better-auth 1.6.22 → 1.6.24

package/dist/plugins/oidc-provider/index.d.mts

@@ -1,12 +1,10 @@
 import { InferOptionSchema } from "../../types/plugins.mjs";
 import { schema } from "./schema.mjs";
 import { AuthorizationQuery, Client, CodeVerificationValue, OAuthAccessToken, OIDCMetadata, OIDCOptions, TokenBody } from "./types.mjs";
+import "../index.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as _better_auth_core_db0 from "@better-auth/core/db";
-import * as better_call0 from "better-call";
 import { OpenAPIParameter } from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/oidc-provider/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -41,21 +39,21 @@ declare const oidcProvider: (options: OIDCOptions) => {
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<Response | {
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<Response | {
         redirect: boolean;
         url: string;
       } | undefined>;
     }[];
   };
   endpoints: {
-    getOpenIdConfig: better_call0.StrictEndpoint<"/.well-known/openid-configuration", {
+    getOpenIdConfig: import("better-call").StrictEndpoint<"/.well-known/openid-configuration", {
       method: "GET";
       operationId: string;
       metadata: {
         readonly scope: "server";
       };
     }, OIDCMetadata>;
-    oAuth2authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
+    oAuth2authorize: import("better-call").StrictEndpoint<"/oauth2/authorize", {
       method: "GET";
       operationId: string;
       query: z.ZodRecord<z.ZodString, z.ZodAny>;
@@ -82,14 +80,14 @@ declare const oidcProvider: (options: OIDCOptions) => {
       redirect: boolean;
       url: string;
     }>;
-    oAuthConsent: better_call0.StrictEndpoint<"/oauth2/consent", {
+    oAuthConsent: import("better-call").StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       operationId: string;
       body: z.ZodObject<{
         accept: z.ZodBoolean;
         consent_code: z.ZodOptional<z.ZodNullable<z.ZodOptional<z.ZodString>>>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -161,7 +159,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
     }, {
       redirectURI: string;
     }>;
-    oAuth2token: better_call0.StrictEndpoint<"/oauth2/token", {
+    oAuth2token: import("better-call").StrictEndpoint<"/oauth2/token", {
       method: "POST";
       operationId: string;
       body: z.ZodRecord<z.ZodAny, z.ZodAny>;
@@ -183,7 +181,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
       scope: string;
       id_token: string | undefined;
     }>;
-    oAuth2userInfo: better_call0.StrictEndpoint<"/oauth2/userinfo", {
+    oAuth2userInfo: import("better-call").StrictEndpoint<"/oauth2/userinfo", {
       method: "GET";
       operationId: string;
       metadata: {
@@ -275,7 +273,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/oidc-provider#api-method-oauth2-register)
      */
-    registerOAuthApplication: better_call0.StrictEndpoint<"/oauth2/register", {
+    registerOAuthApplication: import("better-call").StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodString>;
@@ -415,9 +413,9 @@ declare const oidcProvider: (options: OIDCOptions) => {
       client_secret?: string | undefined;
       client_id: string;
     }>;
-    getOAuthClient: better_call0.StrictEndpoint<"/oauth2/client/:id", {
+    getOAuthClient: import("better-call").StrictEndpoint<"/oauth2/client/:id", {
       method: "GET";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -488,7 +486,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
      *
      * @see [OpenID Connect RP-Initiated Logout Spec](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
      */
-    endSession: better_call0.StrictEndpoint<"/oauth2/endsession", {
+    endSession: import("better-call").StrictEndpoint<"/oauth2/endsession", {
       method: ("GET" | "POST")[];
       query: z.ZodOptional<z.ZodObject<{
         id_token_hint: z.ZodOptional<z.ZodString>;
@@ -514,7 +512,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
         scope: "server";
       };
     }, {
-      status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call0.Status;
+      status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | import("better-call").Status;
       body: ({
         message?: string;
         code?: string;
@@ -689,7 +687,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
     allowPlainCodeChallengeMethod: boolean;
     generateClientId?: (() => string) | undefined;
     generateClientSecret?: (() => string) | undefined;
-    getAdditionalUserInfoClaim?: ((user: _better_auth_core_db0.User & Record<string, any>, scopes: string[], client: Client) => Record<string, any> | Promise<Record<string, any>>) | undefined;
+    getAdditionalUserInfoClaim?: ((user: import("@better-auth/core/db").User & Record<string, any>, scopes: string[], client: Client) => Record<string, any> | Promise<Record<string, any>>) | undefined;
     trustedClients?: Client[] | undefined;
     storeClientSecret: "plain" | "hashed" | "encrypted" | {
       hash: (clientSecret: string) => Promise<string>;
@@ -702,4 +700,4 @@ declare const oidcProvider: (options: OIDCOptions) => {
   };
 };
 //#endregion
-export { AuthorizationQuery, Client, CodeVerificationValue, OAuthAccessToken, OIDCMetadata, OIDCOptions, TokenBody, getClient, getMetadata, oidcProvider };
+export { type AuthorizationQuery, type Client, type CodeVerificationValue, type OAuthAccessToken, type OIDCMetadata, type OIDCOptions, type TokenBody, getClient, getMetadata, oidcProvider };

package/dist/plugins/oidc-provider/index.mjs

@@ -414,8 +414,7 @@ const oidcProvider = (options) => {
 					client_id = id;
 					client_secret = secret;
 				}
-				const now = Date.now();
-				const iat = Math.floor(now / 1e3);
+				const iat = Math.floor(Date.now() / 1e3);
 				const exp = iat + (opts.accessTokenExpiresIn ?? 3600);
 				const accessTokenExpiresAt = /* @__PURE__ */ new Date(exp * 1e3);
 				const refreshTokenExpiresAt = /* @__PURE__ */ new Date((iat + (opts.refreshTokenExpiresIn ?? 604800)) * 1e3);
@@ -765,6 +764,21 @@ const oidcProvider = (options) => {
 					...userClaims
 				});
 			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/oauth2/register`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.registerOAuthApplication`
+			*
+			* **client:**
+			* `authClient.oauth2.register`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/oidc-provider#api-method-oauth2-register)
+			*/
 			registerOAuthApplication: createAuthEndpoint("/oauth2/register", {
 				method: "POST",
 				body: registerOAuthApplicationBodySchema,
@@ -965,6 +979,16 @@ const oidcProvider = (options) => {
 					icon: client.icon || null
 				});
 			}),
+			/**
+			* ### Endpoint
+			*
+			* GET/POST `/oauth2/endsession`
+			*
+			* Implements RP-Initiated Logout as per OpenID Connect RP-Initiated Logout 1.0.
+			* Allows relying parties to request that an OpenID Provider log out the end-user.
+			*
+			* @see [OpenID Connect RP-Initiated Logout Spec](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
+			*/
 			endSession: createAuthEndpoint("/oauth2/endsession", {
 				method: ["GET", "POST"],
 				query: z.object({

package/dist/plugins/oidc-provider/schema.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-
 //#region src/plugins/oidc-provider/schema.d.ts
 declare const oAuthApplicationSchema: z.ZodObject<{
   clientId: z.ZodString;

package/dist/plugins/oidc-provider/schema.mjs

@@ -1,17 +1,54 @@
 import * as z from "zod";
 //#region src/plugins/oidc-provider/schema.ts
 z.object({
+	/**
+	* Client ID
+	*
+	* size 32
+	*
+	* as described on https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2
+	*/
 	clientId: z.string(),
+	/**
+	* Client Secret
+	*
+	* A secret for the client, if required by the authorization server.
+	* Optional for public clients using PKCE.
+	*
+	* size 32
+	*/
 	clientSecret: z.string().optional(),
+	/**
+	* The client type
+	*
+	* as described on https://www.rfc-editor.org/rfc/rfc6749.html#section-2.1
+	*
+	* - web - A web application
+	* - native - A mobile application
+	* - user-agent-based - A user-agent-based application
+	* - public - A public client (PKCE-enabled, no client_secret)
+	*/
 	type: z.enum([
 		"web",
 		"native",
 		"user-agent-based",
 		"public"
 	]),
+	/**
+	* The name of the client.
+	*/
 	name: z.string(),
+	/**
+	* The icon of the client.
+	*/
 	icon: z.string().optional(),
+	/**
+	* Additional metadata about the client.
+	*/
 	metadata: z.string().optional(),
+	/**
+	* Whether the client is disabled or not.
+	*/
 	disabled: z.boolean().optional().default(false),
 	redirectUrls: z.string(),
 	userId: z.string().optional(),

package/dist/plugins/oidc-provider/types.d.mts

@@ -1,7 +1,7 @@
 import { User } from "../../types/models.mjs";
 import { InferOptionSchema } from "../../types/plugins.mjs";
+import "../../types/index.mjs";
 import { OAuthApplication, schema } from "./schema.mjs";
-
 //#region src/plugins/oidc-provider/types.d.ts
 interface OIDCOptions {
   /** @internal */

package/dist/plugins/one-tap/client.d.mts

@@ -1,7 +1,4 @@
-import * as _better_auth_core0 from "@better-auth/core";
 import { ClientFetchOption } from "@better-auth/core";
-import * as _better_fetch_fetch0 from "@better-fetch/fetch";
-
 //#region src/plugins/one-tap/client.d.ts
 declare global {
   interface Window {
@@ -162,13 +159,13 @@ declare const oneTapClient: (options: GoogleOneTapOptions) => {
     id: string;
     name: string;
     hooks: {
-      onResponse(ctx: _better_fetch_fetch0.ResponseContext): Promise<void>;
+      onResponse(ctx: import("@better-fetch/fetch").ResponseContext): Promise<void>;
     };
   }[];
-  getActions: ($fetch: _better_fetch_fetch0.BetterFetch, _: _better_auth_core0.ClientStore) => {
+  getActions: ($fetch: import("@better-fetch/fetch").BetterFetch, _: import("@better-auth/core").ClientStore) => {
     oneTap: (opts?: GoogleOneTapActionOptions | undefined, fetchOptions?: ClientFetchOption | undefined) => Promise<void>;
   };
-  getAtoms($fetch: _better_fetch_fetch0.BetterFetch): {};
+  getAtoms($fetch: import("@better-fetch/fetch").BetterFetch): {};
 };
 //#endregion
 export { GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, oneTapClient };

package/dist/plugins/one-tap/client.mjs

@@ -124,6 +124,9 @@ const oneTapClient = (options) => {
 							context: contextValue,
 							ux_mode: opts?.uxMode || "popup",
 							nonce: opts?.nonce,
+							/**
+							* @see {@link https://developers.google.com/identity/gsi/web/guides/overview}
+							*/
 							itp_support: true,
 							use_fedcm_for_prompt: useFedCM,
 							...options.additionalOptions

package/dist/plugins/one-tap/index.d.mts

@@ -1,6 +1,4 @@
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/one-tap/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -28,7 +26,7 @@ declare const oneTap: (options?: OneTapOptions | undefined) => {
   id: "one-tap";
   version: string;
   endpoints: {
-    oneTapCallback: better_call0.StrictEndpoint<"/one-tap/callback", {
+    oneTapCallback: import("better-call").StrictEndpoint<"/one-tap/callback", {
       method: "POST";
       body: z.ZodObject<{
         idToken: z.ZodString;

package/dist/plugins/one-tap/index.mjs

@@ -10,6 +10,11 @@ import * as z from "zod";
 //#region src/plugins/one-tap/index.ts
 const oneTapCallbackBodySchema = z.object({
 	idToken: z.string().meta({ description: "Google ID token, which the client obtains from the One Tap API" }),
+	/**
+	* Sent so the global origin-check middleware validates the post-login
+	* redirect target against `trustedOrigins`. Without it the client performs
+	* an unvalidated `window.location` redirect, which is an open redirect.
+	*/
 	callbackURL: z.string().meta({ description: "URL to redirect to after a successful sign-in" }).optional()
 });
 const oneTap = (options) => ({

package/dist/plugins/one-time-token/client.d.mts

@@ -1,5 +1,4 @@
 import { OneTimeTokenOptions, oneTimeToken } from "./index.mjs";
-
 //#region src/plugins/one-time-token/client.d.ts
 declare const oneTimeTokenClient: () => {
   id: "one-time-token";
@@ -7,4 +6,4 @@ declare const oneTimeTokenClient: () => {
   $InferServerPlugin: ReturnType<typeof oneTimeToken>;
 };
 //#endregion
-export { oneTimeTokenClient };
+export { type OneTimeTokenOptions, oneTimeTokenClient };

package/dist/plugins/one-time-token/index.d.mts

@@ -1,8 +1,7 @@
 import { Session, User } from "../../types/models.mjs";
+import "../../types/index.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/one-time-token/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -67,9 +66,9 @@ declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-generate)
      */
-    generateOneTimeToken: better_call0.StrictEndpoint<"/one-time-token/generate", {
+    generateOneTimeToken: import("better-call").StrictEndpoint<"/one-time-token/generate", {
       method: "GET";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -110,7 +109,7 @@ declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-verify)
      */
-    verifyOneTimeToken: better_call0.StrictEndpoint<"/one-time-token/verify", {
+    verifyOneTimeToken: import("better-call").StrictEndpoint<"/one-time-token/verify", {
       method: "POST";
       body: z.ZodObject<{
         token: z.ZodString;
@@ -123,7 +122,7 @@ declare const oneTimeToken: (options?: OneTimeTokenOptions | undefined) => {
   hooks: {
     after: {
       matcher: () => true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
   options: OneTimeTokenOptions | undefined;

package/dist/plugins/one-time-token/index.mjs

@@ -32,6 +32,21 @@ const oneTimeToken = (options) => {
 		id: "one-time-token",
 		version: PACKAGE_VERSION,
 		endpoints: {
+			/**
+			* ### Endpoint
+			*
+			* GET `/one-time-token/generate`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.generateOneTimeToken`
+			*
+			* **client:**
+			* `authClient.oneTimeToken.generate`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-generate)
+			*/
 			generateOneTimeToken: createAuthEndpoint("/one-time-token/generate", {
 				method: "GET",
 				use: [sessionMiddleware]
@@ -41,6 +56,21 @@ const oneTimeToken = (options) => {
 				const token = await generateToken(c, session);
 				return c.json({ token });
 			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/one-time-token/verify`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.verifyOneTimeToken`
+			*
+			* **client:**
+			* `authClient.oneTimeToken.verify`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/one-time-token#api-method-one-time-token-verify)
+			*/
 			verifyOneTimeToken: createAuthEndpoint("/one-time-token/verify", {
 				method: "POST",
 				body: verifyOneTimeTokenBodySchema

package/dist/plugins/open-api/generator.d.mts

@@ -1,7 +1,6 @@
 import { AuthContext, BetterAuthOptions } from "@better-auth/core";
 import { DBFieldAttributeConfig, DBFieldType } from "@better-auth/core/db";
 import { OpenAPIParameter, OpenAPISchemaType } from "better-call";
-
 //#region src/plugins/open-api/generator.d.ts
 interface Path {
   get?: OpenAPIOperation | undefined;

package/dist/plugins/open-api/generator.mjs

@@ -2,7 +2,7 @@ import { db_exports } from "../../db/index.mjs";
 import { getEndpoints } from "../../api/index.mjs";
 import * as z from "zod";
 //#region src/plugins/open-api/generator.ts
-const OPEN_API_SCHEMA_TYPES = new Set([
+const OPEN_API_SCHEMA_TYPES = /* @__PURE__ */ new Set([
 	"string",
 	"number",
 	"boolean",
@@ -47,7 +47,7 @@ function withDescription(schema, zodType) {
 function addNullType(schema) {
 	if (schema.type) {
 		const type = Array.isArray(schema.type) ? schema.type : [schema.type];
-		const nullableType = Array.from(new Set([...type, "null"]));
+		const nullableType = Array.from(/* @__PURE__ */ new Set([...type, "null"]));
 		return {
 			...schema,
 			type: nullableType
@@ -134,7 +134,7 @@ function mergeObjectSchemas(left, right, description) {
 		if (properties[key] !== void 0 && !areSchemasEqual(properties[key], value)) return;
 		properties[key] = value;
 	}
-	const required = Array.from(new Set([...left.required || [], ...right.required || []]));
+	const required = Array.from(/* @__PURE__ */ new Set([...left.required || [], ...right.required || []]));
 	const leftAdditionalProperties = left.additionalProperties;
 	const rightAdditionalProperties = right.additionalProperties;
 	if (!areSchemaMembersCompatible(leftAdditionalProperties, rightAdditionalProperties)) return;
@@ -162,6 +162,82 @@ function getRequestBody(options) {
 		content: { "application/json": { schema } }
 	};
 }
+/**
+* Paths that accept `user.additionalFields` and plugin user schema fields via
+* `parseUserInput`. Their static OpenAPI request bodies need those fields merged in.
+*/
+const USER_INPUT_BODY_PATHS = /* @__PURE__ */ new Set(["/sign-up/email", "/update-user"]);
+function dbFieldToRequestBodyProperty(field) {
+	if (field.type === "date") return {
+		type: "string",
+		format: "date-time"
+	};
+	if (field.type === "json") return {
+		type: "object",
+		additionalProperties: true
+	};
+	if (field.type === "string[]") return {
+		type: "array",
+		items: { type: "string" }
+	};
+	if (field.type === "number[]") return {
+		type: "array",
+		items: { type: "number" }
+	};
+	if (Array.isArray(field.type)) return {
+		type: "string",
+		enum: field.type
+	};
+	const schema = { type: field.type };
+	if (field.defaultValue !== void 0 && typeof field.defaultValue !== "function") schema.default = field.defaultValue;
+	return schema;
+}
+/**
+* Collect client-writable user fields from `user.additionalFields` and plugin
+* schemas. Mirrors `getFields(..., "input")` used by `parseUserInput`.
+*/
+function getUserInputRequestBodyFields(options) {
+	let fields = { ...options.user?.additionalFields ?? {} };
+	for (const plugin of options.plugins || []) {
+		const pluginUserFields = plugin.schema?.user?.fields;
+		if (pluginUserFields) fields = {
+			...fields,
+			...pluginUserFields
+		};
+	}
+	const properties = {};
+	const required = [];
+	for (const [key, field] of Object.entries(fields)) {
+		if (!field || field.input === false) continue;
+		properties[key] = dbFieldToRequestBodyProperty(field);
+		if (field.required === true && field.defaultValue === void 0) required.push(key);
+	}
+	return {
+		properties,
+		required
+	};
+}
+function applyUserInputFieldsToRequestBody(path, requestBody, options) {
+	if (!USER_INPUT_BODY_PATHS.has(path)) return requestBody;
+	const { properties: inputProperties, required: inputRequired } = getUserInputRequestBodyFields(options);
+	if (Object.keys(inputProperties).length === 0) return requestBody;
+	const existingSchema = requestBody?.content?.["application/json"]?.schema;
+	const properties = { ...existingSchema?.properties ?? {} };
+	for (const [key, value] of Object.entries(inputProperties)) if (properties[key] === void 0) properties[key] = value;
+	const required = new Set(existingSchema?.required ?? []);
+	if (path === "/sign-up/email") {
+		for (const key of inputRequired) if (properties[key] !== void 0) required.add(key);
+	}
+	return {
+		...requestBody,
+		content: { "application/json": { schema: {
+			...existingSchema ?? {},
+			type: existingSchema?.type ?? "object",
+			properties,
+			...required.size > 0 ? { required: Array.from(required) } : {}
+		} } }
+	};
+}
 function toOpenApiSchema(zodType) {
 	if (zodType instanceof z.ZodOptional) return toOpenApiSchema(unwrapZodSchema(zodType));
 	if (zodType instanceof z.ZodNullable) return addNullType(toOpenApiSchema(unwrapZodSchema(zodType)));
@@ -323,7 +399,7 @@ async function generator(ctx, options) {
 	const components = { schemas: { ...Object.entries(tables).reduce((acc, [key, value]) => {
 		const modelName = key.charAt(0).toUpperCase() + key.slice(1);
 		const fields = value.fields;
-		const required = new Set(["id"]);
+		const required = /* @__PURE__ */ new Set(["id"]);
 		const properties = { id: {
 			type: "string",
 			readOnly: true
@@ -366,7 +442,7 @@ async function generator(ctx, options) {
 			}
 		};
 		for (const method of methods.filter((m) => m === "POST" || m === "PATCH" || m === "PUT")) {
-			const body = getRequestBody(options);
+			const body = applyUserInputFieldsToRequestBody(value.path, getRequestBody(options), ctx.options);
 			paths[path] = {
 				...paths[path],
 				[method.toLowerCase()]: {

package/dist/plugins/open-api/index.d.mts

@@ -1,7 +1,5 @@
 import { FieldSchema, OpenAPIModelSchema, OpenAPIParameter, OpenAPISchema, Path, generator } from "./generator.mjs";
 import { LiteralString } from "@better-auth/core";
-import * as better_call0 from "better-call";
-
 //#region src/plugins/open-api/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -44,7 +42,7 @@ declare const openAPI: <O extends OpenAPIOptions>(options?: O | undefined) => {
   id: "open-api";
   version: string;
   endpoints: {
-    generateOpenAPISchema: better_call0.StrictEndpoint<"/open-api/generate-schema", {
+    generateOpenAPISchema: import("better-call").StrictEndpoint<"/open-api/generate-schema", {
       method: "GET";
     }, {
       openapi: string;
@@ -84,7 +82,7 @@ declare const openAPI: <O extends OpenAPIOptions>(options?: O | undefined) => {
       }[];
       paths: Record<string, Path>;
     }>;
-    openAPIReference: better_call0.StrictEndpoint<LiteralString | "/reference", {
+    openAPIReference: import("better-call").StrictEndpoint<LiteralString | "/reference", {
       method: "GET";
       metadata: {
         readonly scope: "server";
@@ -94,4 +92,4 @@ declare const openAPI: <O extends OpenAPIOptions>(options?: O | undefined) => {
   options: NoInfer<O>;
 };
 //#endregion
-export { type FieldSchema, type OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, type Path, generator, openAPI };
+export { type FieldSchema, type OpenAPIModelSchema, OpenAPIOptions, type OpenAPIParameter, type OpenAPISchema, type Path, type generator, openAPI };

package/dist/plugins/organization/access/statement.d.mts

@@ -1,4 +1,5 @@
 import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/types.mjs";
+import "../../index.mjs";
 //#region src/plugins/organization/access/statement.d.ts
 declare const defaultStatements: {
   readonly organization: readonly ["update", "delete"];