better-auth 1.6.22 → 1.6.24

package/dist/plugins/mcp/client/index.mjs

@@ -17,7 +17,19 @@ function buildCorsHeaders(authURL, allowedOrigin) {
 function makeWWWAuthenticate(authURL, resource) {
 	return `Bearer resource_metadata="${resource ? `${resource}/.well-known/oauth-protected-resource` : `${authURL}/.well-known/oauth-protected-resource`}"`;
 }
-function make401Response(authURL, resource) {
+function addExposeHeader(headers, headerName) {
+	const exposedHeaders = headers["Access-Control-Expose-Headers"];
+	if (!exposedHeaders) return {
+		...headers,
+		"Access-Control-Expose-Headers": headerName
+	};
+	const alreadyExposed = exposedHeaders.split(",").some((header) => header.trim().toLowerCase() === headerName.toLowerCase());
+	return {
+		...headers,
+		"Access-Control-Expose-Headers": alreadyExposed ? exposedHeaders : `${exposedHeaders}, ${headerName}`
+	};
+}
+function make401Response(authURL, resource, corsHeaders) {
 	const wwwAuth = makeWWWAuthenticate(authURL, resource);
 	return Response.json({
 		jsonrpc: "2.0",
@@ -29,10 +41,13 @@ function make401Response(authURL, resource) {
 		id: null
 	}, {
 		status: 401,
-		headers: { "WWW-Authenticate": wwwAuth }
+		headers: {
+			...addExposeHeader(corsHeaders, "WWW-Authenticate"),
+			"WWW-Authenticate": wwwAuth
+		}
 	});
 }
-function send401Node(res, wwwAuth, message) {
+function send401Node(res, wwwAuth, message, corsHeaders) {
 	const body = JSON.stringify({
 		jsonrpc: "2.0",
 		error: {
@@ -41,13 +56,21 @@ function send401Node(res, wwwAuth, message) {
 		},
 		id: null
 	});
+	const existingExposedHeaders = res.get?.("Access-Control-Expose-Headers") ?? res.getHeader?.("Access-Control-Expose-Headers") ?? res.getHeader?.("access-control-expose-headers");
+	const headers = {
+		...addExposeHeader({
+			...corsHeaders,
+			...existingExposedHeaders ? { "Access-Control-Expose-Headers": Array.isArray(existingExposedHeaders) ? existingExposedHeaders.join(", ") : String(existingExposedHeaders) } : {}
+		}, "WWW-Authenticate"),
+		"WWW-Authenticate": wwwAuth
+	};
 	if (typeof res.set === "function") {
-		res.set("WWW-Authenticate", wwwAuth);
+		for (const [name, value] of Object.entries(headers)) res.set(name, value);
 		res.status?.(401).json(JSON.parse(body));
 	} else if (typeof res.writeHead === "function") {
 		res.writeHead(401, {
 			"Content-Type": "application/json",
-			"WWW-Authenticate": wwwAuth
+			...headers
 		});
 		res.end?.(body);
 	}
@@ -78,9 +101,10 @@ function createMcpAuthClient(options) {
 				headers: corsHeaders
 			});
 			const authHeader = req.headers.get("Authorization");
-			if (!authHeader || !authHeader.startsWith("Bearer ")) return make401Response(authURL, options.resource);
-			const session = await verifyToken(authHeader.slice(7));
-			if (!session) return make401Response(authURL, options.resource);
+			if (!authHeader || !authHeader.startsWith("Bearer ")) return make401Response(authURL, options.resource, corsHeaders);
+			const token = authHeader.slice(7);
+			const session = await verifyToken(token);
+			if (!session) return make401Response(authURL, options.resource, corsHeaders);
 			return fn(req, session);
 		};
 	};
@@ -128,12 +152,13 @@ function createMcpAuthClient(options) {
 		return async (req, res, next) => {
 			const authHeader = req.headers?.authorization ?? req.headers?.get?.("Authorization") ?? req.get?.("Authorization");
 			if (!authHeader || !authHeader.startsWith("Bearer ")) {
-				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Unauthorized: Authentication required");
+				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Unauthorized: Authentication required", corsHeaders);
 				return;
 			}
-			const session = await verifyToken(authHeader.slice(7));
+			const token = authHeader.slice(7);
+			const session = await verifyToken(token);
 			if (!session) {
-				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Invalid or expired token");
+				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Invalid or expired token", corsHeaders);
 				return;
 			}
 			req.mcpSession = session;

package/dist/plugins/mcp/index.d.mts

@@ -1,8 +1,7 @@
 import { OAuthAccessToken, OIDCMetadata, OIDCOptions } from "../oidc-provider/types.mjs";
+import "../oidc-provider/index.mjs";
 import { BetterAuthOptions, GenericEndpointContext } from "@better-auth/core";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/mcp/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -31,18 +30,18 @@ declare const mcp: (options: MCPOptions) => {
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
   endpoints: {
-    oAuthConsent: better_call0.StrictEndpoint<"/oauth2/consent", {
+    oAuthConsent: import("better-call").StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       operationId: string;
       body: z.ZodObject<{
         accept: z.ZodBoolean;
         consent_code: z.ZodOptional<z.ZodNullable<z.ZodOptional<z.ZodString>>>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -114,13 +113,13 @@ declare const mcp: (options: MCPOptions) => {
     }, {
       redirectURI: string;
     }>;
-    getMcpOAuthConfig: better_call0.StrictEndpoint<"/.well-known/oauth-authorization-server", {
+    getMcpOAuthConfig: import("better-call").StrictEndpoint<"/.well-known/oauth-authorization-server", {
       method: "GET";
       metadata: {
         readonly scope: "server";
       };
     }, OIDCMetadata | null>;
-    getMCPProtectedResource: better_call0.StrictEndpoint<"/.well-known/oauth-protected-resource", {
+    getMCPProtectedResource: import("better-call").StrictEndpoint<"/.well-known/oauth-protected-resource", {
       method: "GET";
       metadata: {
         readonly scope: "server";
@@ -133,7 +132,7 @@ declare const mcp: (options: MCPOptions) => {
       bearer_methods_supported: string[];
       resource_signing_alg_values_supported: string[];
     }>;
-    mcpOAuthAuthorize: better_call0.StrictEndpoint<"/mcp/authorize", {
+    mcpOAuthAuthorize: import("better-call").StrictEndpoint<"/mcp/authorize", {
       method: "GET";
       query: z.ZodRecord<z.ZodString, z.ZodAny>;
       metadata: {
@@ -156,7 +155,7 @@ declare const mcp: (options: MCPOptions) => {
         };
       };
     }, void>;
-    mcpOAuthToken: better_call0.StrictEndpoint<"/mcp/token", {
+    mcpOAuthToken: import("better-call").StrictEndpoint<"/mcp/token", {
       method: "POST";
       body: z.ZodRecord<z.ZodAny, z.ZodAny>;
       metadata: {
@@ -177,7 +176,7 @@ declare const mcp: (options: MCPOptions) => {
       scope: string;
       id_token: string | undefined;
     }>;
-    registerMcpClient: better_call0.StrictEndpoint<"/mcp/register", {
+    registerMcpClient: import("better-call").StrictEndpoint<"/mcp/register", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodString>;
@@ -295,7 +294,7 @@ declare const mcp: (options: MCPOptions) => {
         };
       };
     }, Response>;
-    getMcpSession: better_call0.StrictEndpoint<"/mcp/get-session", {
+    getMcpSession: import("better-call").StrictEndpoint<"/mcp/get-session", {
       method: "GET";
       requireHeaders: true;
     }, OAuthAccessToken | null>;

package/dist/plugins/multi-session/client.d.mts

@@ -1,7 +1,5 @@
 import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
 import { MultiSessionConfig, multiSession } from "./index.mjs";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/multi-session/client.d.ts
 declare const multiSessionClient: () => {
   id: "multi-session";
@@ -12,8 +10,8 @@ declare const multiSessionClient: () => {
     signal: "$sessionSignal";
   }[];
   $ERROR_CODES: {
-    INVALID_SESSION_TOKEN: _better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+    INVALID_SESSION_TOKEN: import("@better-auth/core/utils/error-codes").RawError<"INVALID_SESSION_TOKEN">;
   };
 };
 //#endregion
-export { multiSessionClient };
+export { MULTI_SESSION_ERROR_CODES, type MultiSessionConfig, multiSessionClient };

package/dist/plugins/multi-session/client.mjs

@@ -16,4 +16,4 @@ const multiSessionClient = () => {
 	};
 };
 //#endregion
-export { multiSessionClient };
+export { MULTI_SESSION_ERROR_CODES, multiSessionClient };

package/dist/plugins/multi-session/error-codes.d.mts

@@ -1,8 +1,6 @@
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/multi-session/error-codes.d.ts
 declare const MULTI_SESSION_ERROR_CODES: {
-  INVALID_SESSION_TOKEN: _better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+  INVALID_SESSION_TOKEN: import("@better-auth/core/utils/error-codes").RawError<"INVALID_SESSION_TOKEN">;
 };
 //#endregion
 export { MULTI_SESSION_ERROR_CODES };

package/dist/plugins/multi-session/index.d.mts

@@ -1,9 +1,5 @@
 import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
-import * as _better_auth_core0 from "@better-auth/core";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/multi-session/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -39,7 +35,7 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-list-device-sessions)
      */
-    listDeviceSessions: better_call0.StrictEndpoint<"/multi-session/list-device-sessions", {
+    listDeviceSessions: import("better-call").StrictEndpoint<"/multi-session/list-device-sessions", {
       method: "GET";
       requireHeaders: true;
     }, {
@@ -78,7 +74,7 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-set-active)
      */
-    setActiveSession: better_call0.StrictEndpoint<"/multi-session/set-active", {
+    setActiveSession: import("better-call").StrictEndpoint<"/multi-session/set-active", {
       method: "POST";
       body: z.ZodObject<{
         sessionToken: z.ZodString;
@@ -142,13 +138,13 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-revoke)
      */
-    revokeDeviceSession: better_call0.StrictEndpoint<"/multi-session/revoke", {
+    revokeDeviceSession: import("better-call").StrictEndpoint<"/multi-session/revoke", {
       method: "POST";
       body: z.ZodObject<{
         sessionToken: z.ZodString;
       }, z.core.$strip>;
       requireHeaders: true;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -199,13 +195,13 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
   };
   hooks: {
     after: {
-      matcher: (context: _better_auth_core0.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher: (context: import("@better-auth/core").HookEndpointContext) => boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
   options: MultiSessionConfig | undefined;
   $ERROR_CODES: {
-    INVALID_SESSION_TOKEN: _better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+    INVALID_SESSION_TOKEN: import("@better-auth/core/utils/error-codes").RawError<"INVALID_SESSION_TOKEN">;
   };
 };
 //#endregion

package/dist/plugins/multi-session/index.mjs

@@ -20,6 +20,21 @@ const multiSession = (options) => {
 		id: "multi-session",
 		version: PACKAGE_VERSION,
 		endpoints: {
+			/**
+			* ### Endpoint
+			*
+			* GET `/multi-session/list-device-sessions`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.listDeviceSessions`
+			*
+			* **client:**
+			* `authClient.multiSession.listDeviceSessions`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-list-device-sessions)
+			*/
 			listDeviceSessions: createAuthEndpoint("/multi-session/list-device-sessions", {
 				method: "GET",
 				requireHeaders: true
@@ -38,6 +53,21 @@ const multiSession = (options) => {
 					user: parseUserOutput(ctx.context.options, item.user)
 				})));
 			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/multi-session/set-active`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.setActiveSession`
+			*
+			* **client:**
+			* `authClient.multiSession.setActive`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-set-active)
+			*/
 			setActiveSession: createAuthEndpoint("/multi-session/set-active", {
 				method: "POST",
 				body: setActiveSessionBodySchema,
@@ -71,6 +101,21 @@ const multiSession = (options) => {
 					user: parseUserOutput(ctx.context.options, session.user)
 				});
 			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/multi-session/revoke`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.revokeDeviceSession`
+			*
+			* **client:**
+			* `authClient.multiSession.revoke`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-revoke)
+			*/
 			revokeDeviceSession: createAuthEndpoint("/multi-session/revoke", {
 				method: "POST",
 				body: revokeDeviceSessionBodySchema,

package/dist/plugins/oauth-popup/client.d.mts

@@ -2,9 +2,7 @@ import { POPUP_TOKEN_STORAGE_KEY } from "./constants.mjs";
 import { OAUTH_POPUP_ERROR_CODES } from "./error-codes.mjs";
 import { oauthPopup } from "./index.mjs";
 import { BetterAuthClientOptions, ClientStore } from "@better-auth/core";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
 import { BetterFetch, BetterFetchPlugin } from "@better-fetch/fetch";
-
 //#region src/plugins/oauth-popup/client.d.ts
 /** Inputs for `authClient.signIn.popup`; mirror the redirect sign-in. */
 interface SignInPopupOptions {
@@ -52,11 +50,7 @@ interface SignInPopupDeps {
  * page to post the session token back, stores it for the bearer fetch plugin,
  * and refreshes the reactive session.
  */
-declare function createSignInPopup({
-  $fetch,
-  options,
-  notifySessionSignal
-}: SignInPopupDeps): (opts: SignInPopupOptions) => Promise<SignInPopupResult>;
+declare function createSignInPopup({ $fetch, options, notifySessionSignal }: SignInPopupDeps): (opts: SignInPopupOptions) => Promise<SignInPopupResult>;
 /**
  * Client plugin for popup OAuth sign-in. Adds `authClient.signIn.popup`. Pair
  * with the server `oauthPopup` and `bearer` plugins.
@@ -66,10 +60,10 @@ declare const oauthPopupClient: () => {
   version: string;
   $InferServerPlugin: ReturnType<typeof oauthPopup>;
   $ERROR_CODES: {
-    POPUP_SIGN_IN_FAILED: _better_auth_core_utils_error_codes0.RawError<"POPUP_SIGN_IN_FAILED">;
-    POPUP_BLOCKED: _better_auth_core_utils_error_codes0.RawError<"POPUP_BLOCKED">;
-    POPUP_CLOSED: _better_auth_core_utils_error_codes0.RawError<"POPUP_CLOSED">;
-    POPUP_TIMEOUT: _better_auth_core_utils_error_codes0.RawError<"POPUP_TIMEOUT">;
+    POPUP_SIGN_IN_FAILED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_SIGN_IN_FAILED">;
+    POPUP_BLOCKED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_BLOCKED">;
+    POPUP_CLOSED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_CLOSED">;
+    POPUP_TIMEOUT: import("@better-auth/core/utils/error-codes").RawError<"POPUP_TIMEOUT">;
   };
   fetchPlugins: BetterFetchPlugin[];
   getActions: ($fetch: BetterFetch, $store: ClientStore, options: BetterAuthClientOptions | undefined) => {
@@ -79,4 +73,4 @@ declare const oauthPopupClient: () => {
   };
 };
 //#endregion
-export { SignInPopupOptions, SignInPopupResult, createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };
+export { OAUTH_POPUP_ERROR_CODES, POPUP_TOKEN_STORAGE_KEY, SignInPopupOptions, SignInPopupResult, createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };

package/dist/plugins/oauth-popup/client.mjs

@@ -74,10 +74,12 @@ function popupError(code, status) {
 	};
 }
 function centeredFeatures() {
-	return `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${window.screenX + (window.outerWidth - POPUP_WIDTH) / 2},top=${window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2},menubar=no,toolbar=no`;
+	const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;
+	const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;
+	return `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},menubar=no,toolbar=no`;
 }
 function randomNonce() {
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	crypto.getRandomValues(bytes);
 	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -200,4 +202,4 @@ const oauthPopupClient = () => {
 	};
 };
 //#endregion
-export { createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };
+export { OAUTH_POPUP_ERROR_CODES, POPUP_TOKEN_STORAGE_KEY, createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };

package/dist/plugins/oauth-popup/error-codes.d.mts

@@ -1,11 +1,9 @@
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/oauth-popup/error-codes.d.ts
 declare const OAUTH_POPUP_ERROR_CODES: {
-  POPUP_SIGN_IN_FAILED: _better_auth_core_utils_error_codes0.RawError<"POPUP_SIGN_IN_FAILED">;
-  POPUP_BLOCKED: _better_auth_core_utils_error_codes0.RawError<"POPUP_BLOCKED">;
-  POPUP_CLOSED: _better_auth_core_utils_error_codes0.RawError<"POPUP_CLOSED">;
-  POPUP_TIMEOUT: _better_auth_core_utils_error_codes0.RawError<"POPUP_TIMEOUT">;
+  POPUP_SIGN_IN_FAILED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_SIGN_IN_FAILED">;
+  POPUP_BLOCKED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_BLOCKED">;
+  POPUP_CLOSED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_CLOSED">;
+  POPUP_TIMEOUT: import("@better-auth/core/utils/error-codes").RawError<"POPUP_TIMEOUT">;
 };
 //#endregion
 export { OAUTH_POPUP_ERROR_CODES };

package/dist/plugins/oauth-popup/index.d.mts

@@ -1,11 +1,7 @@
 import { OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_MESSAGE_TYPE, POPUP_MARKER_COOKIE } from "./constants.mjs";
 import { OAUTH_POPUP_ERROR_CODES } from "./error-codes.mjs";
 import { OAuthPopupData, OAuthPopupMessage } from "./types.mjs";
-import * as _better_auth_core0 from "@better-auth/core";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/oauth-popup/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -32,13 +28,13 @@ declare const oauthPopup: () => {
   id: "oauth-popup";
   version: string;
   $ERROR_CODES: {
-    POPUP_SIGN_IN_FAILED: _better_auth_core_utils_error_codes0.RawError<"POPUP_SIGN_IN_FAILED">;
-    POPUP_BLOCKED: _better_auth_core_utils_error_codes0.RawError<"POPUP_BLOCKED">;
-    POPUP_CLOSED: _better_auth_core_utils_error_codes0.RawError<"POPUP_CLOSED">;
-    POPUP_TIMEOUT: _better_auth_core_utils_error_codes0.RawError<"POPUP_TIMEOUT">;
+    POPUP_SIGN_IN_FAILED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_SIGN_IN_FAILED">;
+    POPUP_BLOCKED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_BLOCKED">;
+    POPUP_CLOSED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_CLOSED">;
+    POPUP_TIMEOUT: import("@better-auth/core/utils/error-codes").RawError<"POPUP_TIMEOUT">;
   };
   endpoints: {
-    oauthPopupStart: better_call0.StrictEndpoint<"/oauth-popup/start", {
+    oauthPopupStart: import("better-call").StrictEndpoint<"/oauth-popup/start", {
       method: "GET";
       query: z.ZodObject<{
         provider: z.ZodString;
@@ -58,10 +54,10 @@ declare const oauthPopup: () => {
   };
   hooks: {
     after: {
-      matcher(context: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };
 //#endregion
-export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_SCRIPT_CSP_HASH, oauthPopup };
+export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, type OAuthPopupData, type OAuthPopupMessage, POPUP_MARKER_COOKIE, oauthPopup };

package/dist/plugins/oauth-popup/index.mjs

@@ -225,4 +225,4 @@ const oauthPopup = () => {
 	};
 };
 //#endregion
-export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_SCRIPT_CSP_HASH, oauthPopup };
+export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, oauthPopup };

package/dist/plugins/oauth-popup/types.d.mts

@@ -1,5 +1,4 @@
 import { OAUTH_POPUP_MESSAGE_TYPE } from "./constants.mjs";
-
 //#region src/plugins/oauth-popup/types.d.ts
 /** OAuth error relayed to the opener when the flow fails. */
 interface OAuthPopupError {
@@ -27,4 +26,4 @@ interface OAuthPopupData extends OAuthPopupMessage {
   targetOrigin: string;
 }
 //#endregion
-export { OAuthPopupData, OAuthPopupMessage };
+export { OAuthPopupData, OAuthPopupError, OAuthPopupMessage };

package/dist/plugins/oauth-proxy/index.d.mts

@@ -1,8 +1,5 @@
-import * as _better_auth_core0 from "@better-auth/core";
 import { SecretConfig } from "@better-auth/core";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/oauth-proxy/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -58,14 +55,14 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
   version: string;
   options: NoInfer<O>;
   endpoints: {
-    oAuthProxy: better_call0.StrictEndpoint<"/oauth-proxy-callback", {
+    oAuthProxy: import("better-call").StrictEndpoint<"/oauth-proxy-callback", {
       method: "GET";
       operationId: string;
       query: z.ZodObject<{
         callbackURL: z.ZodString;
         profile: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
       metadata: {
         openapi: {
           operationId: string;
@@ -100,12 +97,12 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
   };
   hooks: {
     before: {
-      matcher(context: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(context: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };

package/dist/plugins/oauth-proxy/index.mjs

@@ -10,7 +10,7 @@ import { parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
-import { defu } from "defu";
+import { defu as defu$1 } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/oauth-proxy/index.ts
@@ -148,7 +148,7 @@ const oAuthProxy = (opts) => {
 					return context.path === "/callback/:id";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
-					const callbackParams = defu(ctx.query, ctx.body);
+					const callbackParams = defu$1(ctx.query, ctx.body);
 					const state = callbackParams.state;
 					if (!state || typeof state !== "string") return;
 					let statePackage;

package/dist/plugins/oidc-provider/authorize.mjs

@@ -142,6 +142,15 @@ async function authorize(ctx, options) {
 				scope: requestScope,
 				userId: session.user.id,
 				authTime: new Date(session.session.createdAt).getTime(),
+				/**
+				* Consent is required per OIDC spec unless:
+				* 1. Client is trusted (skipConsent = true)
+				* 2. User has already consented (and prompt is not "consent")
+				*
+				* When consent is required, the code needs to be treated as a
+				* consent request. Once the user consents, the code will be
+				* updated with the actual authorization code.
+				*/
 				requireConsent,
 				state: requireConsent ? query.state : null,
 				codeChallenge: query.code_challenge,

package/dist/plugins/oidc-provider/client.d.mts

@@ -1,6 +1,5 @@
 import { AuthorizationQuery, Client, CodeVerificationValue, OAuthAccessToken, OIDCMetadata, OIDCOptions, TokenBody } from "./types.mjs";
 import { oidcProvider } from "./index.mjs";
-
 //#region src/plugins/oidc-provider/client.d.ts
 /**
  * @deprecated Use `@better-auth/oauth-provider` instead. This plugin will be removed in the next major version.
@@ -13,4 +12,4 @@ declare const oidcClient: () => {
 };
 type OidcClientPlugin = ReturnType<typeof oidcClient>;
 //#endregion
-export { OidcClientPlugin, oidcClient };
+export { type AuthorizationQuery, type Client, type CodeVerificationValue, type OAuthAccessToken, type OIDCMetadata, type OIDCOptions, OidcClientPlugin, type TokenBody, oidcClient };