better-auth 1.7.11 → 1.7.13

package/dist/plugins/generic-oauth/types.d.mts

@@ -1,14 +1,13 @@
 import { Awaitable } from "@better-auth/core";
 import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, OAuthMappedUser, OAuthRefreshContext, TokenEndpointAuth } from "@better-auth/core/oauth2";
-
 //#region src/plugins/generic-oauth/types.d.ts
 /** Raw profile returned by a Generic OAuth provider. */
-type GenericOAuthUserInfo = Omit<OAuth2UserInfo, "id"> & {
+export type GenericOAuthUserInfo = Omit<OAuth2UserInfo, "id"> & {
   id?: string | number | null | undefined;
   sub?: string | number | null | undefined;
   [key: string]: unknown;
 };
-interface GenericOAuthOptions<ID extends string = string> {
+export interface GenericOAuthOptions<ID extends string = string> {
   /**
    * Array of OAuth provider configurations.
    */
@@ -17,7 +16,7 @@ interface GenericOAuthOptions<ID extends string = string> {
 /**
  * Configuration interface for generic OAuth providers.
  */
-interface GenericOAuthConfig<ID extends string = string> {
+export interface GenericOAuthConfig<ID extends string = string> {
   /** Unique identifier for the OAuth provider */
   providerId: ID;
   /**
@@ -112,7 +111,8 @@ interface GenericOAuthConfig<ID extends string = string> {
   responseType?: string | undefined;
   /**
    * The response mode to use for the authorization code request.
-    */
+
+   */
   responseMode?: ("query" | "form_post") | undefined;
   /**
    * Prompt parameter for the authorization request.
@@ -264,5 +264,4 @@ interface GenericOAuthConfig<ID extends string = string> {
    */
   disableIdTokenNonceBinding?: boolean | undefined;
 }
-//#endregion
-export { GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo };
+//#endregion

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -1,6 +1,3 @@
-import * as _$_better_auth_core0 from "@better-auth/core";
-import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
-
 //#region src/plugins/haveibeenpwned/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -16,8 +13,8 @@ declare module "@better-auth/core" {
  * @returns Whether the password has been compromised.
  * @throws {APIError} When the password could not be checked.
  */
-declare function isPasswordCompromised(password: string): Promise<boolean>;
-interface HaveIBeenPwnedOptions {
+export declare function isPasswordCompromised(password: string): Promise<boolean>;
+export interface HaveIBeenPwnedOptions {
   /**
    * Custom error message shown when a compromised password is detected.
    */
@@ -35,10 +32,10 @@ interface HaveIBeenPwnedOptions {
    */
   enabled?: boolean | undefined;
 }
-declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
+export declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
   id: "have-i-been-pwned";
   version: string;
-  init(ctx: _$_better_auth_core0.AuthContext): {
+  init(ctx: import("@better-auth/core").AuthContext): {
     context: {
       password: {
         hash(password: string): Promise<string>;
@@ -50,14 +47,13 @@ declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
           minPasswordLength: number;
           maxPasswordLength: number;
         };
-        checkPassword: (userId: string, ctx: _$_better_auth_core0.GenericEndpointContext<_$_better_auth_core0.BetterAuthOptions>) => Promise<boolean>;
+        checkPassword: (userId: string, ctx: import("@better-auth/core").GenericEndpointContext<import("@better-auth/core").BetterAuthOptions>) => Promise<boolean>;
       };
     };
   };
   options: HaveIBeenPwnedOptions | undefined;
   $ERROR_CODES: {
-    PASSWORD_COMPROMISED: _$_better_auth_core_utils_error_codes0.RawError<"PASSWORD_COMPROMISED">;
+    PASSWORD_COMPROMISED: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_COMPROMISED">;
   };
 };
-//#endregion
-export { HaveIBeenPwnedOptions, haveIBeenPwned, isPasswordCompromised };
+//#endregion

package/dist/plugins/index.d.mts

@@ -2,11 +2,13 @@ import { InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPlug
 import { HIDE_METADATA } from "../utils/hide-metadata.mjs";
 import { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset } from "./access/types.mjs";
 import { AuthorizeResponse, createAccessControl, role } from "./access/access.mjs";
+import "./access/index.mjs";
 import { OrganizationOptions } from "./organization/types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "./organization/schema.mjs";
 import { getOrgAdapter } from "./organization/adapter.mjs";
 import { AdminOptions, InferAdminRolesFromOption, SessionWithImpersonatedBy, UserWithRole } from "./admin/types.mjs";
 import { admin } from "./admin/admin.mjs";
+import "./admin/index.mjs";
 import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./anonymous/types.mjs";
 import { anonymous } from "./anonymous/index.mjs";
 import { BearerOptions, bearer } from "./bearer/index.mjs";
@@ -66,4 +68,5 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, ValidateRequestContext, VercelBotIdOptions, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };
+import "./organization/index.mjs";
+export { AccessControl, type AdminOptions, type AnonymousOptions, type AnonymousSession, ArrayElement, type Auth0Options, AuthorizeResponse, type BackupCodeOptions, type BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, type BotIdVerification, type CaptchaFoxOptions, type CaptchaOptions, type CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, type DeviceCode, type DeviceCodeRedemptionAuthorization, type DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, type EmailOTPOptions, ExactRoleStatements, type FieldSchema, type GenericOAuthConfig, type GenericOAuthOptions, type GenericOAuthUserInfo, type GoogleRecaptchaOptions, type GumroadOptions, type HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, type HubSpotOptions, type InferAdminRolesFromOption, type InferInvitation, type InferMember, InferOptionSchema, type InferOrganization, type InferOrganizationRolesFromOption, type InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, type InferTeam, type Invitation, type InvitationInput, type InvitationStatus, type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, type KeycloakOptions, LastLoginMethodOptions, type LineOptions, type LoginResult, MagicLinkOptions, type Member, type MemberInput, type MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, type OAuthPopupData, type OAuthPopupMessage, OAuthProxyOptions, type OTPOptions, type OktaOptions, OneTapOptions, OneTimeTokenOptions, type OpenAPIModelSchema, OpenAPIOptions, type OpenAPIParameter, type OpenAPISchema, type Organization, OrganizationCreator, OrganizationEndpoints, type OrganizationInput, type OrganizationOptions, OrganizationPlugin, type OrganizationRole, type OrganizationSchema, POPUP_MARKER_COOKIE, type Path, type PatreonOptions, type PhoneNumberOptions, type Provider, type ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, type SessionWithImpersonatedBy, type SlackOptions, Statements, SubArray, Subset, type TOTPOptions, TWO_FACTOR_ERROR_CODES, type Team, TeamEndpoints, type TeamInput, type TeamMember, type TeamMemberInput, type TestAuthOptions, type TestCookie, type TestHelpers, type TestUtilsOptions, type TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, type UserWithAnonymous, type UserWithPhoneNumber, type UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, type ValidateRequestContext, type VercelBotIdOptions, type YandexOptions, admin, anonymous, auth0, type backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, type defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, type encodeBackupCodes, type generateBackupCodes, generateExportedKeyPair, type generator, genericOAuth, type getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, type invitationSchema, type invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, type memberSchema, microsoftEntraId, type ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, type organizationRoleSchema, type organizationSchema, type otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, type roleSchema, type sec, signJWT, siwe, slack, type teamMemberSchema, type teamSchema, testUtils, toExpJWT, type totp2fa, twoFactor, twoFactorClient, username, type verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/jwt/adapter.mjs

@@ -1,5 +1,16 @@
 import { getCurrentAdapter } from "@better-auth/core/context";
 //#region src/plugins/jwt/adapter.ts
+/**
+* Algorithm of the key the plugin generates when `jwks.keyPairConfig` is unset.
+*/
+const DEFAULT_JWK_ALG = "EdDSA";
+/**
+* Algorithm for new keys, and for stored keys saved before the `alg` column
+* existed.
+*/
+function getDefaultKeyAlg(options) {
+	return options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+}
 const getJwksAdapter = (baseAdapter, options) => {
 	return {
 		getAllKeys: async (ctx) => {
@@ -38,7 +49,7 @@ const getJwksAdapter = (baseAdapter, options) => {
 		*
 		* Legacy rows persisted before the `alg` column existed have
 		* `alg: null`. Per `schema.ts`, those rows are treated as the
-		* configured default alg (`options.jwks.keyPairConfig.alg ?? "EdDSA"`),
+		* configured default alg ({@link getDefaultKeyAlg}),
 		* so deployments that have only legacy rows can still satisfy an
 		* audience-pinned `signingAlgorithm` matching the default.
 		*
@@ -48,7 +59,7 @@ const getJwksAdapter = (baseAdapter, options) => {
 		getLatestKeyByAlg: async (ctx, alg) => {
 			const candidates = options?.adapter?.getJwks ? await options.adapter.getJwks(ctx) : await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" });
 			if (!candidates) return void 0;
-			const configAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+			const configAlg = getDefaultKeyAlg(options);
 			const now = /* @__PURE__ */ new Date();
 			return candidates.filter((k) => k.alg === alg || k.alg == null && configAlg === alg).filter((k) => !k.expiresAt || k.expiresAt > now).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
 		},
@@ -65,4 +76,4 @@ const getJwksAdapter = (baseAdapter, options) => {
 	};
 };
 //#endregion
-export { getJwksAdapter };
+export { DEFAULT_JWK_ALG, getDefaultKeyAlg, getJwksAdapter };

package/dist/plugins/jwt/client.d.mts

@@ -3,7 +3,6 @@ import { jwt } from "./index.mjs";
 import { BetterAuthClientOptions, ClientFetchOption, ClientStore } from "@better-auth/core";
 import { JSONWebKeySet } from "jose";
 import { BetterFetch } from "@better-fetch/fetch";
-
 //#region src/plugins/jwt/client.d.ts
 interface JwtClientOptions {
   jwks?: {
@@ -16,7 +15,7 @@ interface JwtClientOptions {
     jwksPath?: string;
   };
 }
-declare const jwtClient: (options?: JwtClientOptions) => {
+export declare const jwtClient: (options?: JwtClientOptions) => {
   id: "better-auth-client";
   version: string;
   $InferServerPlugin: ReturnType<typeof jwt>;
@@ -38,4 +37,4 @@ declare const jwtClient: (options?: JwtClientOptions) => {
   };
 };
 //#endregion
-export { jwtClient };
+export type { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey };

package/dist/plugins/jwt/cookie-cache.mjs

@@ -1,5 +1,5 @@
 import { SESSION_COOKIE_JWT_AUDIENCE, SESSION_COOKIE_JWT_TYPE, getSessionCookieJwtVerifyOptions, parseSessionCookieJwtPayload } from "../../cookies/jwt.mjs";
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { resolveSigningKey } from "./sign.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
@@ -9,8 +9,7 @@ function getCookieCacheJwtIssuer(ctx) {
 	return typeof baseURL === "string" ? baseURL || "better-auth:session-cache" : ctx.context.baseURL || "better-auth:session-cache";
 }
 async function importLocalPublicKey(ctx, token, options) {
-	const header = decodeProtectedHeader(token);
-	const kid = header.kid;
+	const kid = decodeProtectedHeader(token).kid;
 	if (!kid) {
 		ctx.context.logger.debug("Cookie-cache JWT missing kid in header");
 		return null;
@@ -25,11 +24,7 @@ async function importLocalPublicKey(ctx, token, options) {
 		ctx.context.logger.debug(`No JWKS key found for cookie-cache JWT kid: ${kid}`);
 		return null;
 	}
-	const alg = key.alg ?? options?.jwks?.keyPairConfig?.alg ?? header.alg;
-	if (!alg) {
-		ctx.context.logger.debug(`No JWT algorithm available for cookie-cache JWT kid: ${kid}`);
-		return null;
-	}
+	const alg = key.alg ?? getDefaultKeyAlg(options);
 	return {
 		alg,
 		publicKey: await importJWK(JSON.parse(key.publicKey), alg)

package/dist/plugins/jwt/index.d.mts

@@ -2,11 +2,8 @@ import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "
 import { getJwtToken, resolveSigningKey, signJWT } from "./sign.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./utils.mjs";
 import { verifyJWT } from "./verify.mjs";
-import * as _$_better_auth_core0 from "@better-auth/core";
-import * as _$better_call0 from "better-call";
 import * as z from "zod";
 import { JSONWebKeySet, JWTPayload } from "jose";
-
 //#region src/plugins/jwt/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -15,14 +12,14 @@ declare module "@better-auth/core" {
     };
   }
 }
-declare const jwt: <O extends JwtOptions>(options?: O) => {
+export declare const jwt: <O extends JwtOptions>(options?: O) => {
   id: "jwt";
   version: string;
   options: NoInfer<O>;
-  init(ctx: _$_better_auth_core0.AuthContext): {
+  init(ctx: import("@better-auth/core").AuthContext): {
     context: {
       sessionConfig: {
-        cookieCacheSigner: _$_better_auth_core0.CookieCacheSigner;
+        cookieCacheSigner: import("@better-auth/core").CookieCacheSigner;
         updateAge: number;
         expiresIn: number;
         freshAge: number;
@@ -34,7 +31,7 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
     };
   } | undefined;
   endpoints: {
-    getJwks: _$better_call0.StrictEndpoint<string, {
+    getJwks: import("better-call").StrictEndpoint<string, {
       method: "GET";
       metadata: {
         openapi: {
@@ -111,10 +108,10 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
         };
       };
     }, JSONWebKeySet>;
-    getToken: _$better_call0.StrictEndpoint<"/token", {
+    getToken: import("better-call").StrictEndpoint<"/token", {
       method: "GET";
       requireHeaders: true;
-      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<{
+      use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -163,7 +160,7 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
     }, {
       token: string;
     }>;
-    signJWT: _$better_call0.StrictEndpoint<string, {
+    signJWT: import("better-call").StrictEndpoint<string, {
       method: "POST";
       metadata: {
         $Infer: {
@@ -180,7 +177,7 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
     }, {
       token: string;
     }>;
-    verifyJWT: _$better_call0.StrictEndpoint<string, {
+    verifyJWT: import("better-call").StrictEndpoint<string, {
       method: "POST";
       metadata: {
         $Infer: {
@@ -207,8 +204,8 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
   };
   hooks: {
     after: {
-      matcher(context: _$_better_auth_core0.HookEndpointContext): boolean;
-      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+      matcher(context: import("@better-auth/core").HookEndpointContext): boolean;
+      handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
     }[];
   };
   schema: {
@@ -243,4 +240,4 @@ declare const jwt: <O extends JwtOptions>(options?: O) => {
   };
 };
 //#endregion
-export { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey, createJwk, generateExportedKeyPair, getJwtToken, jwt, resolveSigningKey, signJWT, toExpJWT, verifyJWT };
+export { type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, type ResolvedSigningKey, createJwk, generateExportedKeyPair, getJwtToken, resolveSigningKey, signJWT, toExpJWT, verifyJWT };

package/dist/plugins/jwt/index.mjs

@@ -2,7 +2,7 @@ import { mergeSchema } from "../../db/schema.mjs";
 import { sessionMiddleware } from "../../api/routes/session.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./utils.mjs";
 import { getJwtToken, resolveSigningKey, signJWT } from "./sign.mjs";
 import { createCookieCacheSigner } from "./cookie-cache.mjs";
@@ -122,7 +122,7 @@ const jwt = (options) => {
 				}
 				if (!keySets?.length) throw new BetterAuthError("No key sets found. Make sure you have a key in your database.");
 				const now = Date.now();
-				const gracePeriod = (options?.jwks?.gracePeriod ?? 3600 * 24 * 30) * 1e3;
+				const gracePeriod = (options?.jwks?.gracePeriod ?? 2592e3) * 1e3;
 				const keys = keySets.filter((key) => {
 					if (!key.expiresAt) return true;
 					return key.expiresAt.getTime() + gracePeriod > now;
@@ -131,7 +131,7 @@ const jwt = (options) => {
 				const defaultCrv = keyPairConfig ? "crv" in keyPairConfig ? keyPairConfig.crv : void 0 : void 0;
 				return ctx.json({ keys: keys.map((keySet) => {
 					return {
-						alg: keySet.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA",
+						alg: keySet.alg ?? getDefaultKeyAlg(options),
 						crv: keySet.crv ?? defaultCrv,
 						...JSON.parse(keySet.publicKey),
 						kid: keySet.id

package/dist/plugins/jwt/schema.d.mts

@@ -1,5 +1,5 @@
 //#region src/plugins/jwt/schema.d.ts
-declare const schema: {
+export declare const schema: {
   jwks: {
     fields: {
       publicKey: {
@@ -29,5 +29,4 @@ declare const schema: {
     };
   };
 };
-//#endregion
-export { schema };
+//#endregion

package/dist/plugins/jwt/sign.d.mts

@@ -1,6 +1,5 @@
 import { JWSAlgorithms, JwtOptions, ResolvedSigningKey } from "./types.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-
 //#region src/plugins/jwt/sign.d.ts
 type JWTPayloadWithOptional = {
   /**
@@ -44,7 +43,8 @@ type JWTPayloadWithOptional = {
    *
    * @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}
    */
-  iat?: number | undefined; /** Any other JWT Claim Set member. */
+  iat?: number | undefined;
+  /** Any other JWT Claim Set member. */
   [propName: string]: unknown | undefined;
 };
 /**
@@ -65,7 +65,7 @@ type JWTPayloadWithOptional = {
  * Used by the OAuth provider plugin to honor per-resource `signingAlgorithm` /
  * `signingKeyId` overrides without re-implementing key resolution.
  */
-interface SigningKeyOverrides {
+export interface SigningKeyOverrides {
   signingKeyId?: string | undefined;
   signingAlgorithm?: JWSAlgorithms | undefined;
 }
@@ -86,10 +86,11 @@ interface SigningKeyOverrides {
  * tokens stay on the configured default algorithm even after extra algorithms
  * have been lazy-minted for audience pinning.
  */
-declare function resolveSigningKey(ctx: GenericEndpointContext, options?: JwtOptions, overrides?: SigningKeyOverrides): Promise<ResolvedSigningKey | null>;
-declare function signJWT(ctx: GenericEndpointContext, config: {
+export declare function resolveSigningKey(ctx: GenericEndpointContext, options?: JwtOptions, overrides?: SigningKeyOverrides): Promise<ResolvedSigningKey | null>;
+export declare function signJWT(ctx: GenericEndpointContext, config: {
   options?: JwtOptions | undefined;
-  payload: JWTPayloadWithOptional; /** Pre-resolved key from resolveSigningKey. Skips redundant DB lookup. */
+  payload: JWTPayloadWithOptional;
+  /** Pre-resolved key from resolveSigningKey. Skips redundant DB lookup. */
   resolvedKey?: ResolvedSigningKey;
   /**
    * Extra JWS Protected Header parameters to merge with the defaults
@@ -123,6 +124,6 @@ declare function signJWT(ctx: GenericEndpointContext, config: {
    */
   signingAlgorithm?: JWSAlgorithms | undefined;
 }): Promise<string>;
-declare function getJwtToken(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<string>;
+export declare function getJwtToken(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<string>;
 //#endregion
-export { getJwtToken, resolveSigningKey, signJWT };
+export {};

package/dist/plugins/jwt/sign.mjs

@@ -1,5 +1,5 @@
 import { symmetricDecrypt } from "../../crypto/index.mjs";
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { createJwk, toExpJWT } from "./utils.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { SignJWT, importJWK } from "jose";
@@ -29,13 +29,13 @@ async function resolveSigningKey(ctx, options, overrides) {
 		key = await adapter.getKeyById(ctx, overrides.signingKeyId);
 		if (!key) throw new BetterAuthError(`signJWT: signingKeyId "${overrides.signingKeyId}" not found in JWKS. The key must be provisioned before it can be referenced.`);
 		if (overrides.signingAlgorithm !== void 0) {
-			const configAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+			const configAlg = getDefaultKeyAlg(options);
 			if ((key.alg ?? configAlg) !== overrides.signingAlgorithm) throw new BetterAuthError(`signJWT: signingKeyId "${overrides.signingKeyId}" has alg "${key.alg ?? `unset (inherits keyPairConfig.alg "${configAlg}")`}" but signingAlgorithm was set to "${overrides.signingAlgorithm}".`);
 		}
 	} else if (overrides?.signingAlgorithm !== void 0) {
 		key = await adapter.getLatestKeyByAlg(ctx, overrides.signingAlgorithm);
 		if (!key) {
-			const primaryAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+			const primaryAlg = getDefaultKeyAlg(options);
 			const preconfig = options?.jwks?.keyPairConfigs?.find((c) => c.alg === overrides.signingAlgorithm);
 			const isPrimary = primaryAlg === overrides.signingAlgorithm;
 			if (preconfig || isPrimary) key = await createJwk(ctx, {
@@ -51,7 +51,7 @@ async function resolveSigningKey(ctx, options, overrides) {
 			}
 		}
 	} else {
-		const primaryAlg = options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+		const primaryAlg = getDefaultKeyAlg(options);
 		key = await adapter.getLatestKeyByAlg(ctx, primaryAlg) ?? await adapter.getLatestKey(ctx);
 	}
 	if (!key || key.expiresAt && key.expiresAt < /* @__PURE__ */ new Date()) {
@@ -64,7 +64,7 @@ async function resolveSigningKey(ctx, options, overrides) {
 	}).catch(() => {
 		throw new BetterAuthError("Failed to decrypt private key. Make sure the secret currently in use is the same as the one used to encrypt the private key. If you are using a different secret, either clean up your JWKS or disable private key encryption.");
 	}) : key.privateKey;
-	const alg = key.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA";
+	const alg = key.alg ?? getDefaultKeyAlg(options);
 	const privateKey = await importJWK(JSON.parse(privateWebKey), alg);
 	return {
 		alg,
@@ -86,6 +86,7 @@ async function signJWT(ctx, config) {
 	const defaultIss = options?.jwt?.issuer ?? baseURLOrigin;
 	const aud = payload.aud;
 	const defaultAud = options?.jwt?.audience ?? baseURLOrigin;
+	if (!(iss ?? defaultIss) || !(aud ?? defaultAud)) ctx.context.logger.warn("[better-auth] The JWT plugin signed a JWT without an issuer or audience because no base URL was resolved for this call. Set `baseURL`, or `jwt.issuer` and `jwt.audience` in the JWT plugin options.");
 	if (options?.jwt?.sign) {
 		const jwtPayload = {
 			...payload,

package/dist/plugins/jwt/types.d.mts

@@ -1,11 +1,11 @@
 import { Session, User } from "../../types/models.mjs";
 import { InferOptionSchema } from "../../types/plugins.mjs";
+import "../../types/index.mjs";
 import { schema } from "./schema.mjs";
 import { Awaitable, GenericEndpointContext } from "@better-auth/core";
 import { JWTPayload } from "jose";
-
 //#region src/plugins/jwt/types.d.ts
-interface JwtOptions {
+export interface JwtOptions {
   /**
    * Use the JWT plugin's locally managed signing keys for JWT session cookie
    * cache values.
@@ -214,7 +214,7 @@ interface JwtOptions {
  *
  * @see https://github.com/panva/jose/issues/210
  */
-type JWKOptions = {
+export type JWKOptions = {
   alg: "EdDSA";
   crv?: "Ed25519" | undefined;
 } | {
@@ -230,8 +230,8 @@ type JWKOptions = {
   alg: "RS256";
   modulusLength?: number | undefined;
 };
-type JWSAlgorithms = JWKOptions["alg"];
-interface Jwk {
+export type JWSAlgorithms = JWKOptions["alg"];
+export interface Jwk {
   id: string;
   publicKey: string;
   privateKey: string;
@@ -247,10 +247,9 @@ interface Jwk {
  * read the `alg` before constructing the JWT payload
  * (required for OIDC hash claims like at_hash).
  */
-interface ResolvedSigningKey {
+export interface ResolvedSigningKey {
   alg: string;
   kid: string;
   privateKey: CryptoKey | Uint8Array;
 }
-//#endregion
-export { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey };
+//#endregion

package/dist/plugins/jwt/utils.d.mts

@@ -1,7 +1,5 @@
 import { Jwk, JwtOptions } from "./types.mjs";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as _$jose from "jose";
-
 //#region src/plugins/jwt/utils.d.ts
 /**
  * Converts an expirationTime to ISO seconds expiration time (the format of JWT exp)
@@ -12,10 +10,10 @@ import * as _$jose from "jose";
  * @param iat - the iat time to consolidate on
  * @returns
  */
-declare function toExpJWT(expirationTime: number | Date | string, iat: number): number;
-declare function generateExportedKeyPair(options?: JwtOptions | undefined): Promise<{
-  publicWebKey: _$jose.JWK;
-  privateWebKey: _$jose.JWK;
+export declare function toExpJWT(expirationTime: number | Date | string, iat: number): number;
+export declare function generateExportedKeyPair(options?: JwtOptions | undefined): Promise<{
+  publicWebKey: import("jose").JWK;
+  privateWebKey: import("jose").JWK;
   alg: "EdDSA" | "ES256" | "ES512" | "PS256" | "RS256";
   cfg: {
     crv?: "Ed25519" | undefined;
@@ -36,6 +34,5 @@ declare function generateExportedKeyPair(options?: JwtOptions | undefined): Prom
  * @param options
  * @returns
  */
-declare function createJwk(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<Jwk>;
-//#endregion
-export { createJwk, generateExportedKeyPair, toExpJWT };
+export declare function createJwk(ctx: GenericEndpointContext, options?: JwtOptions | undefined): Promise<Jwk>;
+//#endregion

package/dist/plugins/jwt/verify.d.mts

@@ -1,11 +1,9 @@
 import { JwtOptions } from "./types.mjs";
 import { JWTPayload } from "jose";
-
 //#region src/plugins/jwt/verify.d.ts
 /**
  * Verify a JWT token using the JWKS public keys
  * Returns the payload if valid, null otherwise
  */
-declare function verifyJWT<T extends JWTPayload = JWTPayload>(token: string, options?: JwtOptions): Promise<(T & Required<Pick<JWTPayload, "sub" | "aud">>) | null>;
-//#endregion
-export { verifyJWT };
+export declare function verifyJWT<T extends JWTPayload = JWTPayload>(token: string, options?: JwtOptions): Promise<(T & Required<Pick<JWTPayload, "sub" | "aud">>) | null>;
+//#endregion

package/dist/plugins/jwt/verify.mjs

@@ -1,4 +1,4 @@
-import { getJwksAdapter } from "./adapter.mjs";
+import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { base64 } from "@better-auth/utils/base64";
 import { importJWK, jwtVerify } from "jose";
@@ -28,11 +28,17 @@ async function verifyJWT(token, options) {
 			ctx.context.logger.debug(`No JWKS key found for kid: ${kid}`);
 			return null;
 		}
-		const cryptoKey = await importJWK(JSON.parse(key.publicKey), key.alg ?? options?.jwks?.keyPairConfig?.alg ?? "EdDSA");
+		const publicKey = JSON.parse(key.publicKey);
+		const alg = key.alg ?? getDefaultKeyAlg(options);
+		const cryptoKey = await importJWK(publicKey, alg);
 		const baseURLOrigin = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : void 0;
+		const issuer = options?.jwt?.issuer ?? baseURLOrigin;
+		const audience = options?.jwt?.audience ?? baseURLOrigin;
+		if (!issuer || !audience) ctx.context.logger.warn("[better-auth] The JWT plugin is verifying a JWT without checking its issuer or audience because no base URL was resolved for this call. Set `baseURL`, or `jwt.issuer` and `jwt.audience` in the JWT plugin options.");
 		const { payload } = await jwtVerify(token, cryptoKey, {
-			issuer: options?.jwt?.issuer ?? baseURLOrigin,
-			audience: options?.jwt?.audience ?? baseURLOrigin
+			issuer,
+			audience,
+			algorithms: [alg]
 		});
 		if (!payload.sub || !payload.aud) return null;
 		return payload;

package/dist/plugins/last-login-method/client.d.mts

@@ -2,7 +2,7 @@
 /**
  * Configuration for the client-side last login method plugin
  */
-interface LastLoginMethodClientConfig {
+export interface LastLoginMethodClientConfig {
   /**
    * Name of the cookie to read the last login method from
    * @default "better-auth.last_used_login_method"
@@ -22,7 +22,7 @@ interface LastLoginMethodClientConfig {
 /**
  * Client-side plugin to retrieve the last used login method
  */
-declare const lastLoginMethodClient: (config?: LastLoginMethodClientConfig) => {
+export declare const lastLoginMethodClient: (config?: LastLoginMethodClientConfig) => {
   id: "last-login-method-client";
   version: string;
   getActions(): {
@@ -44,5 +44,4 @@ declare const lastLoginMethodClient: (config?: LastLoginMethodClientConfig) => {
     isLastUsedLoginMethod: (method: string) => boolean;
   };
 };
-//#endregion
-export { LastLoginMethodClientConfig, lastLoginMethodClient };
+//#endregion

package/dist/plugins/last-login-method/index.d.mts

@@ -1,7 +1,4 @@
-import * as _$_better_auth_core0 from "@better-auth/core";
 import { GenericEndpointContext } from "@better-auth/core";
-import * as _$better_call0 from "better-call";
-
 //#region src/plugins/last-login-method/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
@@ -13,7 +10,7 @@ declare module "@better-auth/core" {
 /**
  * Configuration for tracking different authentication methods
  */
-interface LastLoginMethodOptions {
+export interface LastLoginMethodOptions {
   /**
    * Name of the cookie to store the last login method
    * @default "better-auth.last_used_login_method"
@@ -57,10 +54,10 @@ interface LastLoginMethodOptions {
 /**
  * Plugin to track the last used login method
  */
-declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
+export declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O | undefined) => {
   id: "last-login-method";
   version: string;
-  init(ctx: _$_better_auth_core0.AuthContext): {
+  init(ctx: import("@better-auth/core").AuthContext): {
     options: {
       databaseHooks: {
         user: {
@@ -107,7 +104,7 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   hooks: {
     after: {
       matcher(): true;
-      handler: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>;
+      handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
     }[];
   };
   schema: O["storeInDatabase"] extends true ? {
@@ -123,5 +120,4 @@ declare const lastLoginMethod: <O extends LastLoginMethodOptions>(userConfig?: O
   } : undefined;
   options: NoInfer<O>;
 };
-//#endregion
-export { LastLoginMethodOptions, lastLoginMethod };
+//#endregion

package/dist/plugins/last-login-method/index.mjs

@@ -30,7 +30,7 @@ const lastLoginMethod = (userConfig) => {
 	const config = {
 		...userConfig,
 		cookieName: userConfig?.cookieName ?? "better-auth.last_used_login_method",
-		maxAge: userConfig?.maxAge ?? 3600 * 24 * 30
+		maxAge: userConfig?.maxAge ?? 2592e3
 	};
 	return {
 		id: "last-login-method",