better-auth 1.6.23 → 1.6.25

package/dist/plugins/multi-session/client.mjs

@@ -16,4 +16,4 @@ const multiSessionClient = () => {
 	};
 };
 //#endregion
-export { multiSessionClient };
+export { MULTI_SESSION_ERROR_CODES, multiSessionClient };

package/dist/plugins/multi-session/error-codes.d.mts

@@ -1,8 +1,6 @@
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/multi-session/error-codes.d.ts
 declare const MULTI_SESSION_ERROR_CODES: {
-  INVALID_SESSION_TOKEN: _better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+  INVALID_SESSION_TOKEN: import("@better-auth/core/utils/error-codes").RawError<"INVALID_SESSION_TOKEN">;
 };
 //#endregion
 export { MULTI_SESSION_ERROR_CODES };

package/dist/plugins/multi-session/index.d.mts

@@ -1,9 +1,5 @@
 import { MULTI_SESSION_ERROR_CODES } from "./error-codes.mjs";
-import * as _better_auth_core0 from "@better-auth/core";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/multi-session/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -39,7 +35,7 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-list-device-sessions)
      */
-    listDeviceSessions: better_call0.StrictEndpoint<"/multi-session/list-device-sessions", {
+    listDeviceSessions: import("better-call").StrictEndpoint<"/multi-session/list-device-sessions", {
       method: "GET";
       requireHeaders: true;
     }, {
@@ -78,7 +74,7 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-set-active)
      */
-    setActiveSession: better_call0.StrictEndpoint<"/multi-session/set-active", {
+    setActiveSession: import("better-call").StrictEndpoint<"/multi-session/set-active", {
       method: "POST";
       body: z.ZodObject<{
         sessionToken: z.ZodString;
@@ -142,13 +138,13 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-revoke)
      */
-    revokeDeviceSession: better_call0.StrictEndpoint<"/multi-session/revoke", {
+    revokeDeviceSession: import("better-call").StrictEndpoint<"/multi-session/revoke", {
       method: "POST";
       body: z.ZodObject<{
         sessionToken: z.ZodString;
       }, z.core.$strip>;
       requireHeaders: true;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -199,13 +195,13 @@ declare const multiSession: (options?: MultiSessionConfig | undefined) => {
   };
   hooks: {
     after: {
-      matcher: (context: _better_auth_core0.HookEndpointContext) => boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher: (context: import("@better-auth/core").HookEndpointContext) => boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
   options: MultiSessionConfig | undefined;
   $ERROR_CODES: {
-    INVALID_SESSION_TOKEN: _better_auth_core_utils_error_codes0.RawError<"INVALID_SESSION_TOKEN">;
+    INVALID_SESSION_TOKEN: import("@better-auth/core/utils/error-codes").RawError<"INVALID_SESSION_TOKEN">;
   };
 };
 //#endregion

package/dist/plugins/multi-session/index.mjs

@@ -20,6 +20,21 @@ const multiSession = (options) => {
 		id: "multi-session",
 		version: PACKAGE_VERSION,
 		endpoints: {
+			/**
+			* ### Endpoint
+			*
+			* GET `/multi-session/list-device-sessions`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.listDeviceSessions`
+			*
+			* **client:**
+			* `authClient.multiSession.listDeviceSessions`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-list-device-sessions)
+			*/
 			listDeviceSessions: createAuthEndpoint("/multi-session/list-device-sessions", {
 				method: "GET",
 				requireHeaders: true
@@ -38,6 +53,21 @@ const multiSession = (options) => {
 					user: parseUserOutput(ctx.context.options, item.user)
 				})));
 			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/multi-session/set-active`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.setActiveSession`
+			*
+			* **client:**
+			* `authClient.multiSession.setActive`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-set-active)
+			*/
 			setActiveSession: createAuthEndpoint("/multi-session/set-active", {
 				method: "POST",
 				body: setActiveSessionBodySchema,
@@ -71,6 +101,21 @@ const multiSession = (options) => {
 					user: parseUserOutput(ctx.context.options, session.user)
 				});
 			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/multi-session/revoke`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.revokeDeviceSession`
+			*
+			* **client:**
+			* `authClient.multiSession.revoke`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/multi-session#api-method-multi-session-revoke)
+			*/
 			revokeDeviceSession: createAuthEndpoint("/multi-session/revoke", {
 				method: "POST",
 				body: revokeDeviceSessionBodySchema,

package/dist/plugins/oauth-popup/client.d.mts

@@ -2,9 +2,7 @@ import { POPUP_TOKEN_STORAGE_KEY } from "./constants.mjs";
 import { OAUTH_POPUP_ERROR_CODES } from "./error-codes.mjs";
 import { oauthPopup } from "./index.mjs";
 import { BetterAuthClientOptions, ClientStore } from "@better-auth/core";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
 import { BetterFetch, BetterFetchPlugin } from "@better-fetch/fetch";
-
 //#region src/plugins/oauth-popup/client.d.ts
 /** Inputs for `authClient.signIn.popup`; mirror the redirect sign-in. */
 interface SignInPopupOptions {
@@ -52,11 +50,7 @@ interface SignInPopupDeps {
  * page to post the session token back, stores it for the bearer fetch plugin,
  * and refreshes the reactive session.
  */
-declare function createSignInPopup({
-  $fetch,
-  options,
-  notifySessionSignal
-}: SignInPopupDeps): (opts: SignInPopupOptions) => Promise<SignInPopupResult>;
+declare function createSignInPopup({ $fetch, options, notifySessionSignal }: SignInPopupDeps): (opts: SignInPopupOptions) => Promise<SignInPopupResult>;
 /**
  * Client plugin for popup OAuth sign-in. Adds `authClient.signIn.popup`. Pair
  * with the server `oauthPopup` and `bearer` plugins.
@@ -66,10 +60,10 @@ declare const oauthPopupClient: () => {
   version: string;
   $InferServerPlugin: ReturnType<typeof oauthPopup>;
   $ERROR_CODES: {
-    POPUP_SIGN_IN_FAILED: _better_auth_core_utils_error_codes0.RawError<"POPUP_SIGN_IN_FAILED">;
-    POPUP_BLOCKED: _better_auth_core_utils_error_codes0.RawError<"POPUP_BLOCKED">;
-    POPUP_CLOSED: _better_auth_core_utils_error_codes0.RawError<"POPUP_CLOSED">;
-    POPUP_TIMEOUT: _better_auth_core_utils_error_codes0.RawError<"POPUP_TIMEOUT">;
+    POPUP_SIGN_IN_FAILED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_SIGN_IN_FAILED">;
+    POPUP_BLOCKED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_BLOCKED">;
+    POPUP_CLOSED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_CLOSED">;
+    POPUP_TIMEOUT: import("@better-auth/core/utils/error-codes").RawError<"POPUP_TIMEOUT">;
   };
   fetchPlugins: BetterFetchPlugin[];
   getActions: ($fetch: BetterFetch, $store: ClientStore, options: BetterAuthClientOptions | undefined) => {
@@ -79,4 +73,4 @@ declare const oauthPopupClient: () => {
   };
 };
 //#endregion
-export { SignInPopupOptions, SignInPopupResult, createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };
+export { OAUTH_POPUP_ERROR_CODES, POPUP_TOKEN_STORAGE_KEY, SignInPopupOptions, SignInPopupResult, createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };

package/dist/plugins/oauth-popup/client.mjs

@@ -74,10 +74,12 @@ function popupError(code, status) {
 	};
 }
 function centeredFeatures() {
-	return `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${window.screenX + (window.outerWidth - POPUP_WIDTH) / 2},top=${window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2},menubar=no,toolbar=no`;
+	const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;
+	const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;
+	return `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},menubar=no,toolbar=no`;
 }
 function randomNonce() {
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	crypto.getRandomValues(bytes);
 	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -200,4 +202,4 @@ const oauthPopupClient = () => {
 	};
 };
 //#endregion
-export { createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };
+export { OAUTH_POPUP_ERROR_CODES, POPUP_TOKEN_STORAGE_KEY, createSignInPopup, getStoredPopupToken, oauthPopupClient, popupBearerFetchPlugin };

package/dist/plugins/oauth-popup/error-codes.d.mts

@@ -1,11 +1,9 @@
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/oauth-popup/error-codes.d.ts
 declare const OAUTH_POPUP_ERROR_CODES: {
-  POPUP_SIGN_IN_FAILED: _better_auth_core_utils_error_codes0.RawError<"POPUP_SIGN_IN_FAILED">;
-  POPUP_BLOCKED: _better_auth_core_utils_error_codes0.RawError<"POPUP_BLOCKED">;
-  POPUP_CLOSED: _better_auth_core_utils_error_codes0.RawError<"POPUP_CLOSED">;
-  POPUP_TIMEOUT: _better_auth_core_utils_error_codes0.RawError<"POPUP_TIMEOUT">;
+  POPUP_SIGN_IN_FAILED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_SIGN_IN_FAILED">;
+  POPUP_BLOCKED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_BLOCKED">;
+  POPUP_CLOSED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_CLOSED">;
+  POPUP_TIMEOUT: import("@better-auth/core/utils/error-codes").RawError<"POPUP_TIMEOUT">;
 };
 //#endregion
 export { OAUTH_POPUP_ERROR_CODES };

package/dist/plugins/oauth-popup/index.d.mts

@@ -1,11 +1,7 @@
 import { OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_MESSAGE_TYPE, POPUP_MARKER_COOKIE } from "./constants.mjs";
 import { OAUTH_POPUP_ERROR_CODES } from "./error-codes.mjs";
 import { OAuthPopupData, OAuthPopupMessage } from "./types.mjs";
-import * as _better_auth_core0 from "@better-auth/core";
-import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/oauth-popup/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -32,13 +28,13 @@ declare const oauthPopup: () => {
   id: "oauth-popup";
   version: string;
   $ERROR_CODES: {
-    POPUP_SIGN_IN_FAILED: _better_auth_core_utils_error_codes0.RawError<"POPUP_SIGN_IN_FAILED">;
-    POPUP_BLOCKED: _better_auth_core_utils_error_codes0.RawError<"POPUP_BLOCKED">;
-    POPUP_CLOSED: _better_auth_core_utils_error_codes0.RawError<"POPUP_CLOSED">;
-    POPUP_TIMEOUT: _better_auth_core_utils_error_codes0.RawError<"POPUP_TIMEOUT">;
+    POPUP_SIGN_IN_FAILED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_SIGN_IN_FAILED">;
+    POPUP_BLOCKED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_BLOCKED">;
+    POPUP_CLOSED: import("@better-auth/core/utils/error-codes").RawError<"POPUP_CLOSED">;
+    POPUP_TIMEOUT: import("@better-auth/core/utils/error-codes").RawError<"POPUP_TIMEOUT">;
   };
   endpoints: {
-    oauthPopupStart: better_call0.StrictEndpoint<"/oauth-popup/start", {
+    oauthPopupStart: import("better-call").StrictEndpoint<"/oauth-popup/start", {
       method: "GET";
       query: z.ZodObject<{
         provider: z.ZodString;
@@ -58,10 +54,10 @@ declare const oauthPopup: () => {
   };
   hooks: {
     after: {
-      matcher(context: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };
 //#endregion
-export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_SCRIPT_CSP_HASH, oauthPopup };
+export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, type OAuthPopupData, type OAuthPopupMessage, POPUP_MARKER_COOKIE, oauthPopup };

package/dist/plugins/oauth-popup/index.mjs

@@ -225,4 +225,4 @@ const oauthPopup = () => {
 	};
 };
 //#endregion
-export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_SCRIPT_CSP_HASH, oauthPopup };
+export { OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, oauthPopup };

package/dist/plugins/oauth-popup/types.d.mts

@@ -1,5 +1,4 @@
 import { OAUTH_POPUP_MESSAGE_TYPE } from "./constants.mjs";
-
 //#region src/plugins/oauth-popup/types.d.ts
 /** OAuth error relayed to the opener when the flow fails. */
 interface OAuthPopupError {
@@ -27,4 +26,4 @@ interface OAuthPopupData extends OAuthPopupMessage {
   targetOrigin: string;
 }
 //#endregion
-export { OAuthPopupData, OAuthPopupMessage };
+export { OAuthPopupData, OAuthPopupError, OAuthPopupMessage };

package/dist/plugins/oauth-proxy/index.d.mts

@@ -1,8 +1,5 @@
-import * as _better_auth_core0 from "@better-auth/core";
 import { SecretConfig } from "@better-auth/core";
-import * as better_call0 from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/oauth-proxy/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -58,14 +55,14 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
   version: string;
   options: NoInfer<O>;
   endpoints: {
-    oAuthProxy: better_call0.StrictEndpoint<"/oauth-proxy-callback", {
+    oAuthProxy: import("better-call").StrictEndpoint<"/oauth-proxy-callback", {
       method: "GET";
       operationId: string;
       query: z.ZodObject<{
         callbackURL: z.ZodString;
         profile: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>)[];
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
       metadata: {
         openapi: {
           operationId: string;
@@ -100,12 +97,12 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
   };
   hooks: {
     before: {
-      matcher(context: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
     after: {
-      matcher(context: _better_auth_core0.HookEndpointContext): boolean;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<void>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
     }[];
   };
 };

package/dist/plugins/oauth-proxy/index.mjs

@@ -10,7 +10,7 @@ import { parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
-import { defu } from "defu";
+import { defu as defu$1 } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/oauth-proxy/index.ts
@@ -148,7 +148,7 @@ const oAuthProxy = (opts) => {
 					return context.path === "/callback/:id";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
-					const callbackParams = defu(ctx.query, ctx.body);
+					const callbackParams = defu$1(ctx.query, ctx.body);
 					const state = callbackParams.state;
 					if (!state || typeof state !== "string") return;
 					let statePackage;

package/dist/plugins/oidc-provider/authorize.mjs

@@ -142,6 +142,15 @@ async function authorize(ctx, options) {
 				scope: requestScope,
 				userId: session.user.id,
 				authTime: new Date(session.session.createdAt).getTime(),
+				/**
+				* Consent is required per OIDC spec unless:
+				* 1. Client is trusted (skipConsent = true)
+				* 2. User has already consented (and prompt is not "consent")
+				*
+				* When consent is required, the code needs to be treated as a
+				* consent request. Once the user consents, the code will be
+				* updated with the actual authorization code.
+				*/
 				requireConsent,
 				state: requireConsent ? query.state : null,
 				codeChallenge: query.code_challenge,

package/dist/plugins/oidc-provider/client.d.mts

@@ -1,6 +1,5 @@
 import { AuthorizationQuery, Client, CodeVerificationValue, OAuthAccessToken, OIDCMetadata, OIDCOptions, TokenBody } from "./types.mjs";
 import { oidcProvider } from "./index.mjs";
-
 //#region src/plugins/oidc-provider/client.d.ts
 /**
  * @deprecated Use `@better-auth/oauth-provider` instead. This plugin will be removed in the next major version.
@@ -13,4 +12,4 @@ declare const oidcClient: () => {
 };
 type OidcClientPlugin = ReturnType<typeof oidcClient>;
 //#endregion
-export { OidcClientPlugin, oidcClient };
+export { type AuthorizationQuery, type Client, type CodeVerificationValue, type OAuthAccessToken, type OIDCMetadata, type OIDCOptions, OidcClientPlugin, type TokenBody, oidcClient };

package/dist/plugins/oidc-provider/index.d.mts

@@ -1,12 +1,10 @@
 import { InferOptionSchema } from "../../types/plugins.mjs";
 import { schema } from "./schema.mjs";
 import { AuthorizationQuery, Client, CodeVerificationValue, OAuthAccessToken, OIDCMetadata, OIDCOptions, TokenBody } from "./types.mjs";
+import "../index.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as _better_auth_core_db0 from "@better-auth/core/db";
-import * as better_call0 from "better-call";
 import { OpenAPIParameter } from "better-call";
 import * as z from "zod";
-
 //#region src/plugins/oidc-provider/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -41,21 +39,21 @@ declare const oidcProvider: (options: OIDCOptions) => {
   hooks: {
     after: {
       matcher(): true;
-      handler: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<Response | {
+      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<Response | {
         redirect: boolean;
         url: string;
       } | undefined>;
     }[];
   };
   endpoints: {
-    getOpenIdConfig: better_call0.StrictEndpoint<"/.well-known/openid-configuration", {
+    getOpenIdConfig: import("better-call").StrictEndpoint<"/.well-known/openid-configuration", {
       method: "GET";
       operationId: string;
       metadata: {
         readonly scope: "server";
       };
     }, OIDCMetadata>;
-    oAuth2authorize: better_call0.StrictEndpoint<"/oauth2/authorize", {
+    oAuth2authorize: import("better-call").StrictEndpoint<"/oauth2/authorize", {
       method: "GET";
       operationId: string;
       query: z.ZodRecord<z.ZodString, z.ZodAny>;
@@ -82,14 +80,14 @@ declare const oidcProvider: (options: OIDCOptions) => {
       redirect: boolean;
       url: string;
     }>;
-    oAuthConsent: better_call0.StrictEndpoint<"/oauth2/consent", {
+    oAuthConsent: import("better-call").StrictEndpoint<"/oauth2/consent", {
       method: "POST";
       operationId: string;
       body: z.ZodObject<{
         accept: z.ZodBoolean;
         consent_code: z.ZodOptional<z.ZodNullable<z.ZodOptional<z.ZodString>>>;
       }, z.core.$strip>;
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -161,7 +159,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
     }, {
       redirectURI: string;
     }>;
-    oAuth2token: better_call0.StrictEndpoint<"/oauth2/token", {
+    oAuth2token: import("better-call").StrictEndpoint<"/oauth2/token", {
       method: "POST";
       operationId: string;
       body: z.ZodRecord<z.ZodAny, z.ZodAny>;
@@ -183,7 +181,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
       scope: string;
       id_token: string | undefined;
     }>;
-    oAuth2userInfo: better_call0.StrictEndpoint<"/oauth2/userinfo", {
+    oAuth2userInfo: import("better-call").StrictEndpoint<"/oauth2/userinfo", {
       method: "GET";
       operationId: string;
       metadata: {
@@ -275,7 +273,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
      *
      * @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/oidc-provider#api-method-oauth2-register)
      */
-    registerOAuthApplication: better_call0.StrictEndpoint<"/oauth2/register", {
+    registerOAuthApplication: import("better-call").StrictEndpoint<"/oauth2/register", {
       method: "POST";
       body: z.ZodObject<{
         redirect_uris: z.ZodArray<z.ZodString>;
@@ -415,9 +413,9 @@ declare const oidcProvider: (options: OIDCOptions) => {
       client_secret?: string | undefined;
       client_id: string;
     }>;
-    getOAuthClient: better_call0.StrictEndpoint<"/oauth2/client/:id", {
+    getOAuthClient: import("better-call").StrictEndpoint<"/oauth2/client/:id", {
       method: "GET";
-      use: ((inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -488,7 +486,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
      *
      * @see [OpenID Connect RP-Initiated Logout Spec](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
      */
-    endSession: better_call0.StrictEndpoint<"/oauth2/endsession", {
+    endSession: import("better-call").StrictEndpoint<"/oauth2/endsession", {
       method: ("GET" | "POST")[];
       query: z.ZodOptional<z.ZodObject<{
         id_token_hint: z.ZodOptional<z.ZodString>;
@@ -514,7 +512,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
         scope: "server";
       };
     }, {
-      status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | better_call0.Status;
+      status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | import("better-call").Status;
       body: ({
         message?: string;
         code?: string;
@@ -689,7 +687,7 @@ declare const oidcProvider: (options: OIDCOptions) => {
     allowPlainCodeChallengeMethod: boolean;
     generateClientId?: (() => string) | undefined;
     generateClientSecret?: (() => string) | undefined;
-    getAdditionalUserInfoClaim?: ((user: _better_auth_core_db0.User & Record<string, any>, scopes: string[], client: Client) => Record<string, any> | Promise<Record<string, any>>) | undefined;
+    getAdditionalUserInfoClaim?: ((user: import("@better-auth/core/db").User & Record<string, any>, scopes: string[], client: Client) => Record<string, any> | Promise<Record<string, any>>) | undefined;
     trustedClients?: Client[] | undefined;
     storeClientSecret: "plain" | "hashed" | "encrypted" | {
       hash: (clientSecret: string) => Promise<string>;
@@ -702,4 +700,4 @@ declare const oidcProvider: (options: OIDCOptions) => {
   };
 };
 //#endregion
-export { AuthorizationQuery, Client, CodeVerificationValue, OAuthAccessToken, OIDCMetadata, OIDCOptions, TokenBody, getClient, getMetadata, oidcProvider };
+export { type AuthorizationQuery, type Client, type CodeVerificationValue, type OAuthAccessToken, type OIDCMetadata, type OIDCOptions, type TokenBody, getClient, getMetadata, oidcProvider };

package/dist/plugins/oidc-provider/index.mjs

@@ -414,8 +414,7 @@ const oidcProvider = (options) => {
 					client_id = id;
 					client_secret = secret;
 				}
-				const now = Date.now();
-				const iat = Math.floor(now / 1e3);
+				const iat = Math.floor(Date.now() / 1e3);
 				const exp = iat + (opts.accessTokenExpiresIn ?? 3600);
 				const accessTokenExpiresAt = /* @__PURE__ */ new Date(exp * 1e3);
 				const refreshTokenExpiresAt = /* @__PURE__ */ new Date((iat + (opts.refreshTokenExpiresIn ?? 604800)) * 1e3);
@@ -765,6 +764,21 @@ const oidcProvider = (options) => {
 					...userClaims
 				});
 			}),
+			/**
+			* ### Endpoint
+			*
+			* POST `/oauth2/register`
+			*
+			* ### API Methods
+			*
+			* **server:**
+			* `auth.api.registerOAuthApplication`
+			*
+			* **client:**
+			* `authClient.oauth2.register`
+			*
+			* @see [Read our docs to learn more.](https://better-auth.com/docs/plugins/oidc-provider#api-method-oauth2-register)
+			*/
 			registerOAuthApplication: createAuthEndpoint("/oauth2/register", {
 				method: "POST",
 				body: registerOAuthApplicationBodySchema,
@@ -965,6 +979,16 @@ const oidcProvider = (options) => {
 					icon: client.icon || null
 				});
 			}),
+			/**
+			* ### Endpoint
+			*
+			* GET/POST `/oauth2/endsession`
+			*
+			* Implements RP-Initiated Logout as per OpenID Connect RP-Initiated Logout 1.0.
+			* Allows relying parties to request that an OpenID Provider log out the end-user.
+			*
+			* @see [OpenID Connect RP-Initiated Logout Spec](https://openid.net/specs/openid-connect-rpinitiated-1_0.html)
+			*/
 			endSession: createAuthEndpoint("/oauth2/endsession", {
 				method: ["GET", "POST"],
 				query: z.object({

package/dist/plugins/oidc-provider/schema.d.mts

@@ -1,5 +1,4 @@
 import * as z from "zod";
-
 //#region src/plugins/oidc-provider/schema.d.ts
 declare const oAuthApplicationSchema: z.ZodObject<{
   clientId: z.ZodString;

package/dist/plugins/oidc-provider/schema.mjs

@@ -1,17 +1,54 @@
 import * as z from "zod";
 //#region src/plugins/oidc-provider/schema.ts
 z.object({
+	/**
+	* Client ID
+	*
+	* size 32
+	*
+	* as described on https://www.rfc-editor.org/rfc/rfc6749.html#section-2.2
+	*/
 	clientId: z.string(),
+	/**
+	* Client Secret
+	*
+	* A secret for the client, if required by the authorization server.
+	* Optional for public clients using PKCE.
+	*
+	* size 32
+	*/
 	clientSecret: z.string().optional(),
+	/**
+	* The client type
+	*
+	* as described on https://www.rfc-editor.org/rfc/rfc6749.html#section-2.1
+	*
+	* - web - A web application
+	* - native - A mobile application
+	* - user-agent-based - A user-agent-based application
+	* - public - A public client (PKCE-enabled, no client_secret)
+	*/
 	type: z.enum([
 		"web",
 		"native",
 		"user-agent-based",
 		"public"
 	]),
+	/**
+	* The name of the client.
+	*/
 	name: z.string(),
+	/**
+	* The icon of the client.
+	*/
 	icon: z.string().optional(),
+	/**
+	* Additional metadata about the client.
+	*/
 	metadata: z.string().optional(),
+	/**
+	* Whether the client is disabled or not.
+	*/
 	disabled: z.boolean().optional().default(false),
 	redirectUrls: z.string(),
 	userId: z.string().optional(),

package/dist/plugins/oidc-provider/types.d.mts

@@ -1,7 +1,7 @@
 import { User } from "../../types/models.mjs";
 import { InferOptionSchema } from "../../types/plugins.mjs";
+import "../../types/index.mjs";
 import { OAuthApplication, schema } from "./schema.mjs";
-
 //#region src/plugins/oidc-provider/types.d.ts
 interface OIDCOptions {
   /** @internal */