better-auth 1.7.20 → 1.7.22

package/dist/plugins/generic-oauth/index.mjs

@@ -1,4 +1,3 @@
-import { toBoolean } from "../../utils/boolean.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { GENERIC_OAUTH_ERROR_CODES } from "./error-codes.mjs";
 import { auth0 } from "./providers/auth0.mjs";
@@ -12,11 +11,11 @@ import { patreon } from "./providers/patreon.mjs";
 import { slack } from "./providers/slack.mjs";
 import { yandex } from "./providers/yandex.mjs";
 import { APIError } from "@better-auth/core/error";
-import { applyDefaultAccessTokenExpiry, createAuthorizationURL, refreshAccessToken, validateAuthorizationCode, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { applyDefaultAccessTokenExpiry, createAuthorizationURL, parseStringBoolean, refreshAccessToken, validateAuthorizationCode, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { createAuthMiddleware } from "@better-auth/core/api";
 import { createRemoteJWKSet, decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/generic-oauth/index.ts
+// src/plugins/generic-oauth/index.ts
 function isSecretlessTokenEndpointAuth(tokenEndpointAuth) {
 	return tokenEndpointAuth?.method === "private_key_jwt" || tokenEndpointAuth?.method === "none";
 }
@@ -25,6 +24,7 @@ function isClientSecretTokenEndpointAuth(tokenEndpointAuth) {
 }
 /** A request waits on a discovery retry, so bound it (the SSO plugin uses 10s too). */
 const DISCOVERY_RETRY_TIMEOUT_MS = 1e4;
+const MAX_DISCOVERY_REDIRECTS = 5;
 /**
 * Providers skipped because startup discovery failed. Init stores them on each auth
 * instance's context, so one plugin object can serve several instances. It is a context
@@ -44,25 +44,42 @@ const readIdTokenClaims = (idToken) => {
 	}
 };
 async function fetchDiscovery(url, headers, timeout) {
-	const result = await betterFetch(url, {
-		method: "GET",
-		headers,
-		signal: timeout ? AbortSignal.timeout(timeout) : void 0
-	});
-	if (result.error || !result.data) return null;
-	if (result.data.issuer) try {
-		new URL(result.data.issuer);
-	} catch {
-		return null;
+	const signal = timeout ? AbortSignal.timeout(timeout) : void 0;
+	let target = url;
+	for (let hop = 0;; hop++) {
+		const redirect = {};
+		const result = await betterFetch(target, {
+			method: "GET",
+			headers,
+			redirect: headers ? "manual" : void 0,
+			signal,
+			onError: ({ response }) => {
+				if (response.status >= 300 && response.status < 400) redirect.location = response.headers.get("location");
+			}
+		});
+		if (headers && redirect.location) {
+			const next = new URL(redirect.location, target);
+			if (next.origin !== new URL(url).origin) throw new Error(`discovery redirected to ${next.origin}; with discoveryHeaders set, only same-origin redirects are followed. Set discoveryUrl to the final URL.`);
+			if (hop >= MAX_DISCOVERY_REDIRECTS) throw new Error(`discovery redirected more than ${MAX_DISCOVERY_REDIRECTS} times. Set discoveryUrl to the final URL.`);
+			target = next.href;
+			continue;
+		}
+		if (headers && result.error?.status === 0) throw new Error("discovery redirected; with discoveryHeaders set, set discoveryUrl to the final URL.");
+		if (result.error || !result.data) return null;
+		if (result.data.issuer) try {
+			new URL(result.data.issuer);
+		} catch {
+			return null;
+		}
+		return result.data;
 	}
-	return result.data;
 }
 async function fetchUserInfo(tokens, userInfoUrl, idTokenClaims) {
 	if (tokens.idToken) {
 		const decoded = idTokenClaims ?? readIdTokenClaims(tokens.idToken);
 		if (decoded?.sub && decoded?.email) return {
 			id: decoded.sub,
-			emailVerified: toBoolean(decoded.email_verified),
+			emailVerified: parseStringBoolean(decoded.email_verified) ?? false,
 			image: decoded.picture,
 			...decoded
 		};
@@ -76,7 +93,7 @@ async function fetchUserInfo(tokens, userInfoUrl, idTokenClaims) {
 	return {
 		...userInfo.data,
 		email: userInfo.data.email,
-		emailVerified: toBoolean(userInfo.data.email_verified),
+		emailVerified: parseStringBoolean(userInfo.data.email_verified) ?? false,
 		image: userInfo.data.picture,
 		name: userInfo.data.name
 	};
@@ -128,8 +145,9 @@ const genericOAuth = (options) => {
 							ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
 							continue;
 						}
+						const jwksHeaders = jwksUrl.origin === new URL(c.discoveryUrl).origin ? c.discoveryHeaders : void 0;
 						idTokenConfig = {
-							jwks: createRemoteJWKSet(jwksUrl),
+							jwks: createRemoteJWKSet(jwksUrl, jwksHeaders && { headers: jwksHeaders }),
 							issuer: discovered.issuer,
 							audience: c.clientId,
 							algorithms: isOidc ? signingAlgs : void 0
@@ -160,7 +178,7 @@ const genericOAuth = (options) => {
 				const mapped = c.mapProfileToUser ? await c.mapProfileToUser(raw) : {};
 				const user = {
 					email: raw.email,
-					emailVerified: toBoolean(raw.emailVerified),
+					emailVerified: parseStringBoolean(raw.emailVerified) ?? false,
 					image: raw.image,
 					name: raw.name,
 					...mapped
@@ -287,7 +305,8 @@ const genericOAuth = (options) => {
 						authentication: c.authentication,
 						tokenEndpointAuth,
 						tokenEndpoint: tokenUrl,
-						extraParams: resolvedRefreshParams
+						extraParams: resolvedRefreshParams,
+						headers: c.authorizationHeaders
 					});
 					return applyDefaultAccessTokenExpiry(tokens, c.accessTokenExpiresIn);
 				},
@@ -303,18 +322,13 @@ const genericOAuth = (options) => {
 		}
 		return genericProviders;
 	};
-	const retryDiscovery = (ctx, providerId) => {
+	const retryDiscovery = async (ctx, providerId) => {
 		const pendingDiscovery = getPendingDiscovery(ctx);
 		const pending = pendingDiscovery?.get(providerId);
 		if (!pending) return;
-		pending.attempt ??= buildProviders([pending.config], ctx, DISCOVERY_RETRY_TIMEOUT_MS).then(([provider]) => {
-			if (!provider) return;
-			pendingDiscovery?.delete(providerId);
-			ctx.socialProviders.unshift(provider);
-		}).finally(() => {
-			pending.attempt = void 0;
-		});
-		return pending.attempt;
+		const [provider] = await buildProviders([pending], ctx, DISCOVERY_RETRY_TIMEOUT_MS);
+		if (!provider || !pendingDiscovery?.delete(providerId)) return;
+		ctx.socialProviders.unshift(provider);
 	};
 	const requestedProviderId = (context) => {
 		const id = context.body?.provider ?? context.body?.providerId ?? context.query?.provider ?? context.params?.id;
@@ -326,7 +340,7 @@ const genericOAuth = (options) => {
 		init: async (ctx) => {
 			const genericProviders = await buildProviders(options.config, ctx);
 			const built = new Set(genericProviders.map((p) => p.id));
-			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, { config: c }]));
+			const genericOAuthPendingDiscovery = new Map(options.config.filter((c) => !built.has(c.providerId)).map((c) => [c.providerId, c]));
 			const existingIds = new Set(ctx.socialProviders.map((p) => p.id));
 			for (const gp of genericProviders) if (existingIds.has(gp.id)) ctx.logger.warn(`Generic OAuth provider "${gp.id}" shadows a built-in social provider with the same ID`);
 			return { context: {
@@ -344,5 +358,4 @@ const genericOAuth = (options) => {
 		$ERROR_CODES: GENERIC_OAUTH_ERROR_CODES
 	};
 };
-//#endregion
 export { auth0, genericOAuth, gumroad, hubspot, keycloak, line, microsoftEntraId, okta, patreon, slack, yandex };

package/dist/plugins/generic-oauth/providers/auth0.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/auth0.d.ts
 export interface Auth0Options extends BaseOAuthProviderOptions {
   /**
    * Auth0 domain (e.g., dev-xxx.eu.auth0.com)
@@ -30,5 +29,4 @@ export interface Auth0Options extends BaseOAuthProviderOptions {
  * });
  * ```
  */
-export declare function auth0(options: Auth0Options): GenericOAuthConfig<"auth0">;
-//#endregion
+export declare function auth0(options: Auth0Options): GenericOAuthConfig<"auth0">;

package/dist/plugins/generic-oauth/providers/auth0.mjs

@@ -1,4 +1,4 @@
-//#region src/plugins/generic-oauth/providers/auth0.ts
+// src/plugins/generic-oauth/providers/auth0.ts
 /**
 * Auth0 OAuth provider helper
 *
@@ -45,5 +45,4 @@ function auth0(options) {
 		overrideUserInfo: options.overrideUserInfo
 	};
 }
-//#endregion
 export { auth0 };

package/dist/plugins/generic-oauth/providers/gumroad.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/gumroad.d.ts
 export interface GumroadOptions extends BaseOAuthProviderOptions {}
 /**
  * Gumroad OAuth provider helper
@@ -25,5 +24,4 @@ export interface GumroadOptions extends BaseOAuthProviderOptions {}
  *
  * @see https://app.gumroad.com/oauth
  */
-export declare function gumroad(options: GumroadOptions): GenericOAuthConfig<"gumroad">;
-//#endregion
+export declare function gumroad(options: GumroadOptions): GenericOAuthConfig<"gumroad">;

package/dist/plugins/generic-oauth/providers/gumroad.mjs

@@ -1,5 +1,5 @@
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/generic-oauth/providers/gumroad.ts
+// src/plugins/generic-oauth/providers/gumroad.ts
 /**
 * Gumroad OAuth provider helper
 *
@@ -58,5 +58,4 @@ function gumroad(options) {
 		getUserInfo
 	};
 }
-//#endregion
 export { gumroad };

package/dist/plugins/generic-oauth/providers/hubspot.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/hubspot.d.ts
 export interface HubSpotOptions extends BaseOAuthProviderOptions {
   /**
    * OAuth scopes to request.
@@ -30,5 +29,4 @@ export interface HubSpotOptions extends BaseOAuthProviderOptions {
  * });
  * ```
  */
-export declare function hubspot(options: HubSpotOptions): GenericOAuthConfig<"hubspot">;
-//#endregion
+export declare function hubspot(options: HubSpotOptions): GenericOAuthConfig<"hubspot">;

package/dist/plugins/generic-oauth/providers/hubspot.mjs

@@ -1,5 +1,5 @@
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/generic-oauth/providers/hubspot.ts
+// src/plugins/generic-oauth/providers/hubspot.ts
 /**
 * HubSpot OAuth provider helper
 *
@@ -62,5 +62,4 @@ function hubspot(options) {
 		getUserInfo
 	};
 }
-//#endregion
 export { hubspot };

package/dist/plugins/generic-oauth/providers/keycloak.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/keycloak.d.ts
 export interface KeycloakOptions extends BaseOAuthProviderOptions {
   /**
    * Keycloak issuer URL (includes realm, e.g., https://my-domain/realms/MyRealm)
@@ -30,5 +29,4 @@ export interface KeycloakOptions extends BaseOAuthProviderOptions {
  * });
  * ```
  */
-export declare function keycloak(options: KeycloakOptions): GenericOAuthConfig<"keycloak">;
-//#endregion
+export declare function keycloak(options: KeycloakOptions): GenericOAuthConfig<"keycloak">;

package/dist/plugins/generic-oauth/providers/keycloak.mjs

@@ -1,4 +1,4 @@
-//#region src/plugins/generic-oauth/providers/keycloak.ts
+// src/plugins/generic-oauth/providers/keycloak.ts
 /**
 * Keycloak OAuth provider helper
 *
@@ -43,5 +43,4 @@ function keycloak(options) {
 		overrideUserInfo: options.overrideUserInfo
 	};
 }
-//#endregion
 export { keycloak };

package/dist/plugins/generic-oauth/providers/line.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/line.d.ts
 export interface LineOptions extends BaseOAuthProviderOptions {
   /**
    * Unique provider identifier for this LINE channel.
@@ -48,5 +47,4 @@ export interface LineOptions extends BaseOAuthProviderOptions {
  * });
  * ```
  */
-export declare function line(options: LineOptions): GenericOAuthConfig;
-//#endregion
+export declare function line(options: LineOptions): GenericOAuthConfig;

package/dist/plugins/generic-oauth/providers/line.mjs

@@ -1,6 +1,6 @@
 import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/generic-oauth/providers/line.ts
+// src/plugins/generic-oauth/providers/line.ts
 /**
 * LINE OAuth provider helper
 *
@@ -89,5 +89,4 @@ function line(options) {
 		getUserInfo
 	};
 }
-//#endregion
 export { line };

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/microsoft-entra-id.d.ts
 export interface MicrosoftEntraIdOptions extends BaseOAuthProviderOptions {
   /**
    * Concrete Microsoft Entra ID tenant GUID.
@@ -33,5 +32,4 @@ export interface MicrosoftEntraIdOptions extends BaseOAuthProviderOptions {
  * });
  * ```
  */
-export declare function microsoftEntraId(options: MicrosoftEntraIdOptions): GenericOAuthConfig<"microsoft-entra-id">;
-//#endregion
+export declare function microsoftEntraId(options: MicrosoftEntraIdOptions): GenericOAuthConfig<"microsoft-entra-id">;

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.mjs

@@ -1,7 +1,7 @@
 import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 import { createPlaceholderEmail } from "@better-auth/core/utils/email";
-//#region src/plugins/generic-oauth/providers/microsoft-entra-id.ts
+// src/plugins/generic-oauth/providers/microsoft-entra-id.ts
 function getMicrosoftProfileName(profile) {
 	return profile.name ?? (`${profile.given_name ?? profile.givenname ?? ""} ${profile.family_name ?? profile.familyname ?? ""}`.trim() || void 0);
 }
@@ -100,5 +100,4 @@ function microsoftEntraId(options) {
 		getUserInfo
 	};
 }
-//#endregion
 export { microsoftEntraId };

package/dist/plugins/generic-oauth/providers/okta.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/okta.d.ts
 export interface OktaOptions extends BaseOAuthProviderOptions {
   /**
    * Okta issuer URL (e.g., https://dev-xxxxx.okta.com/oauth2/default)
@@ -30,5 +29,4 @@ export interface OktaOptions extends BaseOAuthProviderOptions {
  * });
  * ```
  */
-export declare function okta(options: OktaOptions): GenericOAuthConfig<"okta">;
-//#endregion
+export declare function okta(options: OktaOptions): GenericOAuthConfig<"okta">;

package/dist/plugins/generic-oauth/providers/okta.mjs

@@ -1,4 +1,4 @@
-//#region src/plugins/generic-oauth/providers/okta.ts
+// src/plugins/generic-oauth/providers/okta.ts
 /**
 * Okta OAuth provider helper
 *
@@ -43,5 +43,4 @@ function okta(options) {
 		overrideUserInfo: options.overrideUserInfo
 	};
 }
-//#endregion
 export { okta };

package/dist/plugins/generic-oauth/providers/patreon.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/patreon.d.ts
 export interface PatreonOptions extends BaseOAuthProviderOptions {}
 /**
  * Patreon OAuth provider helper
@@ -23,5 +22,4 @@ export interface PatreonOptions extends BaseOAuthProviderOptions {}
  * });
  * ```
  */
-export declare function patreon(options: PatreonOptions): GenericOAuthConfig<"patreon">;
-//#endregion
+export declare function patreon(options: PatreonOptions): GenericOAuthConfig<"patreon">;

package/dist/plugins/generic-oauth/providers/patreon.mjs

@@ -1,5 +1,5 @@
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/generic-oauth/providers/patreon.ts
+// src/plugins/generic-oauth/providers/patreon.ts
 /**
 * Patreon OAuth provider helper
 *
@@ -57,5 +57,4 @@ function patreon(options) {
 		getUserInfo
 	};
 }
-//#endregion
 export { patreon };

package/dist/plugins/generic-oauth/providers/slack.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/slack.d.ts
 export interface SlackOptions extends BaseOAuthProviderOptions {}
 /**
  * Slack OAuth provider helper
@@ -23,5 +22,4 @@ export interface SlackOptions extends BaseOAuthProviderOptions {}
  * });
  * ```
  */
-export declare function slack(options: SlackOptions): GenericOAuthConfig<"slack">;
-//#endregion
+export declare function slack(options: SlackOptions): GenericOAuthConfig<"slack">;

package/dist/plugins/generic-oauth/providers/slack.mjs

@@ -1,5 +1,5 @@
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/generic-oauth/providers/slack.ts
+// src/plugins/generic-oauth/providers/slack.ts
 /**
 * Slack OAuth provider helper
 *
@@ -59,5 +59,4 @@ function slack(options) {
 		getUserInfo
 	};
 }
-//#endregion
 export { slack };

package/dist/plugins/generic-oauth/providers/yandex.d.mts

@@ -1,6 +1,5 @@
 import { GenericOAuthConfig } from "../types.mjs";
 import { BaseOAuthProviderOptions } from "../index.mjs";
-//#region src/plugins/generic-oauth/providers/yandex.d.ts
 export interface YandexOptions extends BaseOAuthProviderOptions {}
 /**
  * Yandex OAuth provider helper
@@ -23,5 +22,4 @@ export interface YandexOptions extends BaseOAuthProviderOptions {}
  * });
  * ```
  */
-export declare function yandex(options: YandexOptions): GenericOAuthConfig;
-//#endregion
+export declare function yandex(options: YandexOptions): GenericOAuthConfig;

package/dist/plugins/generic-oauth/providers/yandex.mjs

@@ -1,5 +1,5 @@
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/generic-oauth/providers/yandex.ts
+// src/plugins/generic-oauth/providers/yandex.ts
 /**
 * Yandex OAuth provider helper
 *
@@ -63,5 +63,4 @@ function yandex(options) {
 		getUserInfo
 	};
 }
-//#endregion
 export { yandex };

package/dist/plugins/generic-oauth/types.d.mts

@@ -1,6 +1,5 @@
 import { Awaitable } from "@better-auth/core";
 import { OAuth2Tokens, OAuth2UserInfo, OAuthAccountKeyContext, OAuthMappedUser, OAuthRefreshContext, TokenEndpointAuth } from "@better-auth/core/oauth2";
-//#region src/plugins/generic-oauth/types.d.ts
 /** Raw profile returned by a Generic OAuth provider. */
 export type GenericOAuthUserInfo = Omit<OAuth2UserInfo, "id"> & {
   id?: string | number | null | undefined;
@@ -211,12 +210,15 @@ export interface GenericOAuthConfig<ID extends string = string> {
    */
   authentication?: ("basic" | "post") | undefined;
   /**
-   * Custom headers to include in the discovery request.
+   * Custom headers to include in the discovery request, and in the JWKS request when
+   * `jwks_uri` has the same origin as `discoveryUrl`. When set, discovery follows
+   * redirects only within that origin and fails on a redirect to another origin.
    * Useful for providers like Epic that require specific headers (e.g., Epic-Client-ID).
    */
   discoveryHeaders?: Record<string, string> | undefined;
   /**
-   * Custom headers to include in the authorization request.
+   * Custom headers to include in token endpoint requests: the authorization
+   * code exchange and token refresh.
    * Useful for providers like Qonto that require specific headers (e.g., X-Qonto-Staging-Token for local development).
    */
   authorizationHeaders?: Record<string, string> | undefined;
@@ -263,5 +265,4 @@ export interface GenericOAuthConfig<ID extends string = string> {
    * @default false
    */
   disableIdTokenNonceBinding?: boolean | undefined;
-}
-//#endregion
+}

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -1,4 +1,3 @@
-//#region src/plugins/haveibeenpwned/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     "have-i-been-pwned": {
@@ -55,5 +54,4 @@ export declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefine
   $ERROR_CODES: {
     PASSWORD_COMPROMISED: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_COMPROMISED">;
   };
-};
-//#endregion
+};

package/dist/plugins/haveibeenpwned/index.mjs

@@ -1,11 +1,11 @@
-import { isAPIError } from "../../utils/is-api-error.mjs";
 import { APIError } from "../../api/index.mjs";
+import { isAPIError } from "../../utils/is-api-error.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
-//#region src/plugins/haveibeenpwned/index.ts
+// src/plugins/haveibeenpwned/index.ts
 const ERROR_CODES = defineErrorCodes({ PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password." });
 function getPasswordCompromiseCount(response, hashSuffix) {
 	const matchingEntryPrefix = `${hashSuffix.toUpperCase()}:`;
@@ -77,5 +77,4 @@ const haveIBeenPwned = (options) => {
 		$ERROR_CODES: ERROR_CODES
 	};
 };
-//#endregion
 export { haveIBeenPwned, isPasswordCompromised };

package/dist/plugins/index.d.mts

@@ -53,21 +53,21 @@ import { OneTimeTokenOptions, oneTimeToken } from "./one-time-token/index.mjs";
 import { FieldSchema, OpenAPIModelSchema, OpenAPIParameter, OpenAPISchema, Path, generator } from "./open-api/generator.mjs";
 import { OpenAPIOptions, openAPI } from "./open-api/index.mjs";
 import { PhoneNumberOptions, UserWithPhoneNumber } from "./phone-number/types.mjs";
+import "./organization/index.mjs";
 import { phoneNumber } from "./phone-number/index.mjs";
-import { SIWEPluginOptions, siwe } from "./siwe/index.mjs";
 import { LoginResult, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions } from "./test-utils/types.mjs";
-import { testUtils } from "./test-utils/index.mjs";
+import { SIWEPluginOptions, siwe } from "./siwe/index.mjs";
 import { BackupCodeOptions, backupCode2fa, encodeBackupCodes, generateBackupCodes, getBackupCodes, verifyBackupCode } from "./two-factor/backup-codes/index.mjs";
 import { OTPOptions, otp2fa } from "./two-factor/otp/index.mjs";
 import { TOTPOptions, totp2fa } from "./two-factor/totp/index.mjs";
 import { TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor } from "./two-factor/types.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./two-factor/error-code.mjs";
 import { twoFactorClient } from "./two-factor/client.mjs";
-import { twoFactor } from "./two-factor/index.mjs";
+import { testUtils } from "./test-utils/index.mjs";
 import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
-import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
+import { twoFactor } from "./two-factor/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { parseRoles } from "./organization/roles.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "./organization/organization.mjs";
-import "./organization/index.mjs";
+import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 export { AccessControl, type AdminOptions, type AnonymousOptions, type AnonymousSession, ArrayElement, type Auth0Options, AuthorizeResponse, type BackupCodeOptions, type BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, type BotIdVerification, type CaptchaFoxOptions, type CaptchaOptions, type CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, type DeviceCode, type DeviceCodeRedemptionAuthorization, type DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, type EmailOTPOptions, ExactRoleStatements, type FieldSchema, type GenericOAuthConfig, type GenericOAuthOptions, type GenericOAuthUserInfo, type GoogleRecaptchaOptions, type GumroadOptions, type HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, type HubSpotOptions, type InferAdminRolesFromOption, type InferInvitation, type InferMember, InferOptionSchema, type InferOrganization, type InferOrganizationRolesFromOption, type InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, type InferTeam, type Invitation, type InvitationInput, type InvitationStatus, type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, type KeycloakOptions, LastLoginMethodOptions, type LineOptions, type LoginResult, MagicLinkOptions, type Member, type MemberInput, type MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, type OAuthPopupData, type OAuthPopupMessage, OAuthProxyOptions, type OTPOptions, type OktaOptions, OneTapOptions, OneTimeTokenOptions, type OpenAPIModelSchema, OpenAPIOptions, type OpenAPIParameter, type OpenAPISchema, type Organization, OrganizationCreator, OrganizationEndpoints, type OrganizationInput, type OrganizationOptions, OrganizationPlugin, type OrganizationRole, type OrganizationSchema, POPUP_MARKER_COOKIE, type Path, type PatreonOptions, type PhoneNumberOptions, type Provider, type ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, type SessionWithImpersonatedBy, type SlackOptions, Statements, SubArray, Subset, type TOTPOptions, TWO_FACTOR_ERROR_CODES, type Team, TeamEndpoints, type TeamInput, type TeamMember, type TeamMemberInput, type TestAuthOptions, type TestCookie, type TestHelpers, type TestUtilsOptions, type TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, type UserWithAnonymous, type UserWithPhoneNumber, type UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, type ValidateRequestContext, type VercelBotIdOptions, type YandexOptions, admin, anonymous, auth0, type backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, type defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, type encodeBackupCodes, type generateBackupCodes, generateExportedKeyPair, type generator, genericOAuth, type getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, type invitationSchema, type invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, type memberSchema, microsoftEntraId, type ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, type organizationRoleSchema, type organizationSchema, type otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, type roleSchema, type sec, signJWT, siwe, slack, type teamMemberSchema, type teamSchema, testUtils, toExpJWT, type totp2fa, twoFactor, twoFactorClient, username, type verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/jwt/adapter.mjs

@@ -1,5 +1,5 @@
 import { getCurrentAdapter } from "@better-auth/core/context";
-//#region src/plugins/jwt/adapter.ts
+// src/plugins/jwt/adapter.ts
 /**
 * Algorithm of the key the plugin generates when `jwks.keyPairConfig` is unset.
 */
@@ -75,5 +75,4 @@ const getJwksAdapter = (baseAdapter, options) => {
 		}
 	};
 };
-//#endregion
 export { DEFAULT_JWK_ALG, getDefaultKeyAlg, getJwksAdapter };

package/dist/plugins/jwt/client.d.mts

@@ -1,9 +1,8 @@
-import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./types.mjs";
 import { jwt } from "./index.mjs";
+import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./types.mjs";
 import { BetterAuthClientOptions, ClientFetchOption, ClientStore } from "@better-auth/core";
 import { JSONWebKeySet } from "jose";
 import { BetterFetch } from "@better-fetch/fetch";
-//#region src/plugins/jwt/client.d.ts
 interface JwtClientOptions {
   jwks?: {
     /**
@@ -36,5 +35,4 @@ export declare const jwtClient: (options?: JwtClientOptions) => {
     }>;
   };
 };
-//#endregion
 export type { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey };

package/dist/plugins/jwt/client.mjs

@@ -1,5 +1,5 @@
 import { PACKAGE_VERSION } from "../../version.mjs";
-//#region src/plugins/jwt/client.ts
+// src/plugins/jwt/client.ts
 const jwtClient = (options) => {
 	const jwksPath = options?.jwks?.jwksPath ?? "/jwks";
 	return {
@@ -15,5 +15,4 @@ const jwtClient = (options) => {
 		} })
 	};
 };
-//#endregion
 export { jwtClient };

package/dist/plugins/jwt/cookie-cache.mjs

@@ -3,7 +3,7 @@ import { getDefaultKeyAlg, getJwksAdapter } from "./adapter.mjs";
 import { resolveSigningKey } from "./sign.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import { SignJWT, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
-//#region src/plugins/jwt/cookie-cache.ts
+// src/plugins/jwt/cookie-cache.ts
 function getCookieCacheJwtIssuer(ctx) {
 	const baseURL = ctx.context.options.baseURL;
 	return typeof baseURL === "string" ? baseURL || "better-auth:session-cache" : ctx.context.baseURL || "better-auth:session-cache";
@@ -68,5 +68,4 @@ function createCookieCacheSigner(options) {
 		verify: (ctx, token) => verifyCookieCacheJWT(ctx, token, options)
 	};
 }
-//#endregion
 export { createCookieCacheSigner };

package/dist/plugins/jwt/index.d.mts

@@ -1,10 +1,9 @@
-import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./types.mjs";
 import { getJwtToken, resolveSigningKey, signJWT } from "./sign.mjs";
+import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./types.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./utils.mjs";
 import { verifyJWT } from "./verify.mjs";
 import * as z from "zod";
 import { JSONWebKeySet, JWTPayload } from "jose";
-//#region src/plugins/jwt/index.d.ts
 declare module "@better-auth/core" {
   interface BetterAuthPluginRegistry<AuthOptions, Options> {
     jwt: {
@@ -239,5 +238,4 @@ export declare const jwt: <O extends JwtOptions>(options?: O) => {
     };
   };
 };
-//#endregion
 export { type JWKOptions, type JWSAlgorithms, type Jwk, type JwtOptions, type ResolvedSigningKey, createJwk, generateExportedKeyPair, getJwtToken, resolveSigningKey, signJWT, toExpJWT, verifyJWT };