better-auth 1.6.1 → 1.6.3

package/dist/api/index.d.mts

@@ -249,7 +249,6 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
                 "application/json": {
                   schema: {
                     type: "object";
-                    nullable: boolean;
                     properties: {
                       session: {
                         $ref: string;
@@ -2239,7 +2238,6 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
                 "application/json": {
                   schema: {
                     type: "object";
-                    nullable: boolean;
                     properties: {
                       session: {
                         $ref: string;

package/dist/api/routes/account.mjs

@@ -1,6 +1,6 @@
 import { parseAccountOutput } from "../../db/schema.mjs";
-import { getAwaitableValue } from "../../context/helpers.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
 import { generateState } from "../../oauth2/state.mjs";
 import { decryptOAuthToken, setTokenUtil } from "../../oauth2/utils.mjs";
 import { freshSessionMiddleware, getSessionFromCtx, sessionMiddleware } from "./session.mjs";

package/dist/api/routes/callback.mjs

@@ -1,5 +1,5 @@
-import { getAwaitableValue } from "../../context/helpers.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
 import { parseState } from "../../oauth2/state.mjs";
 import { setTokenUtil } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
@@ -104,7 +104,7 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 			return redirectOnError("unable_to_link_account");
 		}
 		if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return redirectOnError("email_doesn't_match");
-		const existingAccount = await c.context.internalAdapter.findAccount(String(userInfo.id));
+		const existingAccount = await c.context.internalAdapter.findAccountByProviderId(String(userInfo.id), provider.id);
 		if (existingAccount) {
 			if (existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError("account_already_linked_to_different_user");
 			const updateData = Object.fromEntries(Object.entries({

package/dist/api/routes/email-verification.mjs

@@ -1,6 +1,6 @@
 import { originCheck } from "../middlewares/origin-check.mjs";
-import { parseUserOutput } from "../../db/schema.mjs";
 import { signJWT } from "../../crypto/jwt.mjs";
+import { parseUserOutput } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";

package/dist/api/routes/password.mjs

@@ -82,7 +82,7 @@ const requestPasswordReset = createAuthEndpoint("/request-password-reset", {
 });
 const requestPasswordResetCallback = createAuthEndpoint("/reset-password/:token", {
 	method: "GET",
-	operationId: "forgetPasswordCallback",
+	operationId: "resetPasswordCallback",
 	query: z.object({ callbackURL: z.string().meta({ description: "The URL to redirect the user to reset their password" }) }),
 	use: [originCheck((ctx) => ctx.query.callbackURL)],
 	metadata: { openapi: {

package/dist/api/routes/session.d.mts

@@ -25,7 +25,6 @@ declare const getSession: <Option extends BetterAuthOptions>() => better_call0.S
             "application/json": {
               schema: {
                 type: "object";
-                nullable: boolean;
                 properties: {
                   session: {
                     $ref: string;

package/dist/api/routes/session.mjs

@@ -1,7 +1,7 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
-import { getDate } from "../../utils/date.mjs";
-import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { symmetricDecodeJWT, verifyJWT } from "../../crypto/jwt.mjs";
+import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
+import { getDate } from "../../utils/date.mjs";
 import { getChunkedCookie, getSessionQuerySchema } from "../../cookies/session-store.mjs";
 import { deleteSessionCookie, expireCookie, setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
 import { getShouldSkipSessionRefresh } from "../state/should-session-refresh.mjs";
@@ -24,8 +24,7 @@ const getSession = () => createAuthEndpoint("/get-session", {
 		responses: { "200": {
 			description: "Success",
 			content: { "application/json": { schema: {
-				type: "object",
-				nullable: true,
+				type: ["object", "null"],
 				properties: {
 					session: { $ref: "#/components/schemas/Session" },
 					user: { $ref: "#/components/schemas/User" }

package/dist/api/routes/sign-in.mjs

@@ -1,7 +1,7 @@
 import { formCsrfMiddleware } from "../middlewares/origin-check.mjs";
 import { parseUserOutput } from "../../db/schema.mjs";
-import { getAwaitableValue } from "../../context/helpers.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
+import { getAwaitableValue } from "../../context/helpers.mjs";
 import { generateState } from "../../oauth2/state.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";

package/dist/api/to-auth-endpoints.mjs

@@ -1,7 +1,9 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
+import { isDynamicBaseURLConfig, isRequestLike } from "../utils/url.mjs";
+import { pickSource, resolveDynamicTrustedProxyHeaders, resolveRequestContext } from "../context/helpers.mjs";
 import { hasRequestState, runWithEndpointContext, runWithRequestState } from "@better-auth/core/context";
 import { shouldPublishLog } from "@better-auth/core/env";
-import { APIError } from "@better-auth/core/error";
+import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { createDefu } from "defu";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, withSpan } from "@better-auth/core/instrumentation";
 import { kAPIErrorHeaderSymbol, toResponse } from "better-call";
@@ -18,6 +20,27 @@ function getOperationId(endpoint, key) {
 	const opts = endpoint.options;
 	return opts.operationId ?? opts.metadata?.openapi?.operationId ?? key;
 }
+/**
+* Resolves the per-call `AuthContext` for endpoints with a dynamic `baseURL`.
+*
+* - `rawCtx.baseURL` already set: HTTP handler rehydrated upstream; return as-is.
+* - Direct `auth.api` call with a source or a configured `fallback`: resolve here.
+* - Neither: throw `APIError` with a helpful message. Leaving `baseURL = ""`
+*   would let plugins build `new URL("")` and crash cryptically downstream.
+*/
+async function resolveDynamicContext(rawCtx, input) {
+	if (rawCtx.baseURL) return rawCtx;
+	const source = pickSource(input);
+	const config = rawCtx.options.baseURL;
+	const hasFallback = isDynamicBaseURLConfig(config) && Boolean(config.fallback);
+	if (source === void 0 && !hasFallback) throw new APIError("INTERNAL_SERVER_ERROR", { message: "Dynamic baseURL could not be resolved for this direct auth.api call. Pass `headers: request.headers` (or `request`) to the call, or add `fallback` to your baseURL config." });
+	try {
+		return await resolveRequestContext(rawCtx, source, resolveDynamicTrustedProxyHeaders(rawCtx.options));
+	} catch (err) {
+		if (err instanceof BetterAuthError) throw new APIError("INTERNAL_SERVER_ERROR", { message: err.message });
+		throw err;
+	}
+}
 function toAuthEndpoints(endpoints, ctx) {
 	const api = {};
 	for (const [key, endpoint] of Object.entries(endpoints)) {
@@ -26,9 +49,10 @@ function toAuthEndpoints(endpoints, ctx) {
 			const endpointMethod = endpoint?.options?.method;
 			const defaultMethod = Array.isArray(endpointMethod) ? endpointMethod[0] : endpointMethod;
 			const run = async () => {
-				const authContext = await ctx;
+				const rawContext = await ctx;
 				const methodName = context?.method ?? context?.request?.method ?? defaultMethod ?? "?";
 				const route = endpoint.path ?? "/:virtual";
+				const authContext = isDynamicBaseURLConfig(rawContext.options.baseURL) ? await resolveDynamicContext(rawContext, context) : rawContext;
 				let internalContext = {
 					...context,
 					context: {
@@ -40,7 +64,7 @@ function toAuthEndpoints(endpoints, ctx) {
 					path: endpoint.path,
 					headers: context?.headers ? new Headers(context?.headers) : void 0
 				};
-				const hasRequest = context?.request instanceof Request;
+				const hasRequest = isRequestLike(context?.request);
 				const shouldReturnResponse = context?.asResponse ?? hasRequest;
 				return withSpan(`${methodName} ${route}`, {
 					[ATTR_HTTP_ROUTE]: route,

package/dist/auth/base.mjs

@@ -1,6 +1,5 @@
-import { getBaseURL, getOrigin, isDynamicBaseURLConfig, resolveBaseURL } from "../utils/url.mjs";
-import { getTrustedOrigins, getTrustedProviders } from "../context/helpers.mjs";
-import { createCookieGetter, getCookies } from "../cookies/index.mjs";
+import { getBaseURL, getOrigin, isDynamicBaseURLConfig } from "../utils/url.mjs";
+import { getTrustedOrigins, getTrustedProviders, resolveDynamicTrustedProxyHeaders, resolveRequestContext } from "../context/helpers.mjs";
 import { getEndpoints, router } from "../api/index.mjs";
 import { runWithAdapter } from "@better-auth/core/context";
 import { BASE_ERROR_CODES, BetterAuthError } from "@better-auth/core/error";
@@ -13,26 +12,8 @@ const createBetterAuth = (options, initFn) => {
 			const ctx = await authContext;
 			const basePath = ctx.options.basePath || "/api/auth";
 			let handlerCtx;
-			if (isDynamicBaseURLConfig(options.baseURL)) {
-				handlerCtx = Object.create(Object.getPrototypeOf(ctx), Object.getOwnPropertyDescriptors(ctx));
-				const baseURL = resolveBaseURL(options.baseURL, basePath, request);
-				if (baseURL) {
-					handlerCtx.baseURL = baseURL;
-					handlerCtx.options = {
-						...ctx.options,
-						baseURL: getOrigin(baseURL) || void 0
-					};
-				} else throw new BetterAuthError("Could not resolve base URL from request. Check your allowedHosts config.");
-				const trustedOriginOptions = {
-					...handlerCtx.options,
-					baseURL: options.baseURL
-				};
-				handlerCtx.trustedOrigins = await getTrustedOrigins(trustedOriginOptions, request);
-				if (options.advanced?.crossSubDomainCookies?.enabled) {
-					handlerCtx.authCookies = getCookies(handlerCtx.options);
-					handlerCtx.createAuthCookie = createCookieGetter(handlerCtx.options);
-				}
-			} else {
+			if (isDynamicBaseURLConfig(options.baseURL)) handlerCtx = await resolveRequestContext(ctx, request, resolveDynamicTrustedProxyHeaders(ctx.options));
+			else {
 				handlerCtx = ctx;
 				if (!ctx.options.baseURL) {
 					const baseURL = getBaseURL(void 0, basePath, request, void 0, ctx.options.advanced?.trustedProxyHeaders);
@@ -42,8 +23,8 @@ const createBetterAuth = (options, initFn) => {
 					} else throw new BetterAuthError("Could not get base URL from request. Please provide a valid base URL.");
 				}
 				handlerCtx.trustedOrigins = await getTrustedOrigins(ctx.options, request);
+				handlerCtx.trustedProviders = await getTrustedProviders(ctx.options, request);
 			}
-			handlerCtx.trustedProviders = await getTrustedProviders(handlerCtx.options, request);
 			const { handler } = router(handlerCtx, options);
 			return runWithAdapter(handlerCtx.adapter, () => handler(request));
 		},

package/dist/client/plugins/index.d.mts

@@ -20,7 +20,7 @@ import { MULTI_SESSION_ERROR_CODES } from "../../plugins/multi-session/error-cod
 import { MultiSessionConfig } from "../../plugins/multi-session/index.mjs";
 import { OneTimeTokenOptions } from "../../plugins/one-time-token/index.mjs";
 import { PhoneNumberOptions, UserWithPhoneNumber } from "../../plugins/phone-number/types.mjs";
-import { BackupCodeOptions, backupCode2fa, generateBackupCodes, getBackupCodes, verifyBackupCode } from "../../plugins/two-factor/backup-codes/index.mjs";
+import { BackupCodeOptions, backupCode2fa, encodeBackupCodes, generateBackupCodes, getBackupCodes, verifyBackupCode } from "../../plugins/two-factor/backup-codes/index.mjs";
 import { OTPOptions, otp2fa } from "../../plugins/two-factor/otp/index.mjs";
 import { TOTPOptions, totp2fa } from "../../plugins/two-factor/totp/index.mjs";
 import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "../../plugins/two-factor/types.mjs";
@@ -52,4 +52,4 @@ import { phoneNumberClient } from "../../plugins/phone-number/client.mjs";
 import { siweClient } from "../../plugins/siwe/client.mjs";
 import { usernameClient } from "../../plugins/username/client.mjs";
 import { InferServerPlugin } from "./infer-plugin.mjs";
-export { ADMIN_ERROR_CODES, ANONYMOUS_ERROR_CODES, AdminOptions, AnonymousOptions, AnonymousSession, Auth0Options, AuthorizationQuery, BackupCodeOptions, BaseOAuthProviderOptions, Client, CodeVerificationValue, EMAIL_OTP_ERROR_CODES, ExtractPluginField, GENERIC_OAUTH_ERROR_CODES, GenericOAuthConfig, GenericOAuthOptions, GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, GumroadOptions, HasRequiredKeys, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginFieldFromTuple, InferServerPlugin, InferTeam, Invitation, InvitationInput, InvitationStatus, IsAny, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodClientConfig, LineOptions, MULTI_SESSION_ERROR_CODES, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAuthAccessToken, OIDCMetadata, OIDCOptions, ORGANIZATION_ERROR_CODES, OTPOptions, OidcClientPlugin, OktaOptions, OneTimeTokenOptions, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, OverrideMerge, PHONE_NUMBER_ERROR_CODES, PatreonOptions, PhoneNumberOptions, Prettify, PrettifyDeep, RequiredKeysOf, SessionWithImpersonatedBy, SlackOptions, StripEmptyObjects, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamInput, TeamMember, TeamMemberInput, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UnionToIntersection, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, adminClient, anonymousClient, auth0, backupCode2fa, clientSideHasPermission, customSessionClient, defaultRolesSchema, deviceAuthorizationClient, emailOTPClient, generateBackupCodes, genericOAuthClient, getBackupCodes, gumroad, hubspot, inferAdditionalFields, inferOrgAdditionalFields, invitationSchema, invitationStatus, jwtClient, keycloak, lastLoginMethodClient, line, magicLinkClient, memberSchema, microsoftEntraId, multiSessionClient, oidcClient, okta, oneTapClient, oneTimeTokenClient, organizationClient, organizationRoleSchema, organizationSchema, otp2fa, patreon, phoneNumberClient, roleSchema, schema, siweClient, slack, teamMemberSchema, teamSchema, totp2fa, twoFactorClient, usernameClient, verifyBackupCode };
+export { ADMIN_ERROR_CODES, ANONYMOUS_ERROR_CODES, AdminOptions, AnonymousOptions, AnonymousSession, Auth0Options, AuthorizationQuery, BackupCodeOptions, BaseOAuthProviderOptions, Client, CodeVerificationValue, EMAIL_OTP_ERROR_CODES, ExtractPluginField, GENERIC_OAUTH_ERROR_CODES, GenericOAuthConfig, GenericOAuthOptions, GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, GumroadOptions, HasRequiredKeys, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginFieldFromTuple, InferServerPlugin, InferTeam, Invitation, InvitationInput, InvitationStatus, IsAny, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodClientConfig, LineOptions, MULTI_SESSION_ERROR_CODES, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAuthAccessToken, OIDCMetadata, OIDCOptions, ORGANIZATION_ERROR_CODES, OTPOptions, OidcClientPlugin, OktaOptions, OneTimeTokenOptions, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, OverrideMerge, PHONE_NUMBER_ERROR_CODES, PatreonOptions, PhoneNumberOptions, Prettify, PrettifyDeep, RequiredKeysOf, SessionWithImpersonatedBy, SlackOptions, StripEmptyObjects, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamInput, TeamMember, TeamMemberInput, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UnionToIntersection, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, adminClient, anonymousClient, auth0, backupCode2fa, clientSideHasPermission, customSessionClient, defaultRolesSchema, deviceAuthorizationClient, emailOTPClient, encodeBackupCodes, generateBackupCodes, genericOAuthClient, getBackupCodes, gumroad, hubspot, inferAdditionalFields, inferOrgAdditionalFields, invitationSchema, invitationStatus, jwtClient, keycloak, lastLoginMethodClient, line, magicLinkClient, memberSchema, microsoftEntraId, multiSessionClient, oidcClient, okta, oneTapClient, oneTimeTokenClient, organizationClient, organizationRoleSchema, organizationSchema, otp2fa, patreon, phoneNumberClient, roleSchema, schema, siweClient, slack, teamMemberSchema, teamSchema, totp2fa, twoFactorClient, usernameClient, verifyBackupCode };

package/dist/client/query.mjs

@@ -72,15 +72,15 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 		});
 	};
 	initializedAtom = Array.isArray(initializedAtom) ? initializedAtom : [initializedAtom];
-	let isMounted = false;
+	let isInitialized = false;
 	for (const initAtom of initializedAtom) initAtom.subscribe(async () => {
 		if (isServer()) return;
-		if (isMounted) await fn();
+		if (isInitialized) await fn();
 		else onMount(value, () => {
 			const timeoutId = setTimeout(async () => {
-				if (!isMounted) {
+				if (!isInitialized) {
+					isInitialized = true;
 					await fn();
-					isMounted = true;
 				}
 			}, 0);
 			return () => {

package/dist/context/create-context.mjs

@@ -1,10 +1,10 @@
 import { getBaseURL, isDynamicBaseURLConfig } from "../utils/url.mjs";
 import { matchesOriginPattern } from "../auth/trusted-origins.mjs";
-import { createInternalAdapter } from "../db/internal-adapter.mjs";
 import { isPromise } from "../utils/is-promise.mjs";
-import { getInternalPlugins, getTrustedOrigins, getTrustedProviders, runPluginInit } from "./helpers.mjs";
 import { hashPassword, verifyPassword } from "../crypto/password.mjs";
 import { createCookieGetter, getCookies } from "../cookies/index.mjs";
+import { createInternalAdapter } from "../db/internal-adapter.mjs";
+import { getInternalPlugins, getTrustedOrigins, getTrustedProviders, runPluginInit } from "./helpers.mjs";
 import { checkPassword } from "../utils/password.mjs";
 import { checkEndpointConflicts } from "../api/index.mjs";
 import { DEFAULT_SECRET } from "../utils/constants.mjs";

package/dist/context/helpers.mjs

@@ -1,7 +1,9 @@
-import { getBaseURL, isDynamicBaseURLConfig } from "../utils/url.mjs";
-import { createInternalAdapter } from "../db/internal-adapter.mjs";
+import { getBaseURL, getOrigin, isDynamicBaseURLConfig, isRequestLike, resolveBaseURL } from "../utils/url.mjs";
 import { isPromise } from "../utils/is-promise.mjs";
+import { createCookieGetter, getCookies } from "../cookies/index.mjs";
+import { createInternalAdapter } from "../db/internal-adapter.mjs";
 import { env } from "@better-auth/core/env";
+import { BetterAuthError } from "@better-auth/core/error";
 import { defu } from "defu";
 //#region src/context/helpers.ts
 async function runPluginInit(context) {
@@ -80,6 +82,62 @@ async function getTrustedOrigins(options, request) {
 	if (envTrustedOrigins) trustedOrigins.push(...envTrustedOrigins.split(","));
 	return trustedOrigins.filter((v) => Boolean(v));
 }
+/**
+* Picks a `Request`-like or `Headers` value from a direct `auth.api` call.
+* Headers are only accepted when they carry a host: without one, host
+* resolution would fall back to `null` and the caller should use `fallback`
+* or pass a `Request` instead.
+*/
+function pickSource(input) {
+	if (isRequestLike(input?.request)) return input.request;
+	if (!input?.headers) return void 0;
+	const headers = input.headers instanceof Headers ? input.headers : new Headers(input.headers);
+	if (!headers.has("host") && !headers.has("x-forwarded-host")) return;
+	return headers;
+}
+/**
+* Returns the effective `trustedProxyHeaders` value for dynamic `baseURL`
+* resolution. When the user hasn't set `advanced.trustedProxyHeaders`,
+* proxy headers (`x-forwarded-host` / `x-forwarded-proto`) are trusted by
+* default so deployments behind a reverse proxy work without extra config.
+*/
+function resolveDynamicTrustedProxyHeaders(options) {
+	return options.advanced?.trustedProxyHeaders ?? true;
+}
+/**
+* Per-request clone with `baseURL`, `trustedOrigins`, `trustedProviders`
+* and cookies rehydrated for the resolved host. Throws `BetterAuthError`
+* when the URL cannot be resolved; callers on the direct-API path convert
+* this to `APIError`.
+*/
+async function resolveRequestContext(ctx, source, trustedProxyHeaders) {
+	const dynamicBaseURLConfig = ctx.options.baseURL;
+	const baseURL = resolveBaseURL(dynamicBaseURLConfig, ctx.options.basePath || "/api/auth", source, void 0, trustedProxyHeaders);
+	if (!baseURL) throw new BetterAuthError("Could not resolve base URL from request. Check your allowedHosts config.");
+	const resolved = Object.create(Object.getPrototypeOf(ctx), Object.getOwnPropertyDescriptors(ctx));
+	resolved.baseURL = baseURL;
+	resolved.options = {
+		...ctx.options,
+		baseURL: getOrigin(baseURL) || void 0
+	};
+	const trustedOriginOptions = {
+		...resolved.options,
+		baseURL: dynamicBaseURLConfig
+	};
+	const needsRequest = typeof ctx.options.trustedOrigins === "function" || typeof ctx.options.account?.accountLinking?.trustedProviders === "function";
+	let callbackRequest;
+	if (needsRequest) if (isRequestLike(source)) callbackRequest = source;
+	else if (source) callbackRequest = new Request(baseURL, { headers: source });
+	else callbackRequest = void 0;
+	else callbackRequest = void 0;
+	resolved.trustedOrigins = await getTrustedOrigins(trustedOriginOptions, callbackRequest);
+	resolved.trustedProviders = await getTrustedProviders(resolved.options, callbackRequest);
+	if (ctx.options.advanced?.crossSubDomainCookies?.enabled) {
+		resolved.authCookies = getCookies(resolved.options);
+		resolved.createAuthCookie = createCookieGetter(resolved.options);
+	}
+	return resolved;
+}
 async function getAwaitableValue(arr, item) {
 	if (!arr) return void 0;
 	for (const val of arr) {
@@ -94,4 +152,4 @@ async function getTrustedProviders(options, request) {
 	return (await trustedProviders(request) ?? []).filter((v) => Boolean(v));
 }
 //#endregion
-export { getAwaitableValue, getInternalPlugins, getTrustedOrigins, getTrustedProviders, runPluginInit };
+export { getAwaitableValue, getInternalPlugins, getTrustedOrigins, getTrustedProviders, pickSource, resolveDynamicTrustedProxyHeaders, resolveRequestContext, runPluginInit };

package/dist/cookies/index.mjs

@@ -1,11 +1,11 @@
 import { isDynamicBaseURLConfig } from "../utils/url.mjs";
-import { getDate } from "../utils/date.mjs";
+import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "../crypto/jwt.mjs";
 import { parseUserOutput } from "../db/schema.mjs";
+import { getDate } from "../utils/date.mjs";
 import { isPromise } from "../utils/is-promise.mjs";
-import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "../crypto/jwt.mjs";
-import { createAccountStore, createSessionStore, getAccountCookie, getChunkedCookie, setAccountCookie } from "./session-store.mjs";
 import { sec } from "../utils/time.mjs";
 import { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, parseSetCookieHeader, setCookieToHeader, splitSetCookieHeader, stripSecureCookiePrefix } from "./cookie-utils.mjs";
+import { createAccountStore, createSessionStore, getAccountCookie, getChunkedCookie, setAccountCookie } from "./session-store.mjs";
 import { env, isProduction } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { safeJSONParse } from "@better-auth/core/utils/json";

package/dist/crypto/index.mjs

@@ -1,9 +1,9 @@
-import { constantTimeEqual } from "./buffer.mjs";
 import { signJWT, symmetricDecodeJWT, symmetricEncodeJWT, verifyJWT } from "./jwt.mjs";
+import { constantTimeEqual } from "./buffer.mjs";
 import { hashPassword, verifyPassword } from "./password.mjs";
 import { generateRandomString } from "./random.mjs";
-import { createHash } from "@better-auth/utils/hash";
 import { getWebcryptoSubtle } from "@better-auth/utils";
+import { createHash } from "@better-auth/utils/hash";
 import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
 import { bytesToHex, hexToBytes, managedNonce, utf8ToBytes } from "@noble/ciphers/utils.js";
 //#region src/crypto/index.ts

package/dist/db/index.mjs

@@ -1,7 +1,7 @@
 import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.mjs";
 import { getSchema } from "./get-schema.mjs";
-import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
+import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
 import { toZodSchema } from "./to-zod.mjs";

package/dist/db/internal-adapter.mjs

@@ -1,6 +1,6 @@
 import { getIp } from "../utils/get-request-ip.mjs";
-import { getDate } from "../utils/date.mjs";
 import { getSessionDefaultFields, parseSessionOutput, parseUserOutput } from "./schema.mjs";
+import { getDate } from "../utils/date.mjs";
 import { getStorageOption, processIdentifier } from "./verification-token-storage.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, runWithTransaction } from "@better-auth/core/context";

package/dist/index.d.mts

@@ -10,7 +10,7 @@ import { betterAuth } from "./auth/full.mjs";
 import { generateState, parseState } from "./oauth2/state.mjs";
 import { StateData, generateGenericState, parseGenericState } from "./state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
-import { getBaseURL, getHost, getHostFromRequest, getOrigin, getProtocol, getProtocolFromRequest, isDynamicBaseURLConfig, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL } from "./utils/url.mjs";
+import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL } from "./utils/url.mjs";
 import { APIError } from "./api/index.mjs";
 import { StandardSchemaV1 } from "@better-auth/core";
 import { getCurrentAdapter } from "@better-auth/core/context";
@@ -27,4 +27,4 @@ export * from "@better-auth/core/utils/json";
 export * from "@better-auth/core/social-providers";
 export * from "better-call";
 export * from "zod";
-export { APIError, Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, HIDE_METADATA, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, JoinConfig, JoinOption, OverrideMerge, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StandardSchemaV1, StateData, StoreIdentifierOption, StripEmptyObjects, type TelemetryEvent, UnionToIntersection, User, Verification, Where, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromRequest, getOrigin, getProtocol, getProtocolFromRequest, getTelemetryAuthConfig, isDynamicBaseURLConfig, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL };
+export { APIError, Account, AdditionalSessionFieldsInput, AdditionalUserFieldsInput, Auth, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, ClientAtomListener, ClientStore, DBAdapter, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, ExtractPluginField, FilteredAPI, HIDE_METADATA, HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPluginFieldFromTuple, InferPluginIDs, InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, JoinConfig, JoinOption, OverrideMerge, Prettify, PrettifyDeep, RateLimit, RequiredKeysOf, Session, SessionQueryParams, type StandardSchemaV1, StateData, StoreIdentifierOption, StripEmptyObjects, type TelemetryEvent, UnionToIntersection, User, Verification, Where, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { getBaseURL, getHost, getHostFromRequest, getOrigin, getProtocol, getProtocolFromRequest, isDynamicBaseURLConfig, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL } from "./utils/url.mjs";
+import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL } from "./utils/url.mjs";
 import { generateGenericState, parseGenericState } from "./state.mjs";
 import { generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
@@ -14,4 +14,4 @@ export * from "@better-auth/core/oauth2";
 export * from "@better-auth/core/utils/error-codes";
 export * from "@better-auth/core/utils/id";
 export * from "@better-auth/core/utils/json";
-export { APIError, HIDE_METADATA, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromRequest, getOrigin, getProtocol, getProtocolFromRequest, getTelemetryAuthConfig, isDynamicBaseURLConfig, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL };
+export { APIError, HIDE_METADATA, betterAuth, createTelemetry, generateGenericState, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL };

package/dist/integrations/next-js.mjs

@@ -24,20 +24,29 @@ const nextCookies = () => {
 				matcher(ctx) {
 					return ctx.path === "/get-session";
 				},
-				handler: createAuthMiddleware(async () => {
-					let cookieStore;
+				handler: createAuthMiddleware(async (ctx) => {
+					if ("_flag" in ctx && ctx._flag === "router") return;
+					let headersStore;
 					try {
-						const { cookies } = await import("next/headers.js");
-						cookieStore = await cookies();
+						const { headers } = await import("next/headers.js");
+						headersStore = await headers();
 					} catch {
 						return;
 					}
-					try {
-						cookieStore.set("__better-auth-cookie-store", "1", { maxAge: 0 });
-						cookieStore.delete("__better-auth-cookie-store");
-					} catch {
-						await setShouldSkipSessionRefresh(true);
-					}
+					/**
+					* Detect RSC via headers, NOT by probing cookies().set().
+					* In Next.js, cookies().set() unconditionally triggers router
+					* cache invalidation -- even if the value is unchanged.
+					*
+					* RSC sends `RSC: 1` without `next-action`. Only in that
+					* context cookies cannot be written -- skip session refresh
+					* to avoid DB/cookie mismatch.
+					*
+					* @see https://github.com/vercel/next.js/blob/8c5af211d580/packages/next/src/server/web/spec-extension/adapters/request-cookies.ts#L112-L157
+					*/
+					const isRSC = headersStore.get("RSC") === "1";
+					const isServerAction = !!headersStore.get("next-action");
+					if (isRSC && !isServerAction) await setShouldSkipSessionRefresh(true);
 				})
 			}],
 			after: [{
@@ -51,12 +60,12 @@ const nextCookies = () => {
 						const setCookies = returned?.get("set-cookie");
 						if (!setCookies) return;
 						const parsed = parseSetCookieHeader(setCookies);
-						const { cookies } = await import("next/headers.js");
 						let cookieHelper;
 						try {
+							const { cookies } = await import("next/headers.js");
 							cookieHelper = await cookies();
 						} catch (error) {
-							if (error instanceof Error && error.message.startsWith("`cookies` was called outside a request scope.")) return;
+							if (error instanceof Error && (error.message.startsWith("`cookies` was called outside a request scope.") || error.message.includes("Cannot find module"))) return;
 							throw error;
 						}
 						parsed.forEach((value, key) => {

package/dist/oauth2/state.d.mts

@@ -15,6 +15,7 @@ declare function parseState(c: GenericEndpointContext): Promise<{
   expiresAt: number;
   errorURL?: string | undefined;
   newUserURL?: string | undefined;
+  oauthState?: string | undefined;
   link?: {
     email: string;
     userId: string;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.1";
+var version = "1.6.3";
 //#endregion
 export { version };

package/dist/plugins/admin/admin.d.mts

@@ -775,11 +775,9 @@ declare const admin: <O extends AdminOptions>(options?: O | undefined) => {
       body: zod.ZodIntersection<zod.ZodObject<{
         userId: zod.ZodOptional<zod.ZodCoercedString<unknown>>;
         role: zod.ZodOptional<zod.ZodString>;
-      }, zod_v4_core0.$strip>, zod.ZodUnion<readonly [zod.ZodObject<{
+      }, zod_v4_core0.$strip>, zod.ZodXor<readonly [zod.ZodObject<{
         permission: zod.ZodRecord<zod.ZodString, zod.ZodArray<zod.ZodString>>;
-        permissions: zod.ZodUndefined;
       }, zod_v4_core0.$strip>, zod.ZodObject<{
-        permission: zod.ZodUndefined;
         permissions: zod.ZodRecord<zod.ZodString, zod.ZodArray<zod.ZodString>>;
       }, zod_v4_core0.$strip>]>>;
       metadata: {

package/dist/plugins/admin/routes.mjs

@@ -1,5 +1,5 @@
-import { getDate } from "../../utils/date.mjs";
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
+import { getDate } from "../../utils/date.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
@@ -766,13 +766,7 @@ const setUserPassword = (opts) => createAuthEndpoint("/admin/set-user-password",
 const userHasPermissionBodySchema = z.object({
 	userId: z.coerce.string().optional().meta({ description: `The user id. Eg: "user-id"` }),
 	role: z.string().optional().meta({ description: `The role to check permission for. Eg: "admin"` })
-}).and(z.union([z.object({
-	permission: z.record(z.string(), z.array(z.string())),
-	permissions: z.undefined()
-}), z.object({
-	permission: z.undefined(),
-	permissions: z.record(z.string(), z.array(z.string()))
-})]));
+}).and(z.xor([z.object({ permission: z.record(z.string(), z.array(z.string())) }), z.object({ permissions: z.record(z.string(), z.array(z.string())) })]));
 /**
 * ### Endpoint
 *

package/dist/plugins/device-authorization/routes.mjs

@@ -1,5 +1,5 @@
-import { generateRandomString } from "../../crypto/random.mjs";
 import { ms } from "../../utils/time.mjs";
+import { generateRandomString } from "../../crypto/random.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { DEVICE_AUTHORIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { APIError } from "@better-auth/core/error";

package/dist/plugins/email-otp/routes.mjs

@@ -1,5 +1,5 @@
-import { getDate } from "../../utils/date.mjs";
 import { parseUserInput, parseUserOutput } from "../../db/schema.mjs";
+import { getDate } from "../../utils/date.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";

package/dist/plugins/index.d.mts

@@ -51,7 +51,7 @@ import { phoneNumber } from "./phone-number/index.mjs";
 import { SIWEPluginOptions, siwe } from "./siwe/index.mjs";
 import { LoginResult, TestCookie, TestHelpers, TestUtilsOptions } from "./test-utils/types.mjs";
 import { testUtils } from "./test-utils/index.mjs";
-import { BackupCodeOptions, backupCode2fa, generateBackupCodes, getBackupCodes, verifyBackupCode } from "./two-factor/backup-codes/index.mjs";
+import { BackupCodeOptions, backupCode2fa, encodeBackupCodes, generateBackupCodes, getBackupCodes, verifyBackupCode } from "./two-factor/backup-codes/index.mjs";
 import { OTPOptions, otp2fa } from "./two-factor/otp/index.mjs";
 import { TOTPOptions, totp2fa } from "./two-factor/totp/index.mjs";
 import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "./two-factor/types.mjs";
@@ -62,4 +62,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizationQuery, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, Client, CloudflareTurnstileOptions, CodeVerificationValue, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationOptions, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAuthAccessToken, OAuthProxyOptions, OIDCMetadata, OIDCOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, Path, PatreonOptions, PhoneNumberOptions, Provider, Role, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, memberSchema, microsoftEntraId, ms, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, withMcpAuth };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizationQuery, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, Client, CloudflareTurnstileOptions, CodeVerificationValue, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationOptions, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAuthAccessToken, OAuthProxyOptions, OIDCMetadata, OIDCOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, Path, PatreonOptions, PhoneNumberOptions, Provider, Role, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, memberSchema, microsoftEntraId, ms, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, withMcpAuth };

package/dist/plugins/jwt/utils.mjs

@@ -1,5 +1,5 @@
-import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { sec } from "../../utils/time.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getJwksAdapter } from "./adapter.mjs";
 import { exportJWK, generateKeyPair } from "jose";
 //#region src/plugins/jwt/utils.ts