kitcn 0.27.5 → 0.28.1

package/CHANGELOG.md

@@ -1,5 +1,215 @@
 # kitcn
 
+## 0.28.1
+
+### Patch Changes
+
+- [#420](https://github.com/udecode/kitcn/pull/420) [`73741ed`](https://github.com/udecode/kitcn/commit/73741ed08779d539c9f186db366e326b138dbd36) Thanks [@MikeyZhang75](https://github.com/MikeyZhang75)! - ## Patches
+
+  - Fix `insert()` re-reading the same parent row once per inserted row. Rows of one statement that share a foreign key now cost one existence check instead of one per row.
+  - Fix the aggregate write barrier re-scanning the `CLEARING` index-state range once per written row. A multi-row write now checks it once per transaction, and a backfill that starts clearing an index still blocks the writes that follow it.
+  - Fix a relation `where` re-reading the same related document once per scanned row. Filtering by a relation now reads each distinct related document once per query instead of once per candidate row.
+
+## 0.28.0
+
+### Minor Changes
+
+- [#430](https://github.com/udecode/kitcn/pull/430) [`d90c209`](https://github.com/udecode/kitcn/commit/d90c20987a5a94a29d3fcb57aee85e060146a2a8) Thanks [@zbeyens](https://github.com/zbeyens)! - ## Breaking changes
+
+  - Require Better Auth 1.7. Existing deployments need a maintenance window and
+    two schema deployments. Do not refresh the required Better Auth 1.7 schema
+    first: the old schema rejects new fields, while the required schema rejects
+    old rows.
+
+  ```ts
+  // Before
+  const account = { accountId, providerId, userId };
+
+  // After
+  const account = { accountId, issuer, providerId, userId };
+  ```
+
+  ### Deployment 1: optional fields and backfills
+
+  Stop authentication writes, background jobs, and admin APIs that write
+  `account`, `team`, or `teamMember`. Keep them stopped through deployment 2.
+
+  Keep the currently deployed Better Auth version. Temporarily add `issuer` and
+  the lookup index to the existing account schema owner. Apps using organization
+  teams must also add optional `memberCount` and `membershipKey` fields plus the
+  `membershipKey` index:
+
+  ```ts
+  // ORM account field/index
+  issuer: text(),
+  index("accountId_issuer").on(accountTable.accountId, accountTable.issuer),
+
+  // ORM team and teamMember fields/index
+  memberCount: integer(),
+  membershipKey: text(),
+  uniqueIndex("membershipKey").on(teamMemberTable.membershipKey),
+
+  // Raw Convex account field/index
+  issuer: v.optional(v.string()),
+  .index("accountId_issuer", ["accountId", "issuer"])
+
+  // Raw Convex team and teamMember fields/index
+  memberCount: v.optional(v.number()),
+  membershipKey: v.optional(v.string()),
+  .index("membershipKey", ["membershipKey"])
+  ```
+
+  `membershipKey` stays optional in the generated Better Auth 1.7 schema, and
+  the 1.7 adapter falls back to the existing `(teamId, userId)` pair when it is
+  absent. Existing rows do not need a membership-key backfill; new 1.7 writes
+  populate it.
+
+  Create a migration with `bunx kitcn migrate create backfill_account_issuer`.
+  Inventory every provider and resolve both parts of its 1.7 identity from
+  trusted provider data. Credential accounts use `local:credential` and their
+  linked user ID. OAuth providers without an issuer use
+  `local:oauth:${encodeURIComponent(providerId)}` and keep their stable provider
+  subject unless the 1.7 provider contract changed it.
+
+  Microsoft is a required exception: map every `microsoft` and
+  `microsoft-entra-id` row from its old `sub` to the verified directory `oid`
+  from a verified stored ID token or trusted Entra export. Apply the same rule to
+  custom OAuth/OIDC providers whose 1.7 `accountSubject` differs. Never derive an
+  identity from email or another mutable profile field. The
+  [Better Auth 1.7 upgrade guide](https://www.better-auth.com/docs/guides/1-7-upgrade-guide)
+  owns the provider-specific mapping rules.
+
+  ```ts
+  import { defineMigration } from "kitcn/orm";
+
+  const issuerByProviderId = {
+    credential: "local:credential",
+    github: "local:oauth:github",
+    google: "https://accounts.google.com",
+  } as const;
+
+  // Add every row whose trusted 1.7 provider subject differs from accountId.
+  const accountIdByRowId: Record<string, string> = {
+    "microsoft-account-row-id": "verified-directory-oid",
+  };
+
+  export const migration = defineMigration({
+    id: "20260826_000000_backfill_account_issuer",
+    up: {
+      table: "account",
+      migrateOne: async (ctx, account) => {
+        const issuer =
+          issuerByProviderId[
+            account.providerId as keyof typeof issuerByProviderId
+          ];
+
+        if (!issuer) {
+          throw new Error(`Map issuer for provider ${account.providerId}`);
+        }
+        const mappedAccountId = accountIdByRowId[account._id];
+        if (
+          (account.providerId === "microsoft" ||
+            account.providerId === "microsoft-entra-id") &&
+          !mappedAccountId
+        ) {
+          throw new Error(`Map verified Microsoft oid for ${account._id}`);
+        }
+        const accountId =
+          mappedAccountId ??
+          (account.providerId === "credential"
+            ? account.userId
+            : account.accountId);
+        if (!accountId) {
+          throw new Error(`Map account subject for ${account._id}`);
+        }
+
+        if (account.issuer !== undefined && account.issuer !== issuer) {
+          throw new Error(`Issuer mismatch for account ${account._id}`);
+        }
+        if (account.issuer === issuer && account.accountId === accountId) {
+          return;
+        }
+
+        const collision = await ctx.db
+          .query("account")
+          .withIndex("accountId_issuer", (query) =>
+            query.eq("accountId", accountId).eq("issuer", issuer)
+          )
+          .unique();
+
+        if (collision && collision._id !== account._id) {
+          throw new Error(`Duplicate account identity ${issuer}:${accountId}`);
+        }
+
+        return { accountId, issuer };
+      },
+    },
+  });
+  ```
+
+  Apps using organization teams must also create a migration that sets every
+  team's count from the indexed `teamMember` rows:
+
+  ```ts
+  export const teamMemberCountMigration = defineMigration({
+    id: "20260826_000001_backfill_team_member_count",
+    up: {
+      table: "team",
+      migrateOne: async (ctx, team) => {
+        const members = await ctx.db
+          .query("teamMember")
+          .withIndex("teamId", (query) => query.eq("teamId", team._id))
+          .collect();
+
+        return { memberCount: members.length };
+      },
+    },
+  });
+  ```
+
+  Deploy the optional schema and migration, then require a completed status:
+
+  ```bash
+  bunx kitcn codegen
+  bunx kitcn deploy --prod
+  bunx kitcn migrate status --prod
+  ```
+
+  Raw Convex apps use the same resolver and indexed collision check in a
+  paginated internal mutation after deploying the optional fields and indexes.
+  Team users must also count `teamMember` rows by the `teamId` index and patch
+  every team using the team's Convex `_id`. Finish every page, verify no account
+  lacks either identity field, verify no `(issuer, accountId)` collision exists,
+  and verify every team count before continuing.
+
+  ### Deployment 2: required Better Auth 1.7 schema
+
+  After the backfill is complete, upgrade KitCN and Better Auth, refresh the
+  auth-owned schema, and deploy the required field and compound identity index:
+
+  ```bash
+  # Default KitCN schema owner
+  bunx kitcn add auth --schema --yes
+
+  # Raw Convex schema owner; use this command instead of the default command
+  bunx kitcn add auth --preset convex --yes
+
+  bunx kitcn deploy --prod
+  ```
+
+  Verify returning credential, OAuth, and Microsoft sign-in plus team membership
+  changes against the migrated data. Resume writes only after these checks pass.
+
+  ## Features
+
+  - Support Better Auth 1.7 account identity constraints, declared table indexes,
+    atomic adapter mutations, stable join configuration, session hydration, and
+    organization metadata reads.
+
+  ## Patches
+
+  - Fix OpenID discovery to advertise the configured JWT signing algorithm.
+
 ## 0.27.5
 
 ### Patch Changes

package/dist/aggregate/index.d.ts

@@ -1,5 +1,5 @@
-import { Bn as ConvexTextBuilderInitial, Xt as ConvexTableWithColumns } from "../capabilities-DkfnnNp7.js";
-import { C as ConvexNumberBuilderInitial, E as ConvexIdBuilderInitial, N as ConvexCustomBuilderInitial } from "../where-clause-compiler-DuC8Nr7e.js";
+import { Bn as ConvexTextBuilderInitial, Xt as ConvexTableWithColumns } from "../capabilities-BAiI8avr.js";
+import { C as ConvexNumberBuilderInitial, E as ConvexIdBuilderInitial, N as ConvexCustomBuilderInitial } from "../where-clause-compiler-DdAw9rNV.js";
 import * as convex_values0 from "convex/values";
 import { GenericId, Infer, Value } from "convex/values";
 import { DocumentByName, GenericDataModel, GenericDatabaseReader, GenericDatabaseWriter, TableNamesInDataModel } from "convex/server";

package/dist/auth/client/index.d.ts

@@ -6,8 +6,6 @@ import * as react_jsx_runtime0 from "react/jsx-runtime";
 import { AuthConfig } from "convex/server";
 import * as better_auth0 from "better-auth";
 import { Session, User } from "better-auth";
-import * as better_auth_api0 from "better-auth/api";
-import * as better_auth_plugins_oidc_provider0 from "better-auth/plugins/oidc-provider";
 import * as jose from "jose";
 import { BetterAuthOptions } from "better-auth/minimal";
 import { BetterAuthClientPlugin } from "better-auth/client";
@@ -36,18 +34,15 @@ declare const convex: (opts: {
   hooks: {
     before: ({
       matcher(context: better_auth0.HookEndpointContext): boolean;
-      handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+      handler: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
         context: {
           headers: Headers;
         };
-      } | undefined>;
+      } | undefined>>;
     } | {
       matcher: (ctx: better_auth0.HookEndpointContext) => boolean;
-      handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-        context: better_auth0.MiddlewareContext<better_auth0.MiddlewareOptions, {
-          returned?: unknown | undefined;
-          responseHeaders?: Headers | undefined;
-        } & better_auth0.PluginContext<BetterAuthOptions> & better_auth0.InfoContext & {
+      handler: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+        context: better_auth0.MiddlewareContext<better_auth0.MiddlewareOptions, better_auth0.PluginContext<BetterAuthOptions> & better_auth0.InfoContext & {
           options: BetterAuthOptions;
           trustedOrigins: string[];
           trustedProviders: string[];
@@ -139,6 +134,7 @@ declare const convex: (opts: {
             updateAge: number;
             expiresIn: number;
             freshAge: number;
+            cookieCacheSigner?: better_auth0.CookieCacheSigner | undefined;
             cookieRefreshCache: false | {
               enabled: true;
               updateAge: number;
@@ -172,12 +168,15 @@ declare const convex: (opts: {
           skipCSRFCheck: boolean;
           runInBackground: (promise: Promise<unknown>) => void;
           runInBackgroundOrAwait: (promise: Promise<unknown> | void) => better_auth0.Awaitable<unknown>;
+        } & {
+          returned?: unknown | undefined;
+          responseHeaders?: Headers | undefined;
         }>;
-      }>;
+      }>>;
     })[];
     after: {
-      matcher: (context: better_auth0.HookEndpointContext) => boolean;
-      handler: better_auth_api0.AuthMiddleware;
+      matcher: (ctx: better_auth0.HookEndpointContext) => boolean;
+      handler: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>>;
     }[];
   };
   endpoints: {
@@ -186,7 +185,25 @@ declare const convex: (opts: {
       metadata: {
         isAction: false;
       };
-    }, better_auth_plugins_oidc_provider0.OIDCMetadata>;
+    }, {
+      issuer: string;
+      authorization_endpoint: string;
+      token_endpoint: string;
+      userinfo_endpoint: string;
+      jwks_uri: string;
+      registration_endpoint: string;
+      end_session_endpoint: string;
+      scopes_supported: string[];
+      response_types_supported: string[];
+      response_modes_supported: string[];
+      grant_types_supported: string[];
+      acr_values_supported: string[];
+      subject_types_supported: string[];
+      id_token_signing_alg_values_supported: string[];
+      token_endpoint_auth_methods_supported: string[];
+      code_challenge_methods_supported: string[];
+      claims_supported: string[];
+    }>;
     getJwks: better_auth0.StrictEndpoint<"/convex/jwks", {
       method: "GET";
       metadata: {
@@ -223,7 +240,7 @@ declare const convex: (opts: {
     getToken: better_auth0.StrictEndpoint<"/convex/token", {
       method: "GET";
       requireHeaders: true;
-      use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+      use: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -245,7 +262,7 @@ declare const convex: (opts: {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       metadata: {
         openapi: {
           description: string;
@@ -274,6 +291,14 @@ declare const convex: (opts: {
           type: "date";
           required: false;
         };
+        alg: {
+          type: "string";
+          required: false;
+        };
+        crv: {
+          type: "string";
+          required: false;
+        };
       };
     };
     user: {
@@ -353,7 +378,10 @@ type ConvexAuthProviderClient = {
 type AuthClientWithPlugins<Plugins extends BetterAuthClientPlugin[]> = ReturnType<typeof createAuthClient<{
   plugins: Plugins;
 }>>;
-type AuthClient = AuthClientWithPlugins<PluginsWithCrossDomain> | AuthClientWithPlugins<PluginsWithoutCrossDomain>;
+type HydratableAuthClient<Plugins extends BetterAuthClientPlugin[]> = Omit<AuthClientWithPlugins<Plugins>, 'hydrateSession'> & {
+  hydrateSession(session: Parameters<AuthClientWithPlugins<Plugins>['hydrateSession']>[0]): void;
+};
+type AuthClient = HydratableAuthClient<PluginsWithCrossDomain> | HydratableAuthClient<PluginsWithoutCrossDomain>;
 //#endregion
 //#region src/auth-client/convex-auth-provider.d.ts
 type ConvexAuthProviderQueryClient = {

package/dist/auth/generated/index.d.ts

@@ -1,2 +1,2 @@
-import { S as defineAuth, _ as GenericAuthBeforeResult, b as GenericAuthTriggerHandlers, g as BetterAuthOptionsWithoutDatabase, i as getGeneratedAuthDisabledReason, n as GeneratedAuthDisabledReasonKind, r as createDisabledAuthRuntime, t as AuthRuntime, v as GenericAuthDefinition, x as GenericAuthTriggers, y as GenericAuthTriggerChange } from "../../generated-contract-disabled-BEc4d98x.js";
+import { C as GenericAuthTriggers, S as GenericAuthTriggerHandlers, b as GenericAuthDefinition, i as getGeneratedAuthDisabledReason, n as GeneratedAuthDisabledReasonKind, r as createDisabledAuthRuntime, t as AuthRuntime, v as BetterAuthOptionsWithoutDatabase, w as defineAuth, x as GenericAuthTriggerChange, y as GenericAuthBeforeResult } from "../../generated-contract-disabled-BBCcpNyF.js";
 export { type AuthRuntime, BetterAuthOptionsWithoutDatabase, type GeneratedAuthDisabledReasonKind, GenericAuthBeforeResult, GenericAuthDefinition, GenericAuthTriggerChange, GenericAuthTriggerHandlers, GenericAuthTriggers, createDisabledAuthRuntime, defineAuth, getGeneratedAuthDisabledReason };

package/dist/auth/generated/index.js

@@ -1,3 +1,3 @@
-import { i as defineAuth, n as createDisabledAuthRuntime, r as getGeneratedAuthDisabledReason } from "../../generated-contract-disabled-CZa0iyV0.js";
+import { i as defineAuth, n as createDisabledAuthRuntime, r as getGeneratedAuthDisabledReason } from "../../generated-contract-disabled-_1Mjg9pW.js";
 
 export { createDisabledAuthRuntime, defineAuth, getGeneratedAuthDisabledReason };

package/dist/auth/index.d.ts

@@ -1,7 +1,7 @@
 import { a as QueryCtxWithPreferredOrmQueryTable, n as LookupByIdResultByCtx, t as DocByCtx } from "../query-context-DJONf8X5.js";
 import { t as GetAuth } from "../types-Bf3XQex5.js";
 import { t as GenericCtx } from "../context-utils-DwZ3Cam1.js";
-import { S as defineAuth, _ as GenericAuthBeforeResult, a as AuthFunctions, b as GenericAuthTriggerHandlers, c as createApi, d as deleteOneHandler, f as findManyHandler, g as BetterAuthOptionsWithoutDatabase, h as updateOneHandler, i as getGeneratedAuthDisabledReason, l as createHandler, m as updateManyHandler, n as GeneratedAuthDisabledReasonKind, o as Triggers, p as findOneHandler, r as createDisabledAuthRuntime, s as createClient, t as AuthRuntime, u as deleteManyHandler, v as GenericAuthDefinition, x as GenericAuthTriggers, y as GenericAuthTriggerChange } from "../generated-contract-disabled-BEc4d98x.js";
+import { C as GenericAuthTriggers, S as GenericAuthTriggerHandlers, _ as updateOneHandler, a as AuthFunctions, b as GenericAuthDefinition, c as consumeOneHandler, d as deleteManyHandler, f as deleteOneHandler, g as updateManyHandler, h as incrementOneHandler, i as getGeneratedAuthDisabledReason, l as createApi, m as findOneHandler, n as GeneratedAuthDisabledReasonKind, o as Triggers, p as findManyHandler, r as createDisabledAuthRuntime, s as createClient, t as AuthRuntime, u as createHandler, v as BetterAuthOptionsWithoutDatabase, w as defineAuth, x as GenericAuthTriggerChange, y as GenericAuthBeforeResult } from "../generated-contract-disabled-BBCcpNyF.js";
 import * as convex_values0 from "convex/values";
 import { Infer } from "convex/values";
 import { AuthConfig, DocumentByName, GenericDataModel, GenericMutationCtx, GenericQueryCtx, GenericSchema, PaginationOptions, PaginationResult, SchemaDefinition, TableNamesInDataModel } from "convex/server";
@@ -9,8 +9,6 @@ import * as better_auth_adapters0 from "better-auth/adapters";
 import { DBAdapterDebugLogOption } from "better-auth/adapters";
 import { BetterAuthDBSchema } from "better-auth/db";
 import { BetterAuthOptions } from "better-auth/minimal";
-import * as better_auth_api0 from "better-auth/api";
-import * as better_auth_plugins_oidc_provider0 from "better-auth/plugins/oidc-provider";
 import * as jose from "jose";
 import * as better_auth0 from "better-auth";
 import { Session, User } from "better-auth";
@@ -68,7 +66,7 @@ declare const adapterConfig: {
     action: "create" | "update" | "findOne" | "findMany" | "updateMany" | "delete" | "deleteMany" | "consumeOne" | "incrementOne" | "count";
     model: string;
     schema: BetterAuthDBSchema;
-    options: better_auth0.BetterAuthOptions;
+    options: BetterAuthOptions;
   }) => any;
   customTransformOutput: ({
     data,
@@ -80,7 +78,7 @@ declare const adapterConfig: {
     select: string[];
     model: string;
     schema: BetterAuthDBSchema;
-    options: better_auth0.BetterAuthOptions;
+    options: BetterAuthOptions;
   }) => any;
 };
 declare const httpAdapter: <DataModel extends GenericDataModel, Schema extends SchemaDefinition<any, any>>(ctx: GenericCtx<DataModel>, {
@@ -91,7 +89,7 @@ declare const httpAdapter: <DataModel extends GenericDataModel, Schema extends S
   authFunctions: AuthFunctions;
   debugLogs?: DBAdapterDebugLogOption;
   schema?: Schema;
-}) => better_auth_adapters0.AdapterFactory<better_auth0.BetterAuthOptions>;
+}) => better_auth_adapters0.AdapterFactory<BetterAuthOptions>;
 declare const dbAdapter: <DataModel extends GenericDataModel, Schema extends SchemaDefinition<any, any>>(ctx: GenericCtx<DataModel>, {
   authFunctions,
   debugLogs,
@@ -102,7 +100,7 @@ declare const dbAdapter: <DataModel extends GenericDataModel, Schema extends Sch
   getBetterAuthSchema: () => BetterAuthDBSchema;
   schema: Schema;
   debugLogs?: DBAdapterDebugLogOption;
-}) => better_auth_adapters0.AdapterFactory<better_auth0.BetterAuthOptions>;
+}) => better_auth_adapters0.AdapterFactory<BetterAuthOptions>;
 //#endregion
 //#region src/auth/adapter-utils.d.ts
 type AdapterPaginationOptions = PaginationOptions & {
@@ -123,7 +121,6 @@ declare const adapterWhereValidator: convex_values0.VObject<{
   value: convex_values0.VUnion<string | number | boolean | string[] | number[] | null, [convex_values0.VString<string, "required">, convex_values0.VFloat64<number, "required">, convex_values0.VBoolean<boolean, "required">, convex_values0.VArray<string[], convex_values0.VString<string, "required">, "required">, convex_values0.VArray<number[], convex_values0.VFloat64<number, "required">, "required">, convex_values0.VNull<null, "required">], "required", never>;
 }, "required", "mode" | "value" | "connector" | "field" | "operator">;
 declare const adapterArgsValidator: convex_values0.VObject<{
-  select?: string[] | undefined;
   where?: {
     mode?: "sensitive" | "insensitive" | undefined;
     connector?: "AND" | "OR" | undefined;
@@ -133,6 +130,7 @@ declare const adapterArgsValidator: convex_values0.VObject<{
   }[] | undefined;
   limit?: number | undefined;
   offset?: number | undefined;
+  select?: string[] | undefined;
   sortBy?: {
     field: string;
     direction: "asc" | "desc";
@@ -169,7 +167,7 @@ declare const adapterArgsValidator: convex_values0.VObject<{
     operator: convex_values0.VUnion<"lt" | "lte" | "gt" | "gte" | "eq" | "in" | "not_in" | "ne" | "contains" | "starts_with" | "ends_with" | undefined, [convex_values0.VLiteral<"lt", "required">, convex_values0.VLiteral<"lte", "required">, convex_values0.VLiteral<"gt", "required">, convex_values0.VLiteral<"gte", "required">, convex_values0.VLiteral<"eq", "required">, convex_values0.VLiteral<"in", "required">, convex_values0.VLiteral<"not_in", "required">, convex_values0.VLiteral<"ne", "required">, convex_values0.VLiteral<"contains", "required">, convex_values0.VLiteral<"starts_with", "required">, convex_values0.VLiteral<"ends_with", "required">], "optional", never>;
     value: convex_values0.VUnion<string | number | boolean | string[] | number[] | null, [convex_values0.VString<string, "required">, convex_values0.VFloat64<number, "required">, convex_values0.VBoolean<boolean, "required">, convex_values0.VArray<string[], convex_values0.VString<string, "required">, "required">, convex_values0.VArray<number[], convex_values0.VFloat64<number, "required">, "required">, convex_values0.VNull<null, "required">], "required", never>;
   }, "required", "mode" | "value" | "connector" | "field" | "operator">, "optional">;
-}, "required", "model" | "select" | "where" | "limit" | "offset" | "sortBy" | "sortBy.field" | "sortBy.direction">;
+}, "required", "model" | "where" | "limit" | "offset" | "select" | "sortBy" | "sortBy.field" | "sortBy.direction">;
 declare const hasUniqueFields: (betterAuthSchema: BetterAuthDBSchema, model: string, input: Record<string, any>) => boolean;
 declare const checkUniqueFields: <Schema extends SchemaDefinition<any, any>>(ctx: GenericQueryCtx<GenericDataModel>, schema: Schema, betterAuthSchema: BetterAuthDBSchema, table: string, input: Record<string, any>, doc?: Record<string, any>) => Promise<void>;
 declare const selectFields: <T extends TableNamesInDataModel<GenericDataModel>, D extends DocumentByName<GenericDataModel, T>>(doc: D | null, select?: string[]) => D | null;
@@ -254,18 +252,15 @@ declare const convex: (opts: {
   hooks: {
     before: ({
       matcher(context: better_auth0.HookEndpointContext): boolean;
-      handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+      handler: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
         context: {
           headers: Headers;
         };
-      } | undefined>;
+      } | undefined>>;
     } | {
       matcher: (ctx: better_auth0.HookEndpointContext) => boolean;
-      handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-        context: better_auth0.MiddlewareContext<better_auth0.MiddlewareOptions, {
-          returned?: unknown | undefined;
-          responseHeaders?: Headers | undefined;
-        } & better_auth0.PluginContext<BetterAuthOptions> & better_auth0.InfoContext & {
+      handler: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+        context: better_auth0.MiddlewareContext<better_auth0.MiddlewareOptions, better_auth0.PluginContext<BetterAuthOptions> & better_auth0.InfoContext & {
           options: BetterAuthOptions;
           trustedOrigins: string[];
           trustedProviders: string[];
@@ -357,6 +352,7 @@ declare const convex: (opts: {
             updateAge: number;
             expiresIn: number;
             freshAge: number;
+            cookieCacheSigner?: better_auth0.CookieCacheSigner | undefined;
             cookieRefreshCache: false | {
               enabled: true;
               updateAge: number;
@@ -390,12 +386,15 @@ declare const convex: (opts: {
           skipCSRFCheck: boolean;
           runInBackground: (promise: Promise<unknown>) => void;
           runInBackgroundOrAwait: (promise: Promise<unknown> | void) => better_auth0.Awaitable<unknown>;
+        } & {
+          returned?: unknown | undefined;
+          responseHeaders?: Headers | undefined;
         }>;
-      }>;
+      }>>;
     })[];
     after: {
-      matcher: (context: better_auth0.HookEndpointContext) => boolean;
-      handler: better_auth_api0.AuthMiddleware;
+      matcher: (ctx: better_auth0.HookEndpointContext) => boolean;
+      handler: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>>;
     }[];
   };
   endpoints: {
@@ -404,7 +403,25 @@ declare const convex: (opts: {
       metadata: {
         isAction: false;
       };
-    }, better_auth_plugins_oidc_provider0.OIDCMetadata>;
+    }, {
+      issuer: string;
+      authorization_endpoint: string;
+      token_endpoint: string;
+      userinfo_endpoint: string;
+      jwks_uri: string;
+      registration_endpoint: string;
+      end_session_endpoint: string;
+      scopes_supported: string[];
+      response_types_supported: string[];
+      response_modes_supported: string[];
+      grant_types_supported: string[];
+      acr_values_supported: string[];
+      subject_types_supported: string[];
+      id_token_signing_alg_values_supported: string[];
+      token_endpoint_auth_methods_supported: string[];
+      code_challenge_methods_supported: string[];
+      claims_supported: string[];
+    }>;
     getJwks: better_auth0.StrictEndpoint<"/convex/jwks", {
       method: "GET";
       metadata: {
@@ -441,7 +458,7 @@ declare const convex: (opts: {
     getToken: better_auth0.StrictEndpoint<"/convex/token", {
       method: "GET";
       requireHeaders: true;
-      use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+      use: better_auth0.Middleware<better_auth0.MiddlewareOptions, (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
         session: {
           session: Record<string, any> & {
             id: string;
@@ -463,7 +480,7 @@ declare const convex: (opts: {
             image?: string | null | undefined;
           };
         };
-      }>)[];
+      }>>[];
       metadata: {
         openapi: {
           description: string;
@@ -492,6 +509,14 @@ declare const convex: (opts: {
           type: "date";
           required: false;
         };
+        alg: {
+          type: "string";
+          required: false;
+        };
+        crv: {
+          type: "string";
+          required: false;
+        };
       };
     };
     user: {
@@ -506,4 +531,4 @@ declare const convex: (opts: {
   };
 };
 //#endregion
-export { type AuthFunctions, type AuthRuntime, BetterAuthOptionsWithoutDatabase, ConvexCleanedWhere, type GeneratedAuthDisabledReasonKind, GenericAuthBeforeResult, GenericAuthDefinition, GenericAuthTriggerChange, GenericAuthTriggerHandlers, GenericAuthTriggers, GetAuth, SessionClientSignals, type Triggers, adapterArgsValidator, adapterConfig, adapterWhereValidator, checkUniqueFields, convex, createApi, createAuthRuntime, createClient, createDisabledAuthRuntime, createHandler, dbAdapter, defineAuth, deleteManyHandler, deleteOneHandler, findManyHandler, findOneHandler, getAuthUserId, getAuthUserIdentity, getGeneratedAuthDisabledReason, getHeaders, getInvalidAuthDefinitionExportReason, getSession, getSessionNetworkSignals, handlePagination, hasUniqueFields, httpAdapter, listOne, paginate, resolveGeneratedAuthDefinition, selectFields, updateManyHandler, updateOneHandler };
+export { type AuthFunctions, type AuthRuntime, BetterAuthOptionsWithoutDatabase, ConvexCleanedWhere, type GeneratedAuthDisabledReasonKind, GenericAuthBeforeResult, GenericAuthDefinition, GenericAuthTriggerChange, GenericAuthTriggerHandlers, GenericAuthTriggers, GetAuth, SessionClientSignals, type Triggers, adapterArgsValidator, adapterConfig, adapterWhereValidator, checkUniqueFields, consumeOneHandler, convex, createApi, createAuthRuntime, createClient, createDisabledAuthRuntime, createHandler, dbAdapter, defineAuth, deleteManyHandler, deleteOneHandler, findManyHandler, findOneHandler, getAuthUserId, getAuthUserIdentity, getGeneratedAuthDisabledReason, getHeaders, getInvalidAuthDefinitionExportReason, getSession, getSessionNetworkSignals, handlePagination, hasUniqueFields, httpAdapter, incrementOneHandler, listOne, paginate, resolveGeneratedAuthDefinition, selectFields, updateManyHandler, updateOneHandler };