better-auth 1.6.23 → 1.6.25

package/dist/plugins/generic-oauth/types.d.mts

@@ -1,7 +1,6 @@
 import { GenericEndpointContext } from "@better-auth/core";
 import { User } from "@better-auth/core/db";
 import { OAuth2Tokens, OAuth2UserInfo } from "@better-auth/core/oauth2";
-
 //#region src/plugins/generic-oauth/types.d.ts
 interface GenericOAuthOptions {
   /**
@@ -70,7 +69,7 @@ interface GenericOAuthConfig {
   responseType?: string | undefined;
   /**
    * The response mode to use for the authorization code request.
-    */
+   */
   responseMode?: ("query" | "form_post") | undefined;
   /**
    * Prompt parameter for the authorization request.

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -1,6 +1,3 @@
-import * as _better_auth_core0 from "@better-auth/core";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/haveibeenpwned/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -30,7 +27,7 @@ interface HaveIBeenPwnedOptions {
 declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
   id: "have-i-been-pwned";
   version: string;
-  init(ctx: _better_auth_core0.AuthContext): {
+  init(ctx: import("@better-auth/core").AuthContext): {
     context: {
       password: {
         hash(password: string): Promise<string>;
@@ -42,13 +39,13 @@ declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
           minPasswordLength: number;
           maxPasswordLength: number;
         };
-        checkPassword: (userId: string, ctx: _better_auth_core0.GenericEndpointContext<_better_auth_core0.BetterAuthOptions>) => Promise<boolean>;
+        checkPassword: (userId: string, ctx: import("@better-auth/core").GenericEndpointContext<import("@better-auth/core").BetterAuthOptions>) => Promise<boolean>;
       };
     };
   };
   options: HaveIBeenPwnedOptions | undefined;
   $ERROR_CODES: {
-    PASSWORD_COMPROMISED: _better_auth_core_utils_error_codes0.RawError<"PASSWORD_COMPROMISED">;
+    PASSWORD_COMPROMISED: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_COMPROMISED">;
   };
 };
 //#endregion

package/dist/plugins/index.d.mts

@@ -2,11 +2,13 @@ import { InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPlug
 import { HIDE_METADATA } from "../utils/hide-metadata.mjs";
 import { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset } from "./access/types.mjs";
 import { AuthorizeResponse, createAccessControl, role } from "./access/access.mjs";
+import "./access/index.mjs";
 import { OrganizationOptions } from "./organization/types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "./organization/schema.mjs";
 import { getOrgAdapter } from "./organization/adapter.mjs";
 import { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole } from "./admin/types.mjs";
 import { admin } from "./admin/admin.mjs";
+import "./admin/index.mjs";
 import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./anonymous/types.mjs";
 import { anonymous } from "./anonymous/index.mjs";
 import { BearerOptions, bearer } from "./bearer/index.mjs";
@@ -67,4 +69,5 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizationQuery, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, Client, CloudflareTurnstileOptions, CodeVerificationValue, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationOptions, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthAccessToken, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OIDCMetadata, OIDCOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, memberSchema, microsoftEntraId, ms, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oauthPopup, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, withMcpAuth, yandex };
+import "./organization/index.mjs";
+export { AccessControl, type AdminOptions, type AnonymousOptions, type AnonymousSession, ArrayElement, type Auth0Options, type AuthorizationQuery, AuthorizeResponse, type BackupCodeOptions, type BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, type CaptchaFoxOptions, type CaptchaOptions, type Client, type CloudflareTurnstileOptions, type CodeVerificationValue, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationOptions, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, type EmailOTPOptions, ExactRoleStatements, type FieldSchema, type GenericOAuthConfig, type GenericOAuthOptions, type GoogleRecaptchaOptions, type GumroadOptions, type HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, type HubSpotOptions, type InferAdminRolesFromOption, type InferInvitation, type InferMember, InferOptionSchema, type InferOrganization, type InferOrganizationRolesFromOption, type InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, type InferTeam, type Invitation, type InvitationInput, type InvitationStatus, type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, type KeycloakOptions, LastLoginMethodOptions, type LineOptions, type LoginResult, MagicLinkOptions, type Member, type MemberInput, type MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, type OAuthAccessToken, type OAuthPopupData, type OAuthPopupMessage, OAuthProxyOptions, type OIDCMetadata, type OIDCOptions, type OTPOptions, type OktaOptions, OneTapOptions, OneTimeTokenOptions, type OpenAPIModelSchema, OpenAPIOptions, type OpenAPIParameter, type OpenAPISchema, type Organization, OrganizationCreator, OrganizationEndpoints, type OrganizationInput, type OrganizationOptions, OrganizationPlugin, type OrganizationRole, type OrganizationSchema, POPUP_MARKER_COOKIE, type Path, type PatreonOptions, type PhoneNumberOptions, type Provider, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, type SessionWithImpersonatedBy, type SlackOptions, Statements, SubArray, Subset, type TOTPOptions, TWO_FACTOR_ERROR_CODES, type Team, TeamEndpoints, type TeamInput, type TeamMember, type TeamMemberInput, type TestCookie, type TestHelpers, type TestUtilsOptions, type TimeString, type TokenBody, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, type UserWithAnonymous, type UserWithPhoneNumber, type UserWithRole, UserWithTwoFactor, UsernameOptions, type YandexOptions, admin, anonymous, auth0, type backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, type defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, type encodeBackupCodes, type generateBackupCodes, generateExportedKeyPair, type generator, genericOAuth, type getBackupCodes, getClient, getJwtToken, getMCPProtectedResourceMetadata, getMCPProviderMetadata, getMetadata, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, type invitationSchema, type invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, mcp, type memberSchema, microsoftEntraId, type ms, multiSession, oAuthDiscoveryMetadata, oAuthProtectedResourceMetadata, oAuthProxy, oauthPopup, oidcProvider, okta, oneTap, oneTimeToken, openAPI, organization, type organizationRoleSchema, type organizationSchema, type otp2fa, parseRoles, patreon, phoneNumber, role, type roleSchema, type sec, signJWT, siwe, slack, type teamMemberSchema, type teamSchema, testUtils, toExpJWT, type totp2fa, twoFactor, twoFactorClient, username, type verifyBackupCode, verifyJWT, withMcpAuth, yandex };

package/dist/plugins/jwt/client.d.mts

@@ -1,8 +1,6 @@
 import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions } from "./types.mjs";
 import { jwt } from "./index.mjs";
 import { JSONWebKeySet } from "jose";
-import * as _better_fetch_fetch0 from "@better-fetch/fetch";
-
 //#region src/plugins/jwt/client.d.ts
 interface JwtClientOptions {
   jwks?: {
@@ -22,7 +20,7 @@ declare const jwtClient: (options?: JwtClientOptions) => {
   pathMethods: {
     [x: string]: "GET";
   };
-  getActions: ($fetch: _better_fetch_fetch0.BetterFetch) => {
+  getActions: ($fetch: import("@better-fetch/fetch").BetterFetch) => {
     jwks: (fetchOptions?: any) => Promise<{
       data: null;
       error: {
@@ -37,4 +35,4 @@ declare const jwtClient: (options?: JwtClientOptions) => {
   };
 };
 //#endregion
-export { jwtClient };
+export { type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, jwtClient };

package/dist/plugins/jwt/index.d.mts

@@ -2,11 +2,8 @@ import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions } from "./types.mjs";
 import { getJwtToken, signJWT } from "./sign.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./utils.mjs";
 import { verifyJWT } from "./verify.mjs";
-import * as _better_auth_core0 from "@better-auth/core";
-import * as better_call0 from "better-call";
 import * as z from "zod";
 import { JSONWebKeySet, JWTPayload } from "jose";
-
 //#region src/plugins/jwt/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -20,7 +17,7 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
   version: string;
   options: NoInfer<O>;
   endpoints: {
-    getJwks: better_call0.StrictEndpoint<string, {
+    getJwks: import("better-call").StrictEndpoint<string, {
       method: "GET";
       metadata: {
         openapi: {
@@ -97,10 +94,10 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
         };
       };
     }, JSONWebKeySet>;
-    getToken: better_call0.StrictEndpoint<"/token", {
+    getToken: import("better-call").StrictEndpoint<"/token", {
       method: "GET";
       requireHeaders: true;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -149,7 +146,7 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
     }, {
       token: string;
     }>;
-    signJWT: better_call0.StrictEndpoint<string, {
+    signJWT: import("better-call").StrictEndpoint<string, {
       method: "POST";
       metadata: {
         $Infer: {
@@ -166,7 +163,7 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
     }, {
       token: string;
     }>;
-    verifyJWT: better_call0.StrictEndpoint<string, {
+    verifyJWT: import("better-call").StrictEndpoint<string, {
       method: "POST";
       metadata: {
         $Infer: {
@@ -193,8 +190,8 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
   };
   hooks: {
     after: {
-      matcher(context: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
   schema: {
@@ -221,4 +218,4 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
   };
 };
 //#endregion
-export { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, createJwk, generateExportedKeyPair, getJwtToken, jwt, signJWT, toExpJWT, verifyJWT };
+export { type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, createJwk, generateExportedKeyPair, getJwtToken, jwt, signJWT, toExpJWT, verifyJWT };

package/dist/plugins/jwt/sign.d.mts

@@ -1,6 +1,5 @@
 import { JwtOptions } from "./types.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-
 //#region src/plugins/jwt/sign.d.ts
 type JWTPayloadWithOptional = {
   /**
@@ -44,7 +43,8 @@ type JWTPayloadWithOptional = {
    *
    * @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}
    */
-  iat?: number | undefined; /** Any other JWT Claim Set member. */
+  iat?: number | undefined;
+  /** Any other JWT Claim Set member. */
   [propName: string]: unknown | undefined;
 };
 declare function signJWT(ctx: GenericEndpointContext, config: {

package/dist/plugins/jwt/types.d.mts

@@ -1,9 +1,9 @@
 import { Session, User } from "../../types/models.mjs";
 import { InferOptionSchema } from "../../types/plugins.mjs";
+import "../../types/index.mjs";
 import { schema } from "./schema.mjs";
 import { Awaitable, GenericEndpointContext } from "@better-auth/core";
 import { JWTPayload } from "jose";
-
 //#region src/plugins/jwt/types.d.ts
 interface JwtOptions {
   jwks?: {

package/dist/plugins/jwt/utils.d.mts

@@ -1,7 +1,5 @@
 import { Jwk, JwtOptions } from "./types.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as jose from "jose";
-
 //#region src/plugins/jwt/utils.d.ts
 /**
  * Converts an expirationTime to ISO seconds expiration time (the format of JWT exp)
@@ -14,8 +12,8 @@ import * as jose from "jose";
  */
 declare function toExpJWT(expirationTime: number | Date | string, iat: number): number;
 declare function generateExportedKeyPair(options?: JwtOptions | undefined): Promise<{
-  publicWebKey: jose.JWK;
-  privateWebKey: jose.JWK;
+  publicWebKey: import("jose").JWK;
+  privateWebKey: import("jose").JWK;
   alg: "EdDSA" | "ES256" | "ES512" | "PS256" | "RS256";
   cfg: {
     crv?: "Ed25519" | undefined;

package/dist/plugins/jwt/verify.d.mts

@@ -1,6 +1,5 @@
 import { JwtOptions } from "./types.mjs";
 import { JWTPayload } from "jose";
-
 //#region src/plugins/jwt/verify.d.ts
 /**
  * Verify a JWT token using the JWKS public keys

package/dist/plugins/last-login-method/client.mjs

@@ -15,15 +15,28 @@ const lastLoginMethodClient = (config = {}) => {
 		version: PACKAGE_VERSION,
 		getActions() {
 			return {
+				/**
+				* Get the last used login method from cookies
+				* @returns The last used login method or null if not found
+				*/
 				getLastUsedLoginMethod: () => {
 					return getCookieValue(cookieName);
 				},
+				/**
+				* Clear the last used login method cookie
+				* This sets the cookie with an expiration date in the past
+				*/
 				clearLastUsedLoginMethod: () => {
 					if (typeof document !== "undefined") {
 						const domainPart = config.domain ? ` domain=${config.domain};` : "";
 						document.cookie = `${cookieName}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;${domainPart}`;
 					}
 				},
+				/**
+				* Check if a specific login method was the last used
+				* @param method The method to check
+				* @returns True if the method was the last used, false otherwise
+				*/
 				isLastUsedLoginMethod: (method) => {
 					return getCookieValue(cookieName) === method;
 				}

package/dist/plugins/last-login-method/index.d.mts

@@ -1,7 +1,4 @@
-import * as _better_auth_core0 from "@better-auth/core";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as better_call0 from "better-call";
-
 //#region src/plugins/last-login-method/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -35,6 +32,15 @@ interface LastLoginMethodOptions {
    * @default false
    */
   storeInDatabase?: boolean | undefined;
+  /**
+   * A hook to run before the last login method is stored in the cookie.
+   * Useful if you are required to follow GDPR or other regulations to ensure that you're allowed to store the last login method in the cookie.
+   *
+   * @param ctx - The context from the hook
+   * @param lastUsedLoginMethod - The last login method
+   * @returns `true` to store the cookie, `false` to skip storing it (authentication continues either way)
+   */
+  beforeStoreCookie?: ((ctx: GenericEndpointContext, lastUsedLoginMethod: string) => Promise<boolean> | boolean) | undefined;
   /**
    * Custom schema for the plugin
    * @default undefined
@@ -51,7 +57,7 @@ interface LastLoginMethodOptions {
 declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
   id: "last-login-method";
   version: string;
-  init(ctx: _better_auth_core0.AuthContext): {
+  init(ctx: import("@better-auth/core").AuthContext): {
     options: {
       databaseHooks: {
         user: {
@@ -98,7 +104,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
   schema: O["storeInDatabase"] extends true ? {

package/dist/plugins/last-login-method/index.mjs

@@ -71,6 +71,14 @@ const lastLoginMethod = (userConfig) => {
 							maxAge: config.maxAge,
 							httpOnly: false
 						};
+						let isPermitted = true;
+						if (config.beforeStoreCookie) try {
+							isPermitted = await config.beforeStoreCookie(ctx, lastUsedLoginMethod);
+						} catch (error) {
+							if (ctx.context.logger) ctx.context.logger.error?.("[LastLoginMethod] Error in beforeStoreCookie hook", error);
+							isPermitted = false;
+						}
+						if (!isPermitted) return;
 						ctx.setCookie(config.cookieName, lastUsedLoginMethod, cookieAttributes);
 					}
 				}

package/dist/plugins/magic-link/client.d.mts

@@ -1,5 +1,4 @@
 import { magicLink } from "./index.mjs";
-
 //#region src/plugins/magic-link/client.d.ts
 declare const magicLinkClient: () => {
   id: "magic-link";

package/dist/plugins/magic-link/index.d.mts

@@ -1,7 +1,5 @@
 import { Awaitable, GenericEndpointContext } from "@better-auth/core";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/magic-link/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -90,9 +88,10 @@ declare const magicLink: (options: MagicLinkOptions) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/sign-in#api-method-sign-in-magic-link)
      */
-    signInMagicLink: better_call0.StrictEndpoint<"/sign-in/magic-link", {
+    signInMagicLink: import("better-call").StrictEndpoint<"/sign-in/magic-link", {
       method: "POST";
       requireHeaders: true;
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
       body: z.ZodObject<{
         email: z.ZodEmail;
         name: z.ZodOptional<z.ZodString>;
@@ -142,7 +141,7 @@ declare const magicLink: (options: MagicLinkOptions) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/magic-link#api-method-magic-link-verify)
      */
-    magicLinkVerify: better_call0.StrictEndpoint<"/magic-link/verify", {
+    magicLinkVerify: import("better-call").StrictEndpoint<"/magic-link/verify", {
       method: "GET";
       query: z.ZodObject<{
         token: z.ZodString;
@@ -150,7 +149,7 @@ declare const magicLink: (options: MagicLinkOptions) => {
         errorCallbackURL: z.ZodOptional<z.ZodString>;
         newUserCallbackURL: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
       requireHeaders: true;
       metadata: {
         openapi: {

package/dist/plugins/magic-link/index.mjs

@@ -1,4 +1,4 @@
-import { originCheck } from "../../api/middlewares/origin-check.mjs";
+import { formCsrfMiddleware, originCheck } from "../../api/middlewares/origin-check.mjs";
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
@@ -38,9 +38,25 @@ const magicLink = (options) => {
 		id: "magic-link",
 		version: PACKAGE_VERSION,
 		endpoints: {
+			/**
+			* ### Endpoint
+			*
+			* POST `/sign-in/magic-link`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.signInMagicLink`
+			*
+			* **client:**
+			* `authClient.signIn.magicLink`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/sign-in#api-method-sign-in-magic-link)
+			*/
 			signInMagicLink: createAuthEndpoint("/sign-in/magic-link", {
 				method: "POST",
 				requireHeaders: true,
+				use: [formCsrfMiddleware],
 				body: signInMagicLinkBodySchema,
 				metadata: { openapi: {
 					operationId: "signInWithMagicLink",
@@ -81,6 +97,21 @@ const magicLink = (options) => {
 				}, ctx);
 				return ctx.json({ status: true });
 			}),
+			/**
+			* ### Endpoint
+			*
+			* GET `/magic-link/verify`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.magicLinkVerify`
+			*
+			* **client:**
+			* `authClient.magicLink.verify`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/magic-link#api-method-magic-link-verify)
+			*/
 			magicLinkVerify: createAuthEndpoint("/magic-link/verify", {
 				method: "GET",
 				query: magicLinkVerifyQuerySchema,

package/dist/plugins/mcp/authorize.mjs

@@ -94,6 +94,18 @@ async function authorizeMCPOAuth(ctx, options) {
 				scope: requestScope,
 				userId: session.user.id,
 				authTime: new Date(session.session.createdAt).getTime(),
+				/**
+				* If the prompt is set to `consent`, then we need
+				* to require the user to consent to the scopes.
+				*
+				* This means the code now needs to be treated as a
+				* consent request.
+				*
+				* once the user consents, the code will be updated
+				* with the actual code. This is to prevent the
+				* client from using the code before the user
+				* consents.
+				*/
 				requireConsent: query.prompt === "consent",
 				state: query.prompt === "consent" ? query.state : null,
 				codeChallenge: query.code_challenge,

package/dist/plugins/mcp/client/adapters.d.mts

@@ -1,5 +1,4 @@
 import { McpAuthClient, McpAuthClientOptions, McpSession } from "./index.mjs";
-
 //#region src/plugins/mcp/client/adapters.d.ts
 interface HonoContext {
   req: {

package/dist/plugins/mcp/client/index.d.mts

@@ -24,7 +24,9 @@ interface NodeLikeRequest {
 }
 interface NodeLikeResponse {
   set?: (name: string, value: string) => void;
+  get?: (name: string) => string | undefined;
   setHeader?: (name: string, value: string) => void;
+  getHeader?: (name: string) => string | number | string[] | undefined;
   status?: (code: number) => {
     json: (body: unknown) => void;
   };

package/dist/plugins/mcp/client/index.mjs

@@ -17,7 +17,19 @@ function buildCorsHeaders(authURL, allowedOrigin) {
 function makeWWWAuthenticate(authURL, resource) {
 	return `Bearer resource_metadata="${resource ? `${resource}/.well-known/oauth-protected-resource` : `${authURL}/.well-known/oauth-protected-resource`}"`;
 }
-function make401Response(authURL, resource) {
+function addExposeHeader(headers, headerName) {
+	const exposedHeaders = headers["Access-Control-Expose-Headers"];
+	if (!exposedHeaders) return {
+		...headers,
+		"Access-Control-Expose-Headers": headerName
+	};
+	const alreadyExposed = exposedHeaders.split(",").some((header) => header.trim().toLowerCase() === headerName.toLowerCase());
+	return {
+		...headers,
+		"Access-Control-Expose-Headers": alreadyExposed ? exposedHeaders : `${exposedHeaders}, ${headerName}`
+	};
+}
+function make401Response(authURL, resource, corsHeaders) {
 	const wwwAuth = makeWWWAuthenticate(authURL, resource);
 	return Response.json({
 		jsonrpc: "2.0",
@@ -29,10 +41,13 @@ function make401Response(authURL, resource) {
 		id: null
 	}, {
 		status: 401,
-		headers: { "WWW-Authenticate": wwwAuth }
+		headers: {
+			...addExposeHeader(corsHeaders, "WWW-Authenticate"),
+			"WWW-Authenticate": wwwAuth
+		}
 	});
 }
-function send401Node(res, wwwAuth, message) {
+function send401Node(res, wwwAuth, message, corsHeaders) {
 	const body = JSON.stringify({
 		jsonrpc: "2.0",
 		error: {
@@ -41,13 +56,21 @@ function send401Node(res, wwwAuth, message) {
 		},
 		id: null
 	});
+	const existingExposedHeaders = res.get?.("Access-Control-Expose-Headers") ?? res.getHeader?.("Access-Control-Expose-Headers") ?? res.getHeader?.("access-control-expose-headers");
+	const headers = {
+		...addExposeHeader({
+			...corsHeaders,
+			...existingExposedHeaders ? { "Access-Control-Expose-Headers": Array.isArray(existingExposedHeaders) ? existingExposedHeaders.join(", ") : String(existingExposedHeaders) } : {}
+		}, "WWW-Authenticate"),
+		"WWW-Authenticate": wwwAuth
+	};
 	if (typeof res.set === "function") {
-		res.set("WWW-Authenticate", wwwAuth);
+		for (const [name, value] of Object.entries(headers)) res.set(name, value);
 		res.status?.(401).json(JSON.parse(body));
 	} else if (typeof res.writeHead === "function") {
 		res.writeHead(401, {
 			"Content-Type": "application/json",
-			"WWW-Authenticate": wwwAuth
+			...headers
 		});
 		res.end?.(body);
 	}
@@ -78,9 +101,10 @@ function createMcpAuthClient(options) {
 				headers: corsHeaders
 			});
 			const authHeader = req.headers.get("Authorization");
-			if (!authHeader || !authHeader.startsWith("Bearer ")) return make401Response(authURL, options.resource);
-			const session = await verifyToken(authHeader.slice(7));
-			if (!session) return make401Response(authURL, options.resource);
+			if (!authHeader || !authHeader.startsWith("Bearer ")) return make401Response(authURL, options.resource, corsHeaders);
+			const token = authHeader.slice(7);
+			const session = await verifyToken(token);
+			if (!session) return make401Response(authURL, options.resource, corsHeaders);
 			return fn(req, session);
 		};
 	};
@@ -128,12 +152,13 @@ function createMcpAuthClient(options) {
 		return async (req, res, next) => {
 			const authHeader = req.headers?.authorization ?? req.headers?.get?.("Authorization") ?? req.get?.("Authorization");
 			if (!authHeader || !authHeader.startsWith("Bearer ")) {
-				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Unauthorized: Authentication required");
+				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Unauthorized: Authentication required", corsHeaders);
 				return;
 			}
-			const session = await verifyToken(authHeader.slice(7));
+			const token = authHeader.slice(7);
+			const session = await verifyToken(token);
 			if (!session) {
-				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Invalid or expired token");
+				send401Node(res, makeWWWAuthenticate(authURL, options.resource), "Invalid or expired token", corsHeaders);
 				return;
 			}
 			req.mcpSession = session;

package/dist/plugins/mcp/index.d.mts

@@ -1,8 +1,7 @@
 import { OAuthAccessToken, OIDCMetadata, OIDCOptions } from "../oidc-provider/types.mjs";
+import "../oidc-provider/index.mjs";
 import { BetterAuthOptions, GenericEndpointContext } from "@better-auth/core";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/mcp/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -31,18 +30,18 @@ declare const mcp: (options: MCPOptions) => {
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
   endpoints: {
-    oAuthConsent: better_call0.StrictEndpoint<"/oauth2/consent", {
+    oAuthConsent: import("better-call").StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       operationId: string;
       body: z.ZodObject<{
         accept: z.ZodBoolean;
         consent_code: z.ZodOptional<z.ZodNullable<z.ZodOptional<z.ZodString>>>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -114,13 +113,13 @@ declare const mcp: (options: MCPOptions) => {
     }, {
       redirectURI: string;
     }>;
-    getMcpOAuthConfig: better_call0.StrictEndpoint<"/.well-known/oauth-authorization-server", {
+    getMcpOAuthConfig: import("better-call").StrictEndpoint<"/.well-known/oauth-authorization-server", {
       method: "GET";
       metadata: {
         readonly scope: "server";
       };
     }, OIDCMetadata | null>;
-    getMCPProtectedResource: better_call0.StrictEndpoint<"/.well-known/oauth-protected-resource", {
+    getMCPProtectedResource: import("better-call").StrictEndpoint<"/.well-known/oauth-protected-resource", {
       method: "GET";
       metadata: {
         readonly scope: "server";
@@ -133,7 +132,7 @@ declare const mcp: (options: MCPOptions) => {
       bearer_methods_supported: string[];
       resource_signing_alg_values_supported: string[];
     }>;
-    mcpOAuthAuthorize: better_call0.StrictEndpoint<"/mcp/authorize", {
+    mcpOAuthAuthorize: import("better-call").StrictEndpoint<"/mcp/authorize", {
       method: "GET";
       query: z.ZodRecord<z.ZodString, z.ZodAny>;
       metadata: {
@@ -156,7 +155,7 @@ declare const mcp: (options: MCPOptions) => {
         };
       };
     }, void>;
-    mcpOAuthToken: better_call0.StrictEndpoint<"/mcp/token", {
+    mcpOAuthToken: import("better-call").StrictEndpoint<"/mcp/token", {
       method: "POST";
       body: z.ZodRecord<z.ZodAny, z.ZodAny>;
       metadata: {
@@ -177,7 +176,7 @@ declare const mcp: (options: MCPOptions) => {
       scope: string;
       id_token: string | undefined;
     }>;
-    registerMcpClient: better_call0.StrictEndpoint<"/mcp/register", {
+    registerMcpClient: import("better-call").StrictEndpoint<"/mcp/register", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodString>;
@@ -295,7 +294,7 @@ declare const mcp: (options: MCPOptions) => {
         };
       };
     }, Response>;
-    getMcpSession: better_call0.StrictEndpoint<"/mcp/get-session", {
+    getMcpSession: import("better-call").StrictEndpoint<"/mcp/get-session", {
       method: "GET";
       requireHeaders: true;
     }, OAuthAccessToken | null>;

package/dist/plugins/multi-session/client.d.mts

@@ -1,7 +1,5 @@
 import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
 import { MultiSessionConfig, multiSession } from "./index.mjs";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/multi-session/client.d.ts
 declare const multiSessionClient: () => {
   id: "multi-session";
@@ -12,8 +10,8 @@ declare const multiSessionClient: () => {
     signal: "$sessionSignal";
   }[];
   $ERROR_CODES: {
-    INVALID_SESSION_TOKEN: _better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+    INVALID_SESSION_TOKEN: import("@better-auth/core/utils/error-codes").RawError<"INVALID_SESSION_TOKEN">;
   };
 };
 //#endregion
-export { multiSessionClient };
+export { MULTI_SESSION_ERROR_CODES, type MultiSessionConfig, multiSessionClient };