluginSchema, r as BetterAuthPlugin, I as InferOptionSchema, t as InferPluginErrorCodes, y as createAuthEndpoint, x as createAuthMiddleware, w as optionsMiddleware } from '../shared/better-auth.DU2vRHKI.js';
+import { G as GenericEndpointContext, B as BetterAuthOptions, h as AuthContext } from '../shared/better-auth.S3lnSz8Y.js';
+export { z as AuthEndpoint, D as AuthMiddleware, v as AuthPluginSchema, r as BetterAuthPlugin, I as InferOptionSchema, t as InferPluginErrorCodes, y as createAuthEndpoint, x as createAuthMiddleware, w as optionsMiddleware } from '../shared/better-auth.S3lnSz8Y.js';
 export { H as HIDE_METADATA } from '../shared/better-auth.DEHJp1rk.js';
 export { magicLink } from './magic-link/index.js';
 export { PhoneNumberOptions, UserWithPhoneNumber, phoneNumber } from './phone-number/index.js';
@@ -21,7 +21,7 @@ export { OpenAPIOptions, Path, generator, openAPI } from './open-api/index.js';
 import { OIDCOptions, OIDCMetadata, OAuthAccessToken } from './oidc-provider/index.js';
 export { AuthorizationQuery, Client, CodeVerificationValue, TokenBody, getClient, getMetadata, oidcProvider } from './oidc-provider/index.js';
 export { captcha } from './captcha/index.js';
-export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher } from '../shared/better-auth.WOu5GuAp.js';
+export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher } from '../shared/better-auth.DtrrQDoO.js';
 export { HaveIBeenPwnedOptions, haveIBeenPwned } from './haveibeenpwned/index.js';
 export { oneTimeToken } from './one-time-token/index.js';
 import * as better_call from 'better-call';
@@ -32,13 +32,13 @@ import './access/index.js';
 import '../shared/better-auth.DTtXpZYr.js';
 import '@better-fetch/fetch';
 import 'kysely';
-import '../shared/better-auth.mA4L_-fq.js';
-import 'jose';
+import '../shared/better-auth.B5FL4Q2B.js';
 import 'zod/v4/core';
 import 'zod';
 import 'better-sqlite3';
 import 'bun:sqlite';
 import 'node:sqlite';
+import 'jose';
 
 interface MCPOptions {
     loginPage: string;
@@ -267,7 +267,7 @@ declare const mcp: (options: MCPOptions) => {
                     redirect_uris: string[];
                     token_endpoint_auth_method?: "none" | "client_secret_basic" | "client_secret_post" | undefined;
                     grant_types?: ("authorization_code" | "password" | "refresh_token" | "implicit" | "client_credentials" | "urn:ietf:params:oauth:grant-type:jwt-bearer" | "urn:ietf:params:oauth:grant-type:saml2-bearer")[] | undefined;
-                    response_types?: ("token" | "code")[] | undefined;
+                    response_types?: ("code" | "token")[] | undefined;
                     client_name?: string | undefined;
                     client_uri?: string | undefined;
                     logo_uri?: string | undefined;
@@ -323,8 +323,8 @@ declare const mcp: (options: MCPOptions) => {
                         "urn:ietf:params:oauth:grant-type:saml2-bearer": "urn:ietf:params:oauth:grant-type:saml2-bearer";
                     }>>>>;
                     response_types: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<{
-                        token: "token";
                         code: "code";
+                        token: "token";
                     }>>>>;
                     client_name: z.ZodOptional<z.ZodString>;
                     client_uri: z.ZodOptional<z.ZodString>;

package/dist/plugins/index.mjs

@@ -1,14 +1,14 @@
-export { o as organization, p as parseRoles } from '../shared/better-auth.BlqpEUaH.mjs';
+export { o as organization, p as parseRoles } from '../shared/better-auth.BZTBs9Yy.mjs';
 export { TWO_FACTOR_ERROR_CODES, twoFactor } from './two-factor/index.mjs';
 export { USERNAME_ERROR_CODES, username } from './username/index.mjs';
 export { bearer } from './bearer/index.mjs';
 import { g as getSessionFromCtx, a as createAuthEndpoint, c as createAuthMiddleware } from '../shared/better-auth.DV5EHeYG.mjs';
 export { o as optionsMiddleware } from '../shared/better-auth.DV5EHeYG.mjs';
-export { H as HIDE_METADATA } from '../shared/better-auth.B3CPLvGC.mjs';
+export { H as HIDE_METADATA } from '../shared/better-auth.CSEecXfV.mjs';
 export { magicLink } from './magic-link/index.mjs';
 export { phoneNumber } from './phone-number/index.mjs';
 export { anonymous } from './anonymous/index.mjs';
-export { a as admin } from '../shared/better-auth.B8UjXTUa.mjs';
+export { a as admin } from '../shared/better-auth.CtB1M_c7.mjs';
 export { genericOAuth } from './generic-oauth/index.mjs';
 export { jwt } from './jwt/index.mjs';
 export { multiSession } from './multi-session/index.mjs';
@@ -17,10 +17,10 @@ export { oneTap } from './one-tap/index.mjs';
 export { oAuthProxy } from './oauth-proxy/index.mjs';
 export { customSession } from './custom-session/index.mjs';
 export { openAPI } from './open-api/index.mjs';
-import { o as oidcProvider, s as schema } from '../shared/better-auth.3K3VNUn3.mjs';
-export { g as getClient, a as getMetadata } from '../shared/better-auth.3K3VNUn3.mjs';
+import { o as oidcProvider, s as schema } from '../shared/better-auth.D9PzlwY_.mjs';
+export { g as getClient, a as getMetadata } from '../shared/better-auth.D9PzlwY_.mjs';
 export { captcha } from './captcha/index.mjs';
-export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher, o as oneTimeToken } from '../shared/better-auth.DDDKwecE.mjs';
+export { A as API_KEY_TABLE_NAME, E as ERROR_CODES, a as apiKey, d as defaultKeyHasher, o as oneTimeToken } from '../shared/better-auth.DQ6bmgix.mjs';
 export { haveIBeenPwned } from './haveibeenpwned/index.mjs';
 import * as z from 'zod/v4';
 import { APIError } from 'better-call';
@@ -32,34 +32,33 @@ import { a as getBaseURL } from '../shared/better-auth.CuS_eDdK.mjs';
 import '@better-auth/utils/binary';
 import { p as parseSetCookieHeader } from '../shared/better-auth.UfVWArIB.mjs';
 import '../shared/better-auth.Dcv8PS7T.mjs';
-import '../shared/better-auth.Ck4qhtF6.mjs';
+import '../shared/better-auth.5WTE-uUO.mjs';
 import './organization/access/index.mjs';
 import '@better-auth/utils/random';
 import { createHash } from '@better-auth/utils/hash';
-import '@noble/ciphers/chacha';
-import '@noble/ciphers/utils';
-import '@noble/ciphers/webcrypto';
+import '@noble/ciphers/chacha.js';
+import '@noble/ciphers/utils.js';
 import { SignJWT } from 'jose';
-import '@noble/hashes/scrypt';
+import '@noble/hashes/scrypt.js';
 import { subtle } from '@better-auth/utils';
 import '@better-auth/utils/hex';
-import '@noble/hashes/utils';
+import '@noble/hashes/utils.js';
 import { g as generateRandomString } from '../shared/better-auth.B4Qoxdgc.mjs';
 import 'kysely';
 import '@better-auth/utils/otp';
 import './admin/access/index.mjs';
 import '@better-fetch/fetch';
 import 'zod';
-import '@noble/hashes/sha3';
+import '@noble/hashes/sha3.js';
 export { $deviceAuthorizationOptionsSchema, deviceAuthorization } from './device-authorization/index.mjs';
 export { siwe } from './siwe/index.mjs';
 export { t as twoFactorClient } from '../shared/better-auth.Ddw8bVyV.mjs';
-export { c as createJwk, b as generateExportedKeyPair, g as getJwtToken } from '../shared/better-auth.CY7-Inqt.mjs';
+export { c as createJwk, b as generateExportedKeyPair, g as getJwtToken } from '../shared/better-auth.DDuRjwGK.mjs';
 export { d as deviceAuthorizationClient } from '../shared/better-auth.BpA03GIs.mjs';
 import '../shared/better-auth.CW6D9eSx.mjs';
 import '../shared/better-auth.DdzSJf-n.mjs';
 import '../shared/better-auth.ffWeg50w.mjs';
-import '../shared/better-auth.BjjUH-Ka.mjs';
+import '../shared/better-auth.BWl2NB1B.mjs';
 import '../shared/better-auth.DrJWSFx6.mjs';
 import '../crypto/index.mjs';
 import '../shared/better-auth.YwDQhoPc.mjs';
@@ -1052,7 +1051,7 @@ const withMcpAuth = (auth, handler) => {
     const session = await auth.api.getMcpSession({
       headers: req.headers
     });
-    const wwwAuthenticateValue = `Bearer resource_metadata=${baseURL}/api/auth/.well-known/oauth-protected-resource`;
+    const wwwAuthenticateValue = `Bearer resource_metadata="${baseURL}/.well-known/oauth-protected-resource"`;
     if (!session) {
       return Response.json(
         {
@@ -1067,7 +1066,9 @@ const withMcpAuth = (auth, handler) => {
         {
           status: 401,
           headers: {
-            "WWW-Authenticate": wwwAuthenticateValue
+            "WWW-Authenticate": wwwAuthenticateValue,
+            // we also add this headers otherwise browser based clients will not be able to read the `www-authenticate` header
+            "Access-Control-Expose-Headers": "WWW-Authenticate"
           }
         }
       );