@better-auth/core - npm Package Compare versions

Comparing version 1.6.23 to 1.6.24

dist/api/index.d.mts

 import { BetterAuthDBSchema, ModelNames, SecondaryStorage } from "../db/type.mjs";
 import { DBAdapter } from "../db/adapter/index.mjs";
 import { createLogger } from "../env/logger.mjs";
+import "../db/index.mjs";
 import { AuthContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
-import * as better_call0 from "better-call";
+import "../oauth2/index.mjs";
 import { EndpointContext, EndpointOptions, StrictEndpoint } from "better-call";
-import * as _better_auth_core0 from "@better-auth/core";
-
 //#region src/api/index.d.ts
-declare const optionsMiddleware: <InputCtx extends better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>;
+declare const optionsMiddleware: <InputCtx extends import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>;
 declare const createAuthMiddleware: {
-  <Options extends better_call0.MiddlewareOptions, R>(options: Options, handler: (ctx: better_call0.MiddlewareContext<Options, {
+  <Options extends import("better-call").MiddlewareOptions, R>(options: Options, handler: (ctx: import("better-call").MiddlewareContext<Options, {
     returned?: unknown | undefined;
     responseHeaders?: Headers | undefined;
-  } & _better_auth_core0.PluginContext<_better_auth_core0.BetterAuthOptions> & _better_auth_core0.InfoContext & {
-    options: _better_auth_core0.BetterAuthOptions;
+  } & import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
+    options: import("@better-auth/core").BetterAuthOptions;
     trustedOrigins: string[];
@@ -91,3 +91,3 @@ trustedProviders: string[];
     socialProviders: OAuthProvider[];
-    authCookies: _better_auth_core0.BetterAuthCookies;
+    authCookies: import("@better-auth/core").BetterAuthCookies;
     logger: ReturnType<typeof createLogger>;
@@ -99,8 +99,8 @@ rateLimit: {
       storage: "memory" | "database" | "secondary-storage";
-    } & Omit<_better_auth_core0.BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
-    adapter: DBAdapter<_better_auth_core0.BetterAuthOptions>;
-    internalAdapter: _better_auth_core0.InternalAdapter<_better_auth_core0.BetterAuthOptions>;
-    createAuthCookie: (cookieName: string, overrideAttributes?: Partial<better_call0.CookieOptions> | undefined) => _better_auth_core0.BetterAuthCookie;
+    } & Omit<import("@better-auth/core").BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
+    adapter: DBAdapter<import("@better-auth/core").BetterAuthOptions>;
+    internalAdapter: import("@better-auth/core").InternalAdapter<import("@better-auth/core").BetterAuthOptions>;
+    createAuthCookie: (cookieName: string, overrideAttributes?: Partial<import("better-call").CookieOptions> | undefined) => import("@better-auth/core").BetterAuthCookie;
     secret: string;
-    secretConfig: string | _better_auth_core0.SecretConfig;
+    secretConfig: string | import("@better-auth/core").SecretConfig;
     sessionConfig: {
@@ -130,3 +130,3 @@ updateAge: number;
       };
-      checkPassword: (userId: string, ctx: _better_auth_core0.GenericEndpointContext<_better_auth_core0.BetterAuthOptions>) => Promise<boolean>;
+      checkPassword: (userId: string, ctx: import("@better-auth/core").GenericEndpointContext<import("@better-auth/core").BetterAuthOptions>) => Promise<boolean>;
     };
@@ -143,9 +143,9 @@ tables: BetterAuthDBSchema;
     runInBackground: (promise: Promise<unknown>) => void;
-    runInBackgroundOrAwait: (promise: Promise<unknown> | void) => _better_auth_core0.Awaitable<unknown>;
-  }>) => Promise<R>): (inputContext: better_call0.MiddlewareInputContext<Options>) => Promise<R>;
-  <Options extends better_call0.MiddlewareOptions, R_1>(handler: (ctx: better_call0.MiddlewareContext<Options, {
+    runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("@better-auth/core").Awaitable<unknown>;
+  }>) => Promise<R>): (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R>;
+  <Options extends import("better-call").MiddlewareOptions, R_1>(handler: (ctx: import("better-call").MiddlewareContext<Options, {
     returned?: unknown | undefined;
     responseHeaders?: Headers | undefined;
-  } & _better_auth_core0.PluginContext<_better_auth_core0.BetterAuthOptions> & _better_auth_core0.InfoContext & {
-    options: _better_auth_core0.BetterAuthOptions;
+  } & import("@better-auth/core").PluginContext<import("@better-auth/core").BetterAuthOptions> & import("@better-auth/core").InfoContext & {
+    options: import("@better-auth/core").BetterAuthOptions;
     trustedOrigins: string[];
@@ -224,3 +224,3 @@ trustedProviders: string[];
     socialProviders: OAuthProvider[];
-    authCookies: _better_auth_core0.BetterAuthCookies;
+    authCookies: import("@better-auth/core").BetterAuthCookies;
     logger: ReturnType<typeof createLogger>;
@@ -232,8 +232,8 @@ rateLimit: {
       storage: "memory" | "database" | "secondary-storage";
-    } & Omit<_better_auth_core0.BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
-    adapter: DBAdapter<_better_auth_core0.BetterAuthOptions>;
-    internalAdapter: _better_auth_core0.InternalAdapter<_better_auth_core0.BetterAuthOptions>;
-    createAuthCookie: (cookieName: string, overrideAttributes?: Partial<better_call0.CookieOptions> | undefined) => _better_auth_core0.BetterAuthCookie;
+    } & Omit<import("@better-auth/core").BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
+    adapter: DBAdapter<import("@better-auth/core").BetterAuthOptions>;
+    internalAdapter: import("@better-auth/core").InternalAdapter<import("@better-auth/core").BetterAuthOptions>;
+    createAuthCookie: (cookieName: string, overrideAttributes?: Partial<import("better-call").CookieOptions> | undefined) => import("@better-auth/core").BetterAuthCookie;
     secret: string;
-    secretConfig: string | _better_auth_core0.SecretConfig;
+    secretConfig: string | import("@better-auth/core").SecretConfig;
     sessionConfig: {
@@ -263,3 +263,3 @@ updateAge: number;
       };
-      checkPassword: (userId: string, ctx: _better_auth_core0.GenericEndpointContext<_better_auth_core0.BetterAuthOptions>) => Promise<boolean>;
+      checkPassword: (userId: string, ctx: import("@better-auth/core").GenericEndpointContext<import("@better-auth/core").BetterAuthOptions>) => Promise<boolean>;
     };
@@ -276,4 +276,4 @@ tables: BetterAuthDBSchema;
     runInBackground: (promise: Promise<unknown>) => void;
-    runInBackgroundOrAwait: (promise: Promise<unknown> | void) => _better_auth_core0.Awaitable<unknown>;
-  }>) => Promise<R_1>): (inputContext: better_call0.MiddlewareInputContext<Options>) => Promise<R_1>;
+    runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("@better-auth/core").Awaitable<unknown>;
+  }>) => Promise<R_1>): (inputContext: import("better-call").MiddlewareInputContext<Options>) => Promise<R_1>;
 };
@@ -280,0 +280,0 @@ type EndpointHandler<Path extends string, Options extends EndpointOptions, R> = (context: EndpointContext<Path, Options, AuthContext>) => Promise<R>;

dist/async_hooks/index.d.mts

 import { AsyncLocalStorage } from "node:async_hooks";
-
 //#region src/async_hooks/index.d.ts
@@ -4,0 +3,0 @@ declare function getAsyncLocalStorage(): Promise<typeof AsyncLocalStorage>;

dist/async_hooks/pure.index.d.mts

 import { AsyncLocalStorage } from "node:async_hooks";
-
 //#region src/async_hooks/pure.index.d.ts
@@ -4,0 +3,0 @@ declare function getAsyncLocalStorage(): Promise<typeof AsyncLocalStorage>;

dist/context/endpoint-context.d.mts

 import { AuthContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { EndpointContext, InputContext } from "better-call";
 import { AsyncLocalStorage } from "@better-auth/core/async_hooks";
-
 //#region src/context/endpoint-context.d.ts
@@ -6,0 +6,0 @@ type AuthEndpointContext = Partial<InputContext<string, any> & EndpointContext<string, any>> & {

dist/context/global.d.mts

 import { AsyncLocalStorage } from "@better-auth/core/async_hooks";
-
 //#region src/context/global.d.ts
@@ -4,0 +3,0 @@ declare function getBetterAuthVersion(): string;

dist/context/global.mjs

@@ -5,3 +5,3 @@ //#region src/context/global.ts
 const __context = {};
-const __betterAuthVersion = "1.6.23";
+const __betterAuthVersion = "1.6.24";
 /**
@@ -8,0 +8,0 @@ * We store context instance in the globalThis.

dist/context/request-state.d.mts

 import { AsyncLocalStorage } from "@better-auth/core/async_hooks";
-
 //#region src/context/request-state.d.ts
@@ -4,0 +3,0 @@ type RequestStateWeakMap = WeakMap<object, any>;

dist/context/request-state.mjs

 import { __getBetterAuthGlobal } from "./global.mjs";
 import { getAsyncLocalStorage } from "@better-auth/core/async_hooks";
 //#region src/context/request-state.ts
+let asyncStorageInit = null;
 const ensureAsyncStorage = async () => {
 	const betterAuthGlobal = __getBetterAuthGlobal();
-	if (!betterAuthGlobal.context.requestStateAsyncStorage) {
-		const AsyncLocalStorage = await getAsyncLocalStorage();
-		betterAuthGlobal.context.requestStateAsyncStorage = new AsyncLocalStorage();
-	}
-	return betterAuthGlobal.context.requestStateAsyncStorage;
+	const existing = betterAuthGlobal.context.requestStateAsyncStorage;
+	if (existing) return existing;
+	if (!asyncStorageInit) asyncStorageInit = getAsyncLocalStorage().then((AsyncLocalStorage) => {
+		betterAuthGlobal.context.requestStateAsyncStorage ??= new AsyncLocalStorage();
+		return betterAuthGlobal.context.requestStateAsyncStorage;
+	});
+	return asyncStorageInit;
 };
@@ -12,0 +15,0 @@ async function getRequestStateAsyncLocalStorage() {

dist/context/transaction.d.mts

 import { DBAdapter, DBTransactionAdapter } from "../db/adapter/index.mjs";
 import { BetterAuthOptions } from "../types/init-options.mjs";
+import "../types/index.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
-
 //#region src/context/transaction.d.ts
@@ -6,0 +6,0 @@ type StoredAdapter = DBTransactionAdapter<BetterAuthOptions>;

dist/db/adapter/factory.d.mts

@@ -10,9 +10,7 @@ import { initGetDefaultFieldName } from "./get-default-field-name.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 //#region src/db/adapter/factory.d.ts
 type AdapterFactory<Options extends BetterAuthOptions> = (options: Options) => DBAdapter<Options>;
-declare const createAdapterFactory: <Options extends BetterAuthOptions>({
-  adapter: customAdapter,
-  config: cfg
-}: AdapterFactoryOptions) => AdapterFactory<Options>;
+declare const createAdapterFactory: <Options extends BetterAuthOptions>({ adapter: customAdapter, config: cfg }: AdapterFactoryOptions) => AdapterFactory<Options>;
 //#endregion
-export { AdapterFactory, createAdapterFactory };
+export { AdapterFactory, AdapterFactoryConfig, AdapterFactoryCustomizeAdapterCreator, AdapterFactoryOptions, AdapterTestDebugLogs, createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName };

dist/db/adapter/factory.mjs

@@ -905,2 +905,2 @@ import { getCurrentAdapter, runWithTransaction } from "../../context/transaction.mjs";
 //#endregion
-export { createAdapterFactory };
+export { createAdapterFactory, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName };

dist/db/adapter/get-default-field-name.d.mts

 import { BetterAuthDBSchema } from "../type.mjs";
-
 //#region src/db/adapter/get-default-field-name.d.ts
-declare const initGetDefaultFieldName: ({
-  schema,
-  usePlural
-}: {
+declare const initGetDefaultFieldName: ({ schema, usePlural }: {
   schema: BetterAuthDBSchema;
   usePlural: boolean | undefined;
-}) => ({
-  field,
-  model: unsafeModel
-}: {
+}) => ({ field, model: unsafeModel }: {
   model: string;
@@ -15,0 +8,0 @@ field: string;

dist/db/adapter/get-default-model-name.d.mts

 import { BetterAuthDBSchema } from "../type.mjs";
-
 //#region src/db/adapter/get-default-model-name.d.ts
-declare const initGetDefaultModelName: ({
-  usePlural,
-  schema
-}: {
+declare const initGetDefaultModelName: ({ usePlural, schema }: {
   usePlural: boolean | undefined;
@@ -9,0 +5,0 @@ schema: BetterAuthDBSchema;

dist/db/adapter/get-default-model-name.mjs

@@ -16,10 +16,11 @@ import { BetterAuthError } from "../../error/index.mjs";
 	const getDefaultModelName = (model) => {
+		const resolve = (candidate) => {
+			if (schema[candidate]) return candidate;
+			return Object.entries(schema).find(([_, f]) => f.modelName === candidate)?.[0];
+		};
 		if (usePlural && model.charAt(model.length - 1) === "s") {
-			const pluralessModel = model.slice(0, -1);
-			let m = schema[pluralessModel] ? pluralessModel : void 0;
-			if (!m) m = Object.entries(schema).find(([_, f]) => f.modelName === pluralessModel)?.[0];
+			const m = resolve(model.slice(0, -1));
 			if (m) return m;
 		}
-		let m = schema[model] ? model : void 0;
-		if (!m) m = Object.entries(schema).find(([_, f]) => f.modelName === model)?.[0];
+		const m = resolve(model);
 		if (!m) throw new BetterAuthError(`Model "${model}" not found in schema`);
@@ -26,0 +27,0 @@ return m;

dist/db/adapter/get-field-attributes.d.mts

 import { BetterAuthDBSchema, DBFieldAttribute, DBFieldType } from "../type.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../index.mjs";
+import "../../types/index.mjs";
 //#region src/db/adapter/get-field-attributes.d.ts
-declare const initGetFieldAttributes: ({
-  usePlural,
-  schema,
-  options,
-  customIdGenerator,
-  disableIdGeneration
-}: {
+declare const initGetFieldAttributes: ({ usePlural, schema, options, customIdGenerator, disableIdGeneration }: {
   usePlural?: boolean;
@@ -18,6 +14,3 @@ schema: BetterAuthDBSchema;
   }) => string) | undefined;
-}) => ({
-  model,
-  field
-}: {
+}) => ({ model, field }: {
   model: string;
@@ -24,0 +17,0 @@ field: string;

dist/db/adapter/get-field-name.d.mts

 import { BetterAuthDBSchema } from "../type.mjs";
-
 //#region src/db/adapter/get-field-name.d.ts
-declare const initGetFieldName: ({
-  schema,
-  usePlural
-}: {
+declare const initGetFieldName: ({ schema, usePlural }: {
   schema: BetterAuthDBSchema;
   usePlural: boolean | undefined;
-}) => ({
-  model: modelName,
-  field: fieldName
-}: {
+}) => ({ model: modelName, field: fieldName }: {
   model: string;
@@ -15,0 +8,0 @@ field: string;

dist/db/adapter/get-id-field.d.mts

 import { BetterAuthDBSchema, DBPrimitive } from "../type.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../index.mjs";
+import "../../types/index.mjs";
 //#region src/db/adapter/get-id-field.d.ts
-declare const initGetIdField: ({
-  usePlural,
-  schema,
-  disableIdGeneration,
-  options,
-  customIdGenerator,
-  supportsUUIDs
-}: {
+declare const initGetIdField: ({ usePlural, schema, disableIdGeneration, options, customIdGenerator, supportsUUIDs }: {
   usePlural?: boolean;
@@ -20,6 +15,3 @@ schema: BetterAuthDBSchema;
   supportsUUIDs?: boolean;
-}) => ({
-  customModelName,
-  forceAllowId
-}: {
+}) => ({ customModelName, forceAllowId }: {
   customModelName?: string;
@@ -26,0 +18,0 @@ forceAllowId?: boolean;

dist/db/adapter/get-model-name.d.mts

 import { BetterAuthDBSchema } from "../type.mjs";
-
 //#region src/db/adapter/get-model-name.d.ts
-declare const initGetModelName: ({
-  usePlural,
-  schema
-}: {
+declare const initGetModelName: ({ usePlural, schema }: {
   usePlural: boolean | undefined;
@@ -9,0 +5,0 @@ schema: BetterAuthDBSchema;

dist/db/adapter/index.d.mts

@@ -12,2 +12,3 @@ import { BetterAuthDBSchema, DBFieldAttribute } from "../type.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 //#region src/db/adapter/index.d.ts
@@ -494,7 +495,3 @@ type DBAdapterDebugLogOption = boolean | {
 interface CustomAdapter {
-  create: <T extends Record<string, any>>({
-    data,
-    model,
-    select
-  }: {
+  create: <T extends Record<string, any>>({ data, model, select }: {
     model: string;
@@ -514,8 +511,3 @@ data: T;
   }) => Promise<number>;
-  findOne: <T>({
-    model,
-    where,
-    select,
-    join
-  }: {
+  findOne: <T>({ model, where, select, join }: {
     model: string;
@@ -526,11 +518,3 @@ where: CleanedWhere[];
   }) => Promise<T | null>;
-  findMany: <T>({
-    model,
-    where,
-    limit,
-    select,
-    sortBy,
-    offset,
-    join
-  }: {
+  findMany: <T>({ model, where, limit, select, sortBy, offset, join }: {
     model: string;
@@ -547,13 +531,7 @@ where?: CleanedWhere[] | undefined;
   }) => Promise<T[]>;
-  delete: ({
-    model,
-    where
-  }: {
+  delete: ({ model, where }: {
     model: string;
     where: CleanedWhere[];
   }) => Promise<void>;
-  deleteMany: ({
-    model,
-    where
-  }: {
+  deleteMany: ({ model, where }: {
     model: string;
@@ -594,6 +572,3 @@ where: CleanedWhere[];
   }) => Promise<T | null>;
-  count: ({
-    model,
-    where
-  }: {
+  count: ({ model, where }: {
     model: string;
@@ -600,0 +575,0 @@ where?: CleanedWhere[] | undefined;

dist/db/adapter/types.d.mts

 import { BetterAuthDBSchema, DBFieldAttribute } from "../type.mjs";
 import { CleanedWhere, CustomAdapter, DBAdapterFactoryConfig, DBTransactionAdapter, JoinConfig, Where } from "./index.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 //#region src/db/adapter/types.d.ts
@@ -38,6 +39,3 @@ type AdapterFactoryOptions = {
    */
-  getFieldName: ({
-    model,
-    field
-  }: {
+  getFieldName: ({ model, field }: {
     model: string;
@@ -70,6 +68,3 @@ field: string;
    */
-  getDefaultFieldName: ({
-    model,
-    field
-  }: {
+  getDefaultFieldName: ({ model, field }: {
     model: string;
@@ -83,6 +78,3 @@ field: string;
    */
-  getFieldAttributes: ({
-    model,
-    field
-  }: {
+  getFieldAttributes: ({ model, field }: {
     model: string;
@@ -93,7 +85,3 @@ field: string;
   transformOutput: (data: Record<string, unknown>, defaultModelName: string, select?: string[] | undefined, joinConfig?: JoinConfig | undefined) => Promise<Record<string, unknown>>;
-  transformWhereClause: <W extends Where[] | undefined>({
-    model,
-    where,
-    action
-  }: {
+  transformWhereClause: <W extends Where[] | undefined>({ model, where, action }: {
     where: W;
@@ -100,0 +88,0 @@ model: string;

dist/db/adapter/utils.d.mts

 import { DBFieldAttribute } from "../type.mjs";
-
 //#region src/db/adapter/utils.d.ts
@@ -4,0 +3,0 @@ declare function withApplyDefault(value: any, field: DBFieldAttribute, action: "create" | "update" | "findOne" | "findMany"): any;

dist/db/get-tables.d.mts

 import { BetterAuthDBSchema } from "./type.mjs";
 import { BetterAuthOptions } from "../types/init-options.mjs";
+import "../types/index.mjs";
 //#region src/db/get-tables.d.ts
@@ -4,0 +5,0 @@ declare const getAuthTables: (options: BetterAuthOptions) => BetterAuthDBSchema;

dist/db/get-tables.mjs

@@ -118,3 +118,3 @@ //#region src/db/get-tables.ts
 				references: {
-					model: options.user?.modelName || "user",
+					model: "user",
 					field: "id",
@@ -195,3 +195,3 @@ onDelete: "cascade"
 					references: {
-						model: options.user?.modelName || "user",
+						model: "user",
 						field: "id",
@@ -198,0 +198,0 @@ onDelete: "cascade"

dist/db/plugin.d.mts

 import { DBFieldAttribute } from "./type.mjs";
-
 //#region src/db/plugin.d.ts
@@ -10,4 +9,4 @@ type BetterAuthPluginDBSchema = { [table in string]: {
   modelName?: string | undefined;
-} };
+}; };
 //#endregion
 export { BetterAuthPluginDBSchema };

dist/db/schema/account.d.mts

 import { InferDBFieldsFromOptions, InferDBFieldsFromPlugins } from "../type.mjs";
 import { Prettify } from "../../types/helper.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 import * as z from "zod";
-
 //#region src/db/schema/account.d.ts
@@ -7,0 +7,0 @@ declare const accountSchema: z.ZodObject<{

dist/db/schema/account.mjs

@@ -11,5 +11,17 @@ import { coreSchema } from "./shared.mjs";
 	idToken: z.string().nullish(),
+	/**
+	* Access token expires at
+	*/
 	accessTokenExpiresAt: z.date().nullish(),
+	/**
+	* Refresh token expires at
+	*/
 	refreshTokenExpiresAt: z.date().nullish(),
+	/**
+	* The scopes that the user has authorized
+	*/
 	scope: z.string().nullish(),
+	/**
+	* Password is only stored in the credential provider
+	*/
 	password: z.string().nullish()
@@ -16,0 +28,0 @@ });

dist/db/schema/rate-limit.d.mts

 import { InferDBFieldsFromOptions, InferDBFieldsFromPlugins } from "../type.mjs";
 import { Prettify } from "../../types/helper.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 import * as z from "zod";
-
 //#region src/db/schema/rate-limit.d.ts
@@ -7,0 +7,0 @@ declare const rateLimitSchema: z.ZodObject<{

dist/db/schema/rate-limit.mjs

 import * as z from "zod";
 //#region src/db/schema/rate-limit.ts
 const rateLimitSchema = z.object({
+	/**
+	* The key to use for rate limiting
+	*/
 	key: z.string(),
+	/**
+	* The number of requests made
+	*/
 	count: z.number(),
+	/**
+	* The last request time in milliseconds
+	*/
 	lastRequest: z.number()
@@ -7,0 +16,0 @@ });

dist/db/schema/session.d.mts

 import { InferDBFieldsFromOptions, InferDBFieldsFromPlugins } from "../type.mjs";
 import { Prettify } from "../../types/helper.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 import * as z from "zod";
-
 //#region src/db/schema/session.d.ts
@@ -7,0 +7,0 @@ declare const sessionSchema: z.ZodObject<{

dist/db/schema/shared.d.mts

 import * as z from "zod";
-
 //#region src/db/schema/shared.d.ts
@@ -4,0 +3,0 @@ declare const coreSchema: z.ZodObject<{

dist/db/schema/user.d.mts

 import { InferDBFieldsFromOptions, InferDBFieldsFromPlugins } from "../type.mjs";
 import { Prettify } from "../../types/helper.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 import * as z from "zod";
-
 //#region src/db/schema/user.d.ts
@@ -7,0 +7,0 @@ declare const userSchema: z.ZodObject<{

dist/db/schema/verification.d.mts

 import { InferDBFieldsFromOptions, InferDBFieldsFromPlugins } from "../type.mjs";
 import { Prettify } from "../../types/helper.mjs";
 import { BetterAuthOptions } from "../../types/init-options.mjs";
+import "../../types/index.mjs";
 import * as z from "zod";
-
 //#region src/db/schema/verification.d.ts
@@ -7,0 +7,0 @@ declare const verificationSchema: z.ZodObject<{

dist/db/type.d.mts

 import { Awaitable, LiteralString, UnionToIntersection } from "../types/helper.mjs";
 import { BetterAuthOptions } from "../types/init-options.mjs";
+import "../types/index.mjs";
 import { StandardSchemaV1 } from "@standard-schema/spec";
-
 //#region src/db/type.d.ts
@@ -11,4 +11,4 @@ type BaseModelNames = "user" | "account" | "session" | "verification";
 type InferDBFieldInput<T extends DBFieldAttribute> = InferDBValueType<T["type"]>;
-type InferDBFieldsInput<Field> = Field extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Field[key]["required"] extends false ? never : Field[key]["defaultValue"] extends string | number | boolean | Date ? never : Field[key]["input"] extends false ? never : key]: InferDBFieldInput<Field[key]> } & { [key in Key as Field[key]["input"] extends false ? never : key]?: InferDBFieldInput<Field[key]> | undefined | null } : {};
-type InferDBFieldsOutput<Fields extends Record<string, DBFieldAttribute>> = Fields extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? key : never : key]: InferDBFieldOutput<Fields[key]> } & { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? never : key : never]?: InferDBFieldOutput<Fields[key]> | null } : never;
+type InferDBFieldsInput<Field> = Field extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Field[key]["required"] extends false ? never : Field[key]["defaultValue"] extends string | number | boolean | Date ? never : Field[key]["input"] extends false ? never : key]: InferDBFieldInput<Field[key]>; } & { [key in Key as Field[key]["input"] extends false ? never : key]?: InferDBFieldInput<Field[key]> | undefined | null; } : {};
+type InferDBFieldsOutput<Fields extends Record<string, DBFieldAttribute>> = Fields extends Record<infer Key, DBFieldAttribute> ? { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? key : never : key]: InferDBFieldOutput<Fields[key]>; } & { [key in Key as Fields[key]["returned"] extends false ? never : Fields[key]["required"] extends false ? Fields[key]["defaultValue"] extends boolean | string | number | Date ? never : key : never]?: InferDBFieldOutput<Fields[key]> | null; } : never;
 type InferDBFieldsFromOptionsInput<DBOptions extends BetterAuthOptions["session"] | BetterAuthOptions["user"] | BetterAuthOptions["verification"] | BetterAuthOptions["account"] | BetterAuthOptions["rateLimit"]> = DBOptions extends {
@@ -23,3 +23,3 @@ additionalFields: Record<string, DBFieldAttribute>;
     fields: infer Fields;
-  } };
+  }; };
 } ? Fields extends Record<string, DBFieldAttribute> ? UnionToIntersection<InferDBFieldsInput<Fields> & InferDBFieldsFromPluginsInput<ModelName, Rest>> : InferDBFieldsFromPluginsInput<ModelName, Rest> : InferDBFieldsFromPluginsInput<ModelName, Rest> : {};
@@ -29,3 +29,3 @@ type InferDBFieldsFromPlugins<ModelName extends string, Plugins extends unknown[] | undefined> = Plugins extends [] ? {} : Plugins extends [infer P, ...infer Rest] ? P extends {
     fields: infer Fields;
-  } };
+  }; };
 } ? Fields extends Record<string, DBFieldAttribute> ? UnionToIntersection<InferDBFieldsOutput<Fields> & InferDBFieldsFromPlugins<ModelName, Rest>> : InferDBFieldsFromPlugins<ModelName, Rest> : InferDBFieldsFromPlugins<ModelName, Rest> : {};
@@ -178,3 +178,2 @@ type DBFieldType = "string" | "number" | "boolean" | "date" | "json" | `${"string" | "number"}[]` | Array<LiteralString>;
    */
-
   key: string,
@@ -184,3 +183,2 @@ /**
    */
-
   value: string,
@@ -190,3 +188,2 @@ /**
    */
-
   ttl?: number | undefined) => Awaitable<void | null | unknown>;
@@ -193,0 +190,0 @@ /**

dist/env/logger.d.mts

 //#region src/env/logger.d.ts
 declare const TTY_COLORS: {
-  readonly reset: "\u001B[0m";
-  readonly bright: "\u001B[1m";
-  readonly dim: "\u001B[2m";
-  readonly undim: "\u001B[22m";
-  readonly underscore: "\u001B[4m";
-  readonly blink: "\u001B[5m";
-  readonly reverse: "\u001B[7m";
-  readonly hidden: "\u001B[8m";
+  readonly reset: "";
+  readonly bright: "";
+  readonly dim: "";
+  readonly undim: "";
+  readonly underscore: "";
+  readonly blink: "";
+  readonly reverse: "";
+  readonly hidden: "";
   readonly fg: {
-    readonly black: "\u001B[30m";
-    readonly red: "\u001B[31m";
-    readonly green: "\u001B[32m";
-    readonly yellow: "\u001B[33m";
-    readonly blue: "\u001B[34m";
-    readonly magenta: "\u001B[35m";
-    readonly cyan: "\u001B[36m";
-    readonly white: "\u001B[37m";
+    readonly black: "";
+    readonly red: "";
+    readonly green: "";
+    readonly yellow: "";
+    readonly blue: "";
+    readonly magenta: "";
+    readonly cyan: "";
+    readonly white: "";
   };
   readonly bg: {
-    readonly black: "\u001B[40m";
-    readonly red: "\u001B[41m";
-    readonly green: "\u001B[42m";
-    readonly yellow: "\u001B[43m";
-    readonly blue: "\u001B[44m";
-    readonly magenta: "\u001B[45m";
-    readonly cyan: "\u001B[46m";
-    readonly white: "\u001B[47m";
+    readonly black: "";
+    readonly red: "";
+    readonly green: "";
+    readonly yellow: "";
+    readonly blue: "";
+    readonly magenta: "";
+    readonly cyan: "";
+    readonly white: "";
   };
@@ -42,3 +42,3 @@ };
 type LogHandlerParams = Parameters<NonNullable<Logger["log"]>> extends [LogLevel, ...infer Rest] ? Rest : never;
-type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void } & {
+type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void; } & {
   get level(): LogLevel;
@@ -45,0 +45,0 @@ };

dist/error/codes.d.mts

 import { RawError } from "../utils/error-codes.mjs";
-
 //#region src/error/codes.d.ts
@@ -4,0 +3,0 @@ declare module "@better-auth/core" {

dist/error/index.d.mts

 import { APIErrorCode, BASE_ERROR_CODES } from "./codes.mjs";
 import { APIError as APIError$1 } from "better-call/error";
-
 //#region src/error/index.d.ts
@@ -5,0 +4,0 @@ declare class BetterAuthError extends Error {

dist/index.d.mts

@@ -9,2 +9,2 @@ import { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection } from "./types/helper.mjs";
 import { StandardSchemaV1 } from "./types/index.mjs";
-export { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };

dist/instrumentation/attributes.d.mts

 import { ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE } from "@opentelemetry/semantic-conventions";
-
 //#region src/instrumentation/attributes.d.ts
@@ -4,0 +3,0 @@ /** Operation identifier (e.g. getSession, signUpWithEmailAndPassword). Uses endpoint operationId when set, otherwise the endpoint key. */

dist/instrumentation/pure.index.d.mts

 import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_DB_OPERATION_NAME, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID } from "./attributes.mjs";
-
 //#region src/instrumentation/pure.index.d.ts
@@ -4,0 +3,0 @@ declare function withSpan<T>(name: string, attributes: Record<string, string | number | boolean>, fn: () => T): T;

dist/instrumentation/tracer.mjs

@@ -5,3 +5,3 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.6.23";
+const INSTRUMENTATION_VERSION = "1.6.24";
 /**
@@ -8,0 +8,0 @@ * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth

dist/oauth2/client-credentials-token.d.mts

 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-
 //#region src/oauth2/client-credentials-token.d.ts
-declare function clientCredentialsTokenRequest({
-  options,
-  scope,
-  authentication,
-  resource
-}: {
+declare function clientCredentialsTokenRequest({ options, scope, authentication, resource }: {
   options: AwaitableFunction<ProviderOptions & {
@@ -24,8 +19,3 @@ clientSecret: string;
  */
-declare function createClientCredentialsTokenRequest({
-  options,
-  scope,
-  authentication,
-  resource
-}: {
+declare function createClientCredentialsTokenRequest({ options, scope, authentication, resource }: {
   options: ProviderOptions & {
@@ -41,9 +31,3 @@ clientSecret: string;
 };
-declare function clientCredentialsToken({
-  options,
-  tokenEndpoint,
-  scope,
-  authentication,
-  resource
-}: {
+declare function clientCredentialsToken({ options, tokenEndpoint, scope, authentication, resource }: {
   options: AwaitableFunction<ProviderOptions & {
@@ -50,0 +34,0 @@ clientSecret: string;

dist/oauth2/client-credentials-token.mjs

@@ -57,6 +57,3 @@ import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 	};
-	if (data.expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
-	}
+	if (data.expires_in) tokens.accessTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.expires_in * 1e3);
 	return tokens;
@@ -63,0 +60,0 @@ }

dist/oauth2/create-authorization-url.d.mts

 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { ProviderOptions } from "./oauth-provider.mjs";
+import "./index.mjs";
 //#region src/oauth2/create-authorization-url.d.ts
-declare function createAuthorizationURL({
-  id,
-  options,
-  authorizationEndpoint,
-  state,
-  codeVerifier,
-  scopes,
-  claims,
-  redirectURI,
-  duration,
-  prompt,
-  accessType,
-  responseType,
-  display,
-  loginHint,
-  hd,
-  responseMode,
-  additionalParams,
-  scopeJoiner
-}: {
+declare function createAuthorizationURL({ id, options, authorizationEndpoint, state, codeVerifier, scopes, claims, redirectURI, duration, prompt, accessType, responseType, display, loginHint, hd, responseMode, additionalParams, scopeJoiner }: {
   id: string;
@@ -25,0 +8,0 @@ options: AwaitableFunction<ProviderOptions>;

dist/oauth2/oauth-provider.d.mts

 import { Awaitable, LiteralString } from "../types/helper.mjs";
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 //#region src/oauth2/oauth-provider.d.ts
@@ -66,5 +68,6 @@ interface OAuth2Tokens {
    * @param nonce - The nonce
+   * @param ctx - Request endpoint context (headers via `ctx.headers`)
    * @returns True if the id token is valid, false otherwise
    */
-  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  verifyIdToken?: ((token: string, nonce?: string, ctx?: GenericEndpointContext) => Promise<boolean>) | undefined;
   /**
@@ -127,5 +130,8 @@ * Disable implicit sign up for new users. When set to true for the provider,
   /**
-   * verifyIdToken function to verify the id token
+   * Custom function to verify the id token.
+   * @param token - The id token
+   * @param nonce - The nonce
+   * @param ctx - Request endpoint context (headers via `ctx.headers`)
    */
-  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  verifyIdToken?: ((token: string, nonce?: string, ctx?: GenericEndpointContext) => Promise<boolean>) | undefined;
   /**
@@ -132,0 +138,0 @@ * Custom function to get user info from the provider

dist/oauth2/refresh-access-token.d.mts

 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-
 //#region src/oauth2/refresh-access-token.d.ts
-declare function refreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  extraParams,
-  resource
-}: {
+declare function refreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }: {
   refreshToken: string;
@@ -24,9 +18,3 @@ options: AwaitableFunction<Partial<ProviderOptions>>;
  */
-declare function createRefreshAccessTokenRequest({
-  refreshToken,
-  options,
-  authentication,
-  extraParams,
-  resource
-}: {
+declare function createRefreshAccessTokenRequest({ refreshToken, options, authentication, extraParams, resource }: {
   refreshToken: string;
@@ -41,9 +29,3 @@ options: ProviderOptions;
 };
-declare function refreshAccessToken({
-  refreshToken,
-  options,
-  tokenEndpoint,
-  authentication,
-  extraParams
-}: {
+declare function refreshAccessToken({ refreshToken, options, tokenEndpoint, authentication, extraParams }: {
   refreshToken: string;
@@ -50,0 +32,0 @@ options: Partial<ProviderOptions>;

dist/oauth2/refresh-access-token.mjs

@@ -62,10 +62,4 @@ import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 	};
-	if (data.expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.accessTokenExpiresAt = new Date(now.getTime() + data.expires_in * 1e3);
-	}
-	if (data.refresh_token_expires_in) {
-		const now = /* @__PURE__ */ new Date();
-		tokens.refreshTokenExpiresAt = new Date(now.getTime() + data.refresh_token_expires_in * 1e3);
-	}
+	if (data.expires_in) tokens.accessTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.expires_in * 1e3);
+	if (data.refresh_token_expires_in) tokens.refreshTokenExpiresAt = new Date((/* @__PURE__ */ new Date()).getTime() + data.refresh_token_expires_in * 1e3);
 	return tokens;
@@ -72,0 +66,0 @@ }

dist/oauth2/reject-redirects.mjs

 import { BetterAuthError } from "../error/index.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/reject-redirects.ts
-const HTTP_REDIRECT_STATUSES = new Set([
+const HTTP_REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	301,
@@ -6,0 +6,0 @@ 302,

dist/oauth2/utils.d.mts

 import { OAuth2Tokens } from "./oauth-provider.mjs";
-
 //#region src/oauth2/utils.d.ts
@@ -4,0 +3,0 @@ declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;

dist/oauth2/utils.mjs

@@ -5,4 +5,3 @@ import { base64Url } from "@better-auth/utils/base64";
 	const getDate = (seconds) => {
-		const now = /* @__PURE__ */ new Date();
-		return new Date(now.getTime() + seconds * 1e3);
+		return new Date((/* @__PURE__ */ new Date()).getTime() + seconds * 1e3);
 	};
@@ -9,0 +8,0 @@ return {

dist/oauth2/validate-authorization-code.d.mts

 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "./oauth-provider.mjs";
-import * as jose from "jose";
-
+import "./index.mjs";
 //#region src/oauth2/validate-authorization-code.d.ts
-declare function authorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
+declare function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams, resource }: {
   code: string;
@@ -33,13 +23,3 @@ redirectURI: string;
  */
-declare function createAuthorizationCodeRequest({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
+declare function createAuthorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams, resource }: {
   code: string;
@@ -58,14 +38,3 @@ redirectURI: string;
 };
-declare function validateAuthorizationCode({
-  code,
-  codeVerifier,
-  redirectURI,
-  options,
-  tokenEndpoint,
-  authentication,
-  deviceId,
-  headers,
-  additionalParams,
-  resource
-}: {
+declare function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, deviceId, headers, additionalParams, resource }: {
   code: string;
@@ -85,4 +54,4 @@ redirectURI: string;
   issuer?: string | string[];
-}): Promise<jose.JWTVerifyResult<jose.JWTPayload> & jose.ResolvedKey>;
+}): Promise<import("jose").JWTVerifyResult<import("jose").JWTPayload> & import("jose").ResolvedKey>;
 //#endregion
 export { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken };

dist/oauth2/verify.d.mts

 import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
-
 //#region src/oauth2/verify.d.ts
 type JwksFetchOptions = {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
+  /** Jwks url or promise of a Jwks */
+  jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
   /**
@@ -13,5 +13,2 @@ * Stable object to cache the result of a function `jwksFetch` under,
 };
-/**
- * @internal
- */
 interface VerifyAccessTokenRemote {
@@ -51,3 +48,4 @@ /** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
 declare function verifyJwsAccessToken(token: string, opts: JwksFetchOptions & {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Verify options */
+  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
 }): Promise<JWTPayload>;
@@ -61,8 +59,12 @@ declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWebKeySet>;
 declare function verifyAccessToken(token: string, opts: {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>; /** Scopes to additionally verify. Token must include all but not exact. */
-  scopes?: string[]; /** Required to verify access token locally */
-  jwksUrl?: string; /** If provided, can verify a token remotely */
+  /** Verify options */
+  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Scopes to additionally verify. Token must include all but not exact. */
+  scopes?: string[];
+  /** Required to verify access token locally */
+  jwksUrl?: string;
+  /** If provided, can verify a token remotely */
   remoteVerify?: VerifyAccessTokenRemote;
 }): Promise<JWTPayload>;
 //#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };
+export { VerifyAccessTokenRemote, getJwks, verifyAccessToken, verifyJwsAccessToken };

dist/oauth2/verify.mjs

@@ -6,3 +6,3 @@ import { logger } from "../env/logger.mjs";
 //#region src/oauth2/verify.ts
-const joseInfrastructureErrorCodes = new Set([
+const joseInfrastructureErrorCodes = /* @__PURE__ */ new Set([
 	errors.JWKSTimeout.code,
@@ -203,2 +203,2 @@ errors.JWKSInvalid.code,
 //#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };
+export { getJwks, jwksCache, verifyAccessToken, verifyJwsAccessToken };

dist/social-providers/apple.d.mts

@@ -0,2 +1,5 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/apple.d.ts
@@ -70,7 +73,3 @@ interface AppleProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -83,7 +82,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -94,23 +89,7 @@ redirectURI: string;
   }) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
     user?: {
-      name /**
-            * An Integer value that indicates whether the user appears to be a real
-            * person. Use the value of this claim to mitigate fraud. The possible
-            * values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal). For
-            * more information, see ASUserDetectionStatus. This claim is present only
-            * in iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14
-            * and later. The claim isn’t present or supported for web-based apps.
-            */?
-      /**
-      * An Integer value that indicates whether the user appears to be a real
-      * person. Use the value of this claim to mitigate fraud. The possible
-      * values are: 0 (or Unsupported), 1 (or Unknown), 2 (or LikelyReal). For
-      * more information, see ASUserDetectionStatus. This claim is present only
-      * in iOS 14 and later, macOS 11 and later, watchOS 7 and later, tvOS 14
-      * and later. The claim isn’t present or supported for web-based apps.
-      */
-      : {
+      name?: {
         firstName?: string;
@@ -117,0 +96,0 @@ lastName?: string;

dist/social-providers/apple.mjs

@@ -53,5 +53,5 @@ import { APIError, BetterAuthError } from "../error/index.mjs";
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			try {
@@ -58,0 +58,0 @@ const { kid, alg: jwtAlg } = decodeProtectedHeader(token);

dist/social-providers/atlassian.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/atlassian.d.ts
@@ -24,8 +25,3 @@ interface AtlassianProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -38,7 +34,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -45,0 +37,0 @@ redirectURI: string;

dist/social-providers/cognito.d.mts

@@ -0,2 +1,5 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/cognito.d.ts
@@ -37,8 +40,3 @@ interface CognitoProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -51,7 +49,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -63,3 +57,3 @@ redirectURI: string;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   getUserInfo(token: OAuth2Tokens & {
@@ -66,0 +60,0 @@ user?: {

dist/social-providers/cognito.mjs

@@ -78,5 +78,5 @@ import { APIError, BetterAuthError } from "../error/index.mjs";
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			try {
@@ -83,0 +83,0 @@ const { kid, alg: jwtAlg } = decodeProtectedHeader(token);

dist/social-providers/discord.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/discord.d.ts
@@ -80,7 +81,3 @@ interface DiscordProfile extends Record<string, any> {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -93,6 +90,3 @@ codeVerifier: string;
   }): URL;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -99,0 +93,0 @@ redirectURI: string;

dist/social-providers/dropbox.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/dropbox.d.ts
@@ -23,8 +24,3 @@ interface DropboxProfile {
   name: string;
-  createAuthorizationURL: ({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL: ({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -37,7 +33,3 @@ codeVerifier: string;
   }) => Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -44,0 +36,0 @@ redirectURI: string;

dist/social-providers/facebook.d.mts

@@ -0,2 +1,5 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/facebook.d.ts
@@ -33,8 +36,3 @@ interface FacebookProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    loginHint
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI, loginHint }: {
     state: string;
@@ -47,6 +45,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -57,3 +52,3 @@ redirectURI: string;
   }) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
@@ -60,0 +55,0 @@ getUserInfo(token: OAuth2Tokens & {

dist/social-providers/facebook.mjs

@@ -69,5 +69,5 @@ import { BetterAuthError } from "../error/index.mjs";
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			if (token.split(".").length === 3) try {
@@ -74,0 +74,0 @@ const { payload: jwtClaims } = await jwtVerify(token, createRemoteJWKSet(new URL("https://limited.facebook.com/.well-known/oauth/openid/jwks/")), {

dist/social-providers/figma.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/figma.d.ts
@@ -15,8 +16,3 @@ interface FigmaProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -29,7 +25,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -36,0 +28,0 @@ redirectURI: string;

dist/social-providers/github.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/github.d.ts
@@ -55,9 +56,3 @@ interface GithubProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    loginHint,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, loginHint, codeVerifier, redirectURI }: {
     state: string;
@@ -70,7 +65,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -77,0 +68,0 @@ redirectURI: string;

dist/social-providers/gitlab.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/gitlab.d.ts
@@ -55,9 +56,3 @@ interface GitlabProfile extends Record<string, any> {
   name: string;
-  createAuthorizationURL: ({
-    state,
-    scopes,
-    codeVerifier,
-    loginHint,
-    redirectURI
-  }: {
+  createAuthorizationURL: ({ state, scopes, codeVerifier, loginHint, redirectURI }: {
     state: string;
@@ -70,7 +65,3 @@ codeVerifier: string;
   }) => Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI,
-    codeVerifier
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI, codeVerifier }: {
     code: string;
@@ -77,0 +68,0 @@ redirectURI: string;

dist/social-providers/google.d.mts

@@ -0,4 +1,6 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 import { JWTPayload } from "jose";
-
 //#region src/social-providers/google.d.ts
@@ -60,7 +62,3 @@ interface GoogleProfile {
  */
-declare const verifyGoogleIdToken: ({
-  token,
-  audience,
-  nonce
-}: VerifyGoogleIdTokenOptions) => Promise<JWTPayload | null>;
+declare const verifyGoogleIdToken: ({ token, audience, nonce }: VerifyGoogleIdTokenOptions) => Promise<JWTPayload | null>;
 /**
@@ -74,10 +72,3 @@ * Checks whether Google's verified `hd` claim satisfies the configured hosted
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    loginHint,
-    display
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, display }: {
     state: string;
@@ -90,7 +81,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -102,3 +89,3 @@ redirectURI: string;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   getUserInfo(token: OAuth2Tokens & {
@@ -105,0 +92,0 @@ user?: {

dist/social-providers/google.mjs

@@ -94,5 +94,5 @@ import { APIError, BetterAuthError } from "../error/index.mjs";
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			const jwtClaims = await verifyGoogleIdToken({
@@ -99,0 +99,0 @@ token,

dist/social-providers/huggingface.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/huggingface.d.ts
@@ -37,8 +38,3 @@ interface HuggingFaceProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -51,7 +47,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -58,0 +50,0 @@ redirectURI: string;

dist/social-providers/index.d.mts

@@ -37,5 +37,6 @@ import { AppleNonConformUser, AppleOptions, AppleProfile, apple, getApplePublicKey } from "./apple.mjs";
 import { AwaitableFunction } from "../types/helper.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 import * as z from "zod";
-
 //#region src/social-providers/index.d.ts
@@ -46,7 +47,3 @@ declare const socialProviders: {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -59,7 +56,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -70,3 +63,3 @@ redirectURI: string;
     }) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    verifyIdToken(token: string, nonce?: string, ctx?: import("@better-auth/core").GenericEndpointContext): Promise<boolean>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
@@ -97,8 +90,3 @@ getUserInfo(token: OAuth2Tokens & {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -111,7 +99,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -147,8 +131,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -161,7 +140,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -173,3 +148,3 @@ redirectURI: string;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    verifyIdToken(token: string, nonce?: string, ctx?: import("@better-auth/core").GenericEndpointContext): Promise<boolean>;
     getUserInfo(token: OAuth2Tokens & {
@@ -199,7 +174,3 @@ user?: {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -212,6 +183,3 @@ codeVerifier: string;
     }): URL;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -247,8 +215,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI,
-      loginHint
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI, loginHint }: {
       state: string;
@@ -261,6 +224,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -271,3 +231,3 @@ redirectURI: string;
     }) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    verifyIdToken(token: string, nonce?: string, ctx?: import("@better-auth/core").GenericEndpointContext): Promise<boolean>;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
@@ -298,8 +258,3 @@ getUserInfo(token: OAuth2Tokens & {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -312,7 +267,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -348,9 +299,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      loginHint,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, loginHint, codeVerifier, redirectURI }: {
       state: string;
@@ -363,7 +308,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -407,7 +348,3 @@ redirectURI: string;
     }): Promise<URL>;
-    validateAuthorizationCode({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -418,3 +355,3 @@ redirectURI: string;
     }): Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    verifyIdToken(token: string, nonce?: string, ctx?: import("@better-auth/core").GenericEndpointContext): Promise<boolean>;
     getUserInfo(token: OAuth2Tokens & {
@@ -445,10 +382,3 @@ user?: {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI,
-      loginHint,
-      display
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint, display }: {
       state: string;
@@ -461,7 +391,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -473,3 +399,3 @@ redirectURI: string;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    verifyIdToken(token: string, nonce?: string, ctx?: import("@better-auth/core").GenericEndpointContext): Promise<boolean>;
     getUserInfo(token: OAuth2Tokens & {
@@ -499,8 +425,3 @@ user?: {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -513,7 +434,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -549,7 +466,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -562,6 +475,3 @@ codeVerifier: string;
     }): URL;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -597,8 +507,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -611,7 +516,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -647,7 +548,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -660,6 +557,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -703,7 +597,3 @@ redirectURI: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -739,8 +629,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL: ({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL: ({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -753,7 +638,3 @@ codeVerifier: string;
     }) => Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -789,8 +670,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI,
-      codeVerifier
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI, codeVerifier }: {
       state: string;
@@ -803,7 +679,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode({
-      code,
-      redirectURI,
-      codeVerifier
-    }: {
+    validateAuthorizationCode({ code, redirectURI, codeVerifier }: {
       code: string;
@@ -839,8 +711,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      loginHint,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, loginHint, redirectURI }: {
       state: string;
@@ -853,6 +720,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -888,8 +752,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL: ({
-      state,
-      scopes,
-      redirectURI,
-      loginHint
-    }: {
+    createAuthorizationURL: ({ state, scopes, redirectURI, loginHint }: {
       state: string;
@@ -902,6 +761,3 @@ codeVerifier: string;
     }) => Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -937,9 +793,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL: ({
-      state,
-      scopes,
-      codeVerifier,
-      loginHint,
-      redirectURI
-    }: {
+    createAuthorizationURL: ({ state, scopes, codeVerifier, loginHint, redirectURI }: {
       state: string;
@@ -952,7 +802,3 @@ codeVerifier: string;
     }) => Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI,
-      codeVerifier
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI, codeVerifier }: {
       code: string;
@@ -1009,7 +855,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -1022,6 +864,3 @@ codeVerifier: string;
     }): URL;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -1057,7 +896,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -1070,6 +905,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -1105,7 +937,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -1118,6 +946,3 @@ codeVerifier: string;
     }): URL;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -1153,8 +978,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -1167,7 +987,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -1203,8 +1019,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -1217,8 +1028,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI,
-      deviceId
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI, deviceId }: {
       code: string;
@@ -1254,7 +1060,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL: ({
-      state,
-      redirectURI,
-      codeVerifier
-    }: {
+    createAuthorizationURL: ({ state, redirectURI, codeVerifier }: {
       state: string;
@@ -1267,7 +1069,3 @@ codeVerifier: string;
     }) => Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI,
-      codeVerifier
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI, codeVerifier }: {
       code: string;
@@ -1302,8 +1100,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      loginHint,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, loginHint, redirectURI }: {
       state: string;
@@ -1316,6 +1109,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -1351,7 +1141,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -1364,6 +1150,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -1420,7 +1203,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -1433,6 +1212,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -1489,9 +1265,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI,
-      loginHint
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint }: {
       state: string;
@@ -1504,7 +1274,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -1516,3 +1282,3 @@ redirectURI: string;
     refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    verifyIdToken(token: string, nonce?: string, ctx?: import("@better-auth/core").GenericEndpointContext): Promise<boolean>;
     getUserInfo(token: OAuth2Tokens & {
@@ -1563,9 +1329,3 @@ user?: {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI,
-      loginHint
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint }: {
       state: string;
@@ -1578,7 +1338,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -1614,7 +1370,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, codeVerifier, redirectURI }: {
       state: string;
@@ -1627,6 +1379,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, redirectURI }: {
       code: string;
@@ -1647,3 +1396,3 @@ redirectURI: string;
     }>);
-    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    verifyIdToken(token: string, nonce?: string, ctx?: import("@better-auth/core").GenericEndpointContext): Promise<boolean>;
     getUserInfo(token: OAuth2Tokens & {
@@ -1694,8 +1443,3 @@ user?: {
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -1708,7 +1452,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -1744,8 +1484,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -1758,7 +1493,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -1794,8 +1525,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      codeVerifier,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
       state: string;
@@ -1808,7 +1534,3 @@ codeVerifier: string;
     }): Promise<URL>;
-    validateAuthorizationCode: ({
-      code,
-      codeVerifier,
-      redirectURI
-    }: {
+    validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
       code: string;
@@ -1843,7 +1565,3 @@ redirectURI: string;
     name: string;
-    createAuthorizationURL({
-      state,
-      scopes,
-      redirectURI
-    }: {
+    createAuthorizationURL({ state, scopes, redirectURI }: {
       state: string;
@@ -1856,5 +1574,3 @@ codeVerifier: string;
     }): URL;
-    validateAuthorizationCode: ({
-      code
-    }: {
+    validateAuthorizationCode: ({ code }: {
       code: string;
@@ -1907,5 +1623,5 @@ redirectURI: string;
   enabled?: boolean | undefined;
-}> };
+}>; };
 type SocialProviderList = typeof socialProviderList;
 //#endregion
 export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RailwayOptions, RailwayProfile, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VerifyGoogleIdTokenOptions, VkOption, VkProfile, WeChatOptions, WeChatProfile, ZoomOptions, ZoomProfile, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, getPayPalPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

dist/social-providers/kakao.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/kakao.d.ts
@@ -96,7 +97,3 @@ interface Partner {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -109,6 +106,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -115,0 +109,0 @@ redirectURI: string;

dist/social-providers/kick.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/kick.d.ts
@@ -27,8 +28,3 @@ interface KickProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI,
-    codeVerifier
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI, codeVerifier }: {
     state: string;
@@ -41,7 +37,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode({
-    code,
-    redirectURI,
-    codeVerifier
-  }: {
+  validateAuthorizationCode({ code, redirectURI, codeVerifier }: {
     code: string;
@@ -48,0 +40,0 @@ redirectURI: string;

dist/social-providers/line.d.mts

@@ -0,2 +1,5 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/line.d.ts
@@ -36,9 +39,3 @@ interface LineIdTokenPayload {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    loginHint
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint }: {
     state: string;
@@ -51,7 +48,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -63,3 +56,3 @@ redirectURI: string;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   getUserInfo(token: OAuth2Tokens & {
@@ -66,0 +59,0 @@ user?: {

dist/social-providers/line.mjs

@@ -62,5 +62,5 @@ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			const body = new URLSearchParams();
@@ -67,0 +67,0 @@ body.set("id_token", token);

dist/social-providers/linear.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/linear.d.ts
@@ -23,8 +24,3 @@ interface LinearUser {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    loginHint,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, loginHint, redirectURI }: {
     state: string;
@@ -37,6 +33,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -43,0 +36,0 @@ redirectURI: string;

dist/social-providers/linkedin.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/linkedin.d.ts
@@ -22,8 +23,3 @@ interface LinkedInProfile {
   name: string;
-  createAuthorizationURL: ({
-    state,
-    scopes,
-    redirectURI,
-    loginHint
-  }: {
+  createAuthorizationURL: ({ state, scopes, redirectURI, loginHint }: {
     state: string;
@@ -36,6 +32,3 @@ codeVerifier: string;
   }) => Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -42,0 +35,0 @@ redirectURI: string;

dist/social-providers/microsoft-entra-id.d.mts

@@ -0,2 +1,5 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/microsoft-entra-id.d.ts
@@ -139,7 +142,3 @@ /**
   }): Promise<URL>;
-  validateAuthorizationCode({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -150,3 +149,3 @@ redirectURI: string;
   }): Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   getUserInfo(token: OAuth2Tokens & {
@@ -153,0 +152,0 @@ user?: {

dist/social-providers/microsoft-entra-id.mjs

@@ -62,5 +62,5 @@ import { APIError, BetterAuthError } from "../error/index.mjs";
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			try {
@@ -103,3 +103,4 @@ const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
 						const pictureBuffer = await context.response.clone().arrayBuffer();
-						user.picture = `data:image/jpeg;base64, ${base64.encode(pictureBuffer)}`;
+						const pictureBase64 = base64.encode(pictureBuffer);
+						user.picture = `data:image/jpeg;base64, ${pictureBase64}`;
 					} catch (e) {
@@ -106,0 +107,0 @@ logger.error(e && typeof e === "object" && "name" in e ? e.name : "", e);

dist/social-providers/naver.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/naver.d.ts
@@ -9,11 +10,21 @@ interface NaverProfile {
   response: {
-    /** Unique Naver user identifier */id: string; /** User nickname */
-    nickname: string; /** User real name */
-    name: string; /** User email address */
-    email: string; /** Gender (F: female, M: male, U: unknown) */
-    gender: string; /** Age range */
-    age: string; /** Birthday (MM-DD format) */
-    birthday: string; /** Birth year */
-    birthyear: string; /** Profile image URL */
-    profile_image: string; /** Mobile phone number */
+    /** Unique Naver user identifier */
+    id: string;
+    /** User nickname */
+    nickname: string;
+    /** User real name */
+    name: string;
+    /** User email address */
+    email: string;
+    /** Gender (F: female, M: male, U: unknown) */
+    gender: string;
+    /** Age range */
+    age: string;
+    /** Birthday (MM-DD format) */
+    birthday: string;
+    /** Birth year */
+    birthyear: string;
+    /** Profile image URL */
+    profile_image: string;
+    /** Mobile phone number */
     mobile: string;
@@ -28,7 +39,3 @@ };
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -41,6 +48,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -47,0 +51,0 @@ redirectURI: string;

dist/social-providers/notion.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/notion.d.ts
@@ -19,8 +20,3 @@ interface NotionProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    loginHint,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, loginHint, redirectURI }: {
     state: string;
@@ -33,6 +29,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -39,0 +32,0 @@ redirectURI: string;

dist/social-providers/paybin.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/paybin.d.ts
@@ -24,9 +25,3 @@ interface PaybinProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI,
-    loginHint
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, loginHint }: {
     state: string;
@@ -39,7 +34,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -46,0 +37,0 @@ redirectURI: string;

dist/social-providers/paypal.d.mts

@@ -0,2 +1,5 @@
+import { GenericEndpointContext } from "../types/context.mjs";
+import "../types/index.mjs";
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/paypal.d.ts
@@ -55,7 +58,3 @@ interface PayPalProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, codeVerifier, redirectURI }: {
     state: string;
@@ -68,6 +67,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -88,3 +84,3 @@ redirectURI: string;
   }>);
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  verifyIdToken(token: string, nonce?: string, ctx?: GenericEndpointContext): Promise<boolean>;
   getUserInfo(token: OAuth2Tokens & {
@@ -91,0 +87,0 @@ user?: {

dist/social-providers/paypal.mjs

@@ -108,5 +108,5 @@ import { APIError, BetterAuthError } from "../error/index.mjs";
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(token, nonce, ctx) {
 			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
+			if (options.verifyIdToken) return options.verifyIdToken(token, nonce, ctx);
 			try {
@@ -113,0 +113,0 @@ const { kid, alg: jwtAlg } = decodeProtectedHeader(token);

dist/social-providers/polar.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/polar.d.ts
@@ -28,8 +29,3 @@ interface PolarProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -42,7 +38,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -49,0 +41,0 @@ redirectURI: string;

dist/social-providers/railway.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/railway.d.ts
@@ -19,8 +20,3 @@ interface RailwayProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -33,7 +29,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -40,0 +32,0 @@ redirectURI: string;

dist/social-providers/reddit.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/reddit.d.ts
@@ -18,7 +19,3 @@ interface RedditProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -31,6 +28,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -37,0 +31,0 @@ redirectURI: string;

dist/social-providers/roblox.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/roblox.d.ts
@@ -26,7 +27,3 @@ interface RobloxProfile extends Record<string, any> {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -39,6 +36,3 @@ codeVerifier: string;
   }): URL;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -45,0 +39,0 @@ redirectURI: string;

dist/social-providers/salesforce.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/salesforce.d.ts
@@ -33,8 +34,3 @@ interface SalesforceProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -47,7 +43,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -54,0 +46,0 @@ redirectURI: string;

dist/social-providers/slack.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/slack.d.ts
@@ -39,7 +40,3 @@ interface SlackProfile extends Record<string, any> {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -52,6 +49,3 @@ codeVerifier: string;
   }): URL;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -58,0 +52,0 @@ redirectURI: string;

dist/social-providers/spotify.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/spotify.d.ts
@@ -17,8 +18,3 @@ interface SpotifyProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -31,7 +27,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -38,0 +30,0 @@ redirectURI: string;

dist/social-providers/tiktok.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/tiktok.d.ts
@@ -54,3 +55,4 @@ /**
        */
-      username: string; /** @note Email is currently unsupported by TikTok  */
+      username: string;
+      /** @note Email is currently unsupported by TikTok  */
       email?: string | undefined;
@@ -125,7 +127,3 @@ /**
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -138,6 +136,3 @@ codeVerifier: string;
   }): URL;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -144,0 +139,0 @@ redirectURI: string;

dist/social-providers/twitch.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/twitch.d.ts
@@ -35,7 +36,3 @@ /**
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -48,6 +45,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI }: {
     code: string;
@@ -54,0 +48,0 @@ redirectURI: string;

dist/social-providers/twitter.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/twitter.d.ts
@@ -9,5 +10,8 @@ interface TwitterProfile {
      */
-    id: string; /** The friendly name of this user, as shown on their profile. */
-    name: string; /** The email address of this user. */
-    email?: string | undefined; /** The Twitter handle (screen name) of this user. */
+    id: string;
+    /** The friendly name of this user, as shown on their profile. */
+    name: string;
+    /** The email address of this user. */
+    email?: string | undefined;
+    /** The Twitter handle (screen name) of this user. */
     username: string;
@@ -27,11 +31,19 @@ /**
     entities?: {
-      /** Contains details about the user's profile website. */url: {
-        /** Contains details about the user's profile website. */urls: Array<{
-          /** The start position (zero-based) of the recognized user's profile website. All start indices are inclusive. */start: number; /** The end position (zero-based) of the recognized user's profile website. This end index is exclusive. */
-          end: number; /** The URL in the format entered by the user. */
-          url: string; /** The fully resolved URL. */
-          expanded_url: string; /** The URL as displayed in the user's profile. */
+      /** Contains details about the user's profile website. */
+      url: {
+        /** Contains details about the user's profile website. */
+        urls: Array<{
+          /** The start position (zero-based) of the recognized user's profile website. All start indices are inclusive. */
+          start: number;
+          /** The end position (zero-based) of the recognized user's profile website. This end index is exclusive. */
+          end: number;
+          /** The URL in the format entered by the user. */
+          url: string;
+          /** The fully resolved URL. */
+          expanded_url: string;
+          /** The URL as displayed in the user's profile. */
           display_url: string;
         }>;
-      }; /** Contains details about URLs, Hashtags, Cashtags, or mentions located within a user's description. */
+      };
+      /** Contains details about URLs, Hashtags, Cashtags, or mentions located within a user's description. */
       description: {
@@ -62,3 +74,4 @@ hashtags: Array<{
      */
-    url?: string | undefined; /** The URL to the profile image for this user, as shown on the user's profile. */
+    url?: string | undefined;
+    /** The URL to the profile image for this user, as shown on the user's profile. */
     profile_image_url?: string | undefined;
@@ -96,7 +109,3 @@ protected?: boolean | undefined;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -110,3 +119,3 @@ redirectURI: string;
     user?: {
-      name? /** The start position (zero-based) of the recognized user's profile website. All start indices are inclusive. */: {
+      name?: {
         firstName?: string;
@@ -113,0 +122,0 @@ lastName?: string;

dist/social-providers/vercel.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/vercel.d.ts
@@ -17,8 +18,3 @@ interface VercelProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -31,7 +27,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI }: {
     code: string;
@@ -38,0 +30,0 @@ redirectURI: string;

dist/social-providers/vk.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/vk.d.ts
@@ -23,8 +24,3 @@ interface VkProfile {
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    codeVerifier,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }: {
     state: string;
@@ -37,8 +33,3 @@ codeVerifier: string;
   }): Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    codeVerifier,
-    redirectURI,
-    deviceId
-  }: {
+  validateAuthorizationCode: ({ code, codeVerifier, redirectURI, deviceId }: {
     code: string;
@@ -45,0 +36,0 @@ redirectURI: string;

dist/social-providers/vk.mjs

@@ -49,10 +49,9 @@ import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 			if (!data.accessToken) return null;
-			const formBody = new URLSearchParams({
-				access_token: data.accessToken,
-				client_id: options.clientId
-			}).toString();
 			const { data: profile, error } = await betterFetch("https://id.vk.com/oauth2/user_info", {
 				method: "POST",
 				headers: { "Content-Type": "application/x-www-form-urlencoded" },
-				body: formBody
+				body: new URLSearchParams({
+					access_token: data.accessToken,
+					client_id: options.clientId
+				}).toString()
 			});
@@ -59,0 +58,0 @@ if (error) return null;

dist/social-providers/wechat.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/wechat.d.ts
@@ -56,7 +57,3 @@ /**
   name: string;
-  createAuthorizationURL({
-    state,
-    scopes,
-    redirectURI
-  }: {
+  createAuthorizationURL({ state, scopes, redirectURI }: {
     state: string;
@@ -69,5 +66,3 @@ codeVerifier: string;
   }): URL;
-  validateAuthorizationCode: ({
-    code
-  }: {
+  validateAuthorizationCode: ({ code }: {
     code: string;
@@ -74,0 +69,0 @@ redirectURI: string;

dist/social-providers/zoom.d.mts

 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 //#region src/social-providers/zoom.d.ts
-type LoginType = 0 /** Facebook OAuth */ | 1 /** Google OAuth */ | 24 /** Apple OAuth */ | 27 /** Microsoft OAuth */ | 97 /** Mobile device */ | 98 /** RingCentral OAuth */ | 99 /** API user */ | 100 /** Zoom Work email */ | 101;
-/** Single Sign-On (SSO) */
+type LoginType = 0 | /** Facebook OAuth */ 1 | /** Google OAuth */ 24 | /** Apple OAuth */ 27 | /** Microsoft OAuth */ 97 | /** Mobile device */ 98 | /** RingCentral OAuth */ 99 | /** API user */ 100 | /** Zoom Work email */ 101; /** Single Sign-On (SSO) */
 type AccountStatus = "pending" | "active" | "inactive";
-type PronounOption = 1 /** Ask the user every time */ | 2 /** Always display */ | 3;
-/** Do not display */
+type PronounOption = 1 | /** Ask the user every time */ 2 | /** Always display */ 3; /** Do not display */
 interface PhoneNumber {
@@ -119,7 +118,3 @@ /** The country code of the phone number (Example: "+1") */
   name: string;
-  createAuthorizationURL: ({
-    state,
-    redirectURI,
-    codeVerifier
-  }: {
+  createAuthorizationURL: ({ state, redirectURI, codeVerifier }: {
     state: string;
@@ -132,7 +127,3 @@ codeVerifier: string;
   }) => Promise<URL>;
-  validateAuthorizationCode: ({
-    code,
-    redirectURI,
-    codeVerifier
-  }: {
+  validateAuthorizationCode: ({ code, redirectURI, codeVerifier }: {
     code: string;
@@ -139,0 +130,0 @@ redirectURI: string;

dist/types/context.d.mts

@@ -11,7 +11,8 @@ import { BetterAuthDBSchema, ModelNames, SecondaryStorage } from "../db/type.mjs";
 import { Account } from "../db/schema/account.mjs";
+import "../db/index.mjs";
 import { BetterAuthCookie, BetterAuthCookies } from "./cookie.mjs";
 import { SecretConfig } from "./secret.mjs";
 import { OAuthProvider } from "../oauth2/oauth-provider.mjs";
+import "../oauth2/index.mjs";
 import { CookieOptions, EndpointContext } from "better-call";
-
 //#region src/types/context.d.ts
@@ -18,0 +19,0 @@ /**

dist/types/cookie.d.mts

 import { CookieOptions } from "better-call";
-
 //#region src/types/cookie.d.ts
@@ -4,0 +3,0 @@ type BetterAuthCookie = {

dist/types/helper.d.mts

@@ -7,5 +7,5 @@ //#region src/types/helper.d.ts
 type LiteralUnion<LiteralType, BaseType extends Primitive> = LiteralType | (BaseType & Record<never, never>);
-type Prettify<T> = { [K in keyof T]: T[K] } & {};
+type Prettify<T> = { [K in keyof T]: T[K]; } & {};
 type UnionToIntersection<U> = (U extends any ? (k: U) => void : never) extends ((k: infer I) => void) ? I : never;
 //#endregion
 export { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection };

dist/types/index.d.mts

@@ -9,2 +9,2 @@ import { Awaitable, AwaitableFunction, LiteralString, LiteralUnion, Prettify, Primitive, UnionToIntersection } from "./helper.mjs";
 import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
-export { type StandardSchemaV1$1 as StandardSchemaV1 };
+export type { AuthContext, Awaitable, AwaitableFunction, BaseURLConfig, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookie, BetterAuthCookies, BetterAuthDBOptions, BetterAuthOptions, BetterAuthPlugin, BetterAuthPluginErrorCodePart, BetterAuthPluginRegistry, BetterAuthPluginRegistryIdentifier, BetterAuthRateLimitOptions, BetterAuthRateLimitRule, BetterAuthRateLimitStorage, ClientAtomListener, ClientFetchOption, ClientStore, DynamicBaseURLConfig, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InfoContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, SecretConfig, StandardSchemaV1$1 as StandardSchemaV1, StoreIdentifierOption, UnionToIntersection };

dist/types/init-options.d.mts

@@ -12,2 +12,3 @@ import { DBFieldAttribute, ModelNames, SecondaryStorage } from "../db/type.mjs";
 import { Account, BaseAccount } from "../db/schema/account.mjs";
+import "../db/index.mjs";
 import { AuthContext, GenericEndpointContext } from "./context.mjs";
@@ -20,6 +21,5 @@ import { AuthMiddleware } from "../api/index.mjs";
 import { Dialect, Kysely, MysqlPool, PostgresPool, SqliteDatabase } from "kysely";
-
 //#region src/types/init-options.d.ts
 type KyselyDatabaseType = "postgres" | "mysql" | "sqlite" | "mssql";
-type Optional<T> = { [P in keyof T]?: T[P] | undefined };
+type Optional<T> = { [P in keyof T]?: T[P] | undefined; };
 type StoreIdentifierOption = "plain" | "hashed" | {
@@ -135,3 +135,3 @@ hash: (identifier: string) => Promise<string>;
    */
-  additionalFields?: { [Key in Exclude<string, Keys | "id">]: DBFieldAttribute };
+  additionalFields?: { [Key in Exclude<string, Keys | "id">]: DBFieldAttribute; };
 };
@@ -320,3 +320,3 @@ type BetterAuthRateLimitOptions = Optional<BetterAuthRateLimitRule> & Omit<BetterAuthDBOptions<"rateLimit", keyof BaseRateLimit>, "additionalFields"> & {
    *
-    * - `x-forwarded-host`
+   * - `x-forwarded-host`
    * - `x-forwarded-proto`
@@ -711,3 +711,4 @@ *
     customSyntheticUser?: (params: {
-      /** Core user fields: name, email, emailVerified, image, createdAt, updatedAt */coreFields: {
+      /** Core user fields: name, email, emailVerified, image, createdAt, updatedAt */
+      coreFields: {
         name: string;
@@ -719,4 +720,6 @@ email: string;
         updatedAt: Date;
-      }; /** Processed additional fields from options.user.additionalFields (with defaults applied) */
-      additionalFields: Record<string, unknown>; /** Generated user ID */
+      };
+      /** Processed additional fields from options.user.additionalFields (with defaults applied) */
+      additionalFields: Record<string, unknown>;
+      /** Generated user ID */
       id: string;
@@ -723,0 +726,0 @@ }) => Record<string, unknown>;

dist/types/plugin-client.d.mts

@@ -5,3 +5,2 @@ import { LiteralString } from "./helper.mjs";
 import { Atom, WritableAtom } from "nanostores";
-
 //#region src/types/plugin-client.d.ts
@@ -93,3 +92,2 @@ type InferableServerPlugin = {
    */
-
   options: BetterAuthClientOptions | undefined) => Record<string, any>;
@@ -125,2 +123,2 @@ /**
 //#endregion
-export { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore };
+export { BetterAuthClientOptions, BetterAuthClientPlugin, ClientAtomListener, ClientFetchOption, ClientStore, RevalidateOptions };

dist/types/plugin.d.mts

@@ -5,2 +5,3 @@ import { BetterAuthPluginDBSchema } from "../db/plugin.mjs";
 import { BetterAuthOptions } from "./init-options.mjs";
+import "../db/index.mjs";
 import { AuthContext } from "./context.mjs";
@@ -10,5 +11,4 @@ import { AuthMiddleware } from "../api/index.mjs";
 import { Migration } from "kysely";
-
 //#region src/types/plugin.d.ts
-type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;
+type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]>; } : T;
 type HookEndpointContext = Partial<EndpointContext<string, any> & Omit<InputContext<string, any>, "method">> & {
@@ -15,0 +15,0 @@ path?: string;

dist/utils/async.d.mts

 import { Awaitable } from "../types/helper.mjs";
-
 //#region src/utils/async.d.ts
@@ -4,0 +3,0 @@ interface MapConcurrentOptions {

dist/utils/db.d.mts

 import { DBFieldAttribute } from "../db/type.mjs";
+import "../db/index.mjs";
 //#region src/utils/db.d.ts
@@ -3,0 +4,0 @@ /**

dist/utils/deprecate.d.mts

 import { InternalLogger } from "../env/logger.mjs";
-
 //#region src/utils/deprecate.d.ts
@@ -4,0 +3,0 @@ /**

dist/utils/error-codes.d.mts

@@ -6,3 +6,3 @@ //#region src/utils/error-codes.d.ts
 type InvalidKeyError<K extends string> = `Invalid error code key: "${K}" - must only contain uppercase letters (A-Z) and underscores (_)`;
-type ValidateErrorCodes<T> = { [K in keyof T]: K extends string ? IsValidUpperSnakeCase<K> extends false ? InvalidKeyError<K> : T[K] : T[K] };
+type ValidateErrorCodes<T> = { [K in keyof T]: K extends string ? IsValidUpperSnakeCase<K> extends false ? InvalidKeyError<K> : T[K] : T[K]; };
 type RawError<K extends string = string> = {
@@ -12,4 +12,4 @@ readonly code: K;
 };
-declare function defineErrorCodes<const T extends Record<string, string>, R extends { [K in keyof T & string]: RawError<K> }>(codes: ValidateErrorCodes<T>): R;
+declare function defineErrorCodes<const T extends Record<string, string>, R extends { [K in keyof T & string]: RawError<K>; }>(codes: ValidateErrorCodes<T>): R;
 //#endregion
 export { RawError, defineErrorCodes };

dist/utils/host.d.mts

@@ -29,3 +29,29 @@ //#region src/utils/host.d.ts
  */
-type HostKind = /** IPv4 `127.0.0.0/8` or IPv6 `::1`. */"loopback" /** DNS name `localhost` or RFC 6761 `.localhost` TLD. */ | "localhost" /** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */ | "unspecified" /** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */ | "private" /** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */ | "linkLocal" /** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */ | "sharedAddressSpace" /** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */ | "documentation" /** RFC 2544 `198.18.0.0/15`. */ | "benchmarking" /** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */ | "multicast" /** IPv4 limited broadcast `255.255.255.255`. */ | "broadcast" /** Other RFC 6890 special-purpose ranges (0/8, 192.0.0/24, 240/4, 2001::/32, etc.). */ | "reserved" /** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */ | "cloudMetadata" /** Any host not matching a special-purpose range above. */ | "public";
+type HostKind =
+/** IPv4 `127.0.0.0/8` or IPv6 `::1`. */
+"loopback" |
+/** DNS name `localhost` or RFC 6761 `.localhost` TLD. */
+"localhost" |
+/** IPv4 `0.0.0.0` or IPv6 `::` — "this host on this network", not loopback. */
+"unspecified" |
+/** RFC 1918 `10/8`, `172.16/12`, `192.168/16`, or IPv6 ULA `fc00::/7`. */
+"private" |
+/** IPv4 `169.254/16` or IPv6 `fe80::/10`. Includes AWS IMDS `169.254.169.254`. */
+"linkLocal" |
+/** RFC 6598 carrier-grade NAT `100.64.0.0/10`. */
+"sharedAddressSpace" |
+/** RFC 5737 `192.0.2/24`, `198.51.100/24`, `203.0.113/24`, or RFC 3849 `2001:db8::/32`. */
+"documentation" |
+/** RFC 2544 `198.18.0.0/15`. */
+"benchmarking" |
+/** IPv4 `224.0.0.0/4` or IPv6 `ff00::/8`. */
+"multicast" |
+/** IPv4 limited broadcast `255.255.255.255`. */
+"broadcast" |
+/** Other RFC 6890 special-purpose ranges (0/8, 192.0.0/24, 240/4, 2001::/32, etc.). */
+"reserved" |
+/** Cloud metadata service FQDN (e.g. `metadata.google.internal`). */
+"cloudMetadata" |
+/** Any host not matching a special-purpose range above. */
+"public";
 /**
@@ -32,0 +58,0 @@ * The syntactic form of the input host: an IPv4 literal, an IPv6 literal, or

dist/utils/host.mjs

@@ -12,3 +12,3 @@ import { isValidIP, normalizeIP } from "./ip.mjs";
 */
-const CLOUD_METADATA_HOSTS = new Set([
+const CLOUD_METADATA_HOSTS = /* @__PURE__ */ new Set([
 	"metadata.google.internal",
@@ -15,0 +15,0 @@ "metadata.goog",

dist/utils/ip.d.mts

 import { BetterAuthOptions } from "../types/init-options.mjs";
+import "../types/index.mjs";
 //#region src/utils/ip.d.ts
@@ -3,0 +4,0 @@ /**

dist/utils/ip.mjs

@@ -114,3 +114,3 @@ import { isDevelopment, isTest } from "../env/env-impl.mjs";
 	const groups = expandIPv6(ip);
-	const bytes = new Uint8Array(16);
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
 	for (let i = 0; i < 8; i++) {
@@ -117,0 +117,0 @@ const group = Number.parseInt(groups[i] ?? "0", 16);

dist/utils/is-api-error.d.mts

 import { APIError } from "../error/index.mjs";
-
 //#region src/utils/is-api-error.d.ts
@@ -4,0 +3,0 @@ declare function isAPIError(error: unknown): error is APIError;

dist/utils/redirect-uri.d.mts

 import * as z from "zod";
-
 //#region src/utils/redirect-uri.d.ts
@@ -4,0 +3,0 @@ /**

package.json

 {
   "name": "@better-auth/core",
-  "version": "1.6.23",
+  "version": "1.6.24",
   "description": "The most comprehensive authentication framework for TypeScript.",
@@ -165,3 +165,3 @@ "type": "module",
     "nanostores": "^1.1.1",
-    "tsdown": "0.21.1"
+    "tsdown": "0.22.7"
   },
@@ -168,0 +168,0 @@ "peerDependencies": {

src/context/request-state.ts

@@ -7,11 +7,31 @@ import type { AsyncLocalStorage } from "@better-auth/core/async_hooks";
 
+// Memoizes the in-flight AsyncLocalStorage initialization so concurrent
+// first-callers share a single instance instead of each constructing one.
+let asyncStorageInit: Promise<AsyncLocalStorage<RequestStateWeakMap>> | null =
+	null;
+
 const ensureAsyncStorage = async () => {
 	const betterAuthGlobal = __getBetterAuthGlobal();
-	if (!betterAuthGlobal.context.requestStateAsyncStorage) {
-		const AsyncLocalStorage = await getAsyncLocalStorage();
-		betterAuthGlobal.context.requestStateAsyncStorage =
-			new AsyncLocalStorage<RequestStateWeakMap>();
+	const existing = betterAuthGlobal.context.requestStateAsyncStorage;
+	if (existing) {
+		return existing as AsyncLocalStorage<RequestStateWeakMap>;
 	}
-	return betterAuthGlobal.context
-		.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
+	// Without memoizing the init, several concurrent callers can each pass the
+	// check above, each `await getAsyncLocalStorage()`, and each assign a fresh
+	// instance — last write wins. `runWithRequestState().run()` then executes on
+	// one instance while a nested `getCurrentRequestState()` reads the
+	// overwritten one, throwing "No request state found". This shows up
+	// intermittently on serverless cold start (e.g. Cloudflare Workers), where
+	// the first requests hit before the lazy `node:async_hooks` import settles.
+	// The idempotent `??=` keeps the global singleton stable even if multiple
+	// BetterAuth copies (Dual Module Hazard) race here.
+	if (!asyncStorageInit) {
+		asyncStorageInit = getAsyncLocalStorage().then((AsyncLocalStorage) => {
+			betterAuthGlobal.context.requestStateAsyncStorage ??=
+				new AsyncLocalStorage<RequestStateWeakMap>();
+			return betterAuthGlobal.context
+				.requestStateAsyncStorage as AsyncLocalStorage<RequestStateWeakMap>;
+		});
+	}
+	return asyncStorageInit;
 };
@@ -18,0 +38,0 @@

src/db/adapter/get-default-model-name.ts

@@ -23,2 +23,22 @@ import { BetterAuthError } from "../../error";
 	const getDefaultModelName = (model: string) => {
+		// Resolve a model string (either a schema key or a user-defined
+		// `modelName`) back to its canonical schema key.
+		//
+		// An exact schema-key match must win over a `modelName` match.
+		// Better-auth internals (and `references.model`, see get-tables.ts)
+		// always pass canonical schema keys, so when a user remaps a
+		// built-in table onto another table's schema key (e.g.
+		// `user.modelName = "account"`), preferring the modelName alias
+		// would silently reroute every internal "account" query to the
+		// user table. The modelName lookup is only a fallback for
+		// externally supplied physical table names.
+		// @see https://github.com/better-auth/better-auth/issues/8111
+		// @see https://github.com/better-auth/better-auth/issues/10136
+		const resolve = (candidate: string): string | undefined => {
+			if (schema[candidate]) return candidate;
+			return Object.entries(schema).find(
+				([_, f]) => f.modelName === candidate,
+			)?.[0];
+		};
+
 		// It's possible this `model` could had applied `usePlural`.
@@ -28,18 +48,7 @@ // Thus we'll try the search but without the trailing `s`.
 			const pluralessModel = model.slice(0, -1);
-			let m = schema[pluralessModel] ? pluralessModel : undefined;
-			if (!m) {
-				m = Object.entries(schema).find(
-					([_, f]) => f.modelName === pluralessModel,
-				)?.[0];
-			}
-
-			if (m) {
-				return m;
-			}
+			const m = resolve(pluralessModel);
+			if (m) return m;
 		}
 
-		let m = schema[model] ? model : undefined;
-		if (!m) {
-			m = Object.entries(schema).find(([_, f]) => f.modelName === model)?.[0];
-		}
+		const m = resolve(model);
 
@@ -46,0 +55,0 @@ if (!m) {

src/db/get-tables.ts

@@ -145,3 +145,14 @@ import type { BetterAuthOptions } from "../types";
 					references: {
-						model: options.user?.modelName || "user",
+						// Use the canonical user schema key here rather than
+						// `options.user.modelName`. Downstream consumers (e.g.
+						// `getSchema`, `getMigrations`, and the runtime adapter
+						// resolvers) treat `references.model` as a schema key
+						// and look it up via `tables[references.model]` /
+						// `getDefaultModelName`. Writing the modelName alias
+						// here would collide when a user picks a modelName that
+						// matches another schema key (for example
+						// `user.modelName = "account"`), causing the FK to
+						// resolve to the wrong table.
+						// @see https://github.com/better-auth/better-auth/issues/8111
+						model: "user",
 						field: "id",
@@ -229,3 +240,7 @@ onDelete: "cascade",
 					references: {
-						model: options.user?.modelName || "user",
+						// See note on `session.userId.references.model` above:
+						// always use the canonical user schema key so the FK
+						// target survives `user.modelName` aliasing.
+						// @see https://github.com/better-auth/better-auth/issues/8111
+						model: "user",
 						field: "id",
@@ -232,0 +247,0 @@ onDelete: "cascade",

src/oauth2/oauth-provider.ts

@@ -1,2 +0,6 @@
-import type { Awaitable, LiteralString } from "../types";
+import type {
+	Awaitable,
+	GenericEndpointContext,
+	LiteralString,
+} from "../types";
 
@@ -77,6 +81,11 @@ export interface OAuth2Tokens {
 	 * @param nonce - The nonce
+	 * @param ctx - Request endpoint context (headers via `ctx.headers`)
 	 * @returns True if the id token is valid, false otherwise
 	 */
 	verifyIdToken?:
-		| ((token: string, nonce?: string) => Promise<boolean>)
+		| ((
+				token: string,
+				nonce?: string,
+				ctx?: GenericEndpointContext,
+		  ) => Promise<boolean>)
 		| undefined;
@@ -141,6 +150,13 @@ /**
 	/**
-	 * verifyIdToken function to verify the id token
+	 * Custom function to verify the id token.
+	 * @param token - The id token
+	 * @param nonce - The nonce
+	 * @param ctx - Request endpoint context (headers via `ctx.headers`)
 	 */
 	verifyIdToken?:
-		| ((token: string, nonce?: string) => Promise<boolean>)
+		| ((
+				token: string,
+				nonce?: string,
+				ctx?: GenericEndpointContext,
+		  ) => Promise<boolean>)
 		| undefined;
@@ -147,0 +163,0 @@ /**

src/social-providers/apple.ts

@@ -13,2 +13,3 @@ import { betterFetch } from "@better-fetch/fetch";
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 export interface AppleProfile {
@@ -135,3 +136,7 @@ /**
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
@@ -141,3 +146,3 @@ return false;
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
@@ -144,0 +149,0 @@ try {

src/social-providers/cognito.ts

@@ -12,2 +12,3 @@ import { betterFetch } from "@better-fetch/fetch";
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
@@ -134,3 +135,7 @@ export interface CognitoProfile {
 
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
@@ -140,3 +145,3 @@ return false;
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
@@ -143,0 +148,0 @@

src/social-providers/facebook.ts

@@ -12,2 +12,3 @@ import { betterFetch } from "@better-fetch/fetch";
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 export interface FacebookProfile {
@@ -134,3 +135,7 @@ id: string;
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
@@ -141,3 +146,3 @@ return false;
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
@@ -144,0 +149,0 @@

src/social-providers/google.ts

@@ -13,2 +13,3 @@ import { betterFetch } from "@better-fetch/fetch";
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
@@ -185,3 +186,7 @@ export interface GoogleProfile {
 				},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
@@ -191,3 +196,3 @@ return false;
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
@@ -194,0 +199,0 @@

src/social-providers/line.ts

@@ -9,2 +9,3 @@ import { betterFetch } from "@better-fetch/fetch";
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
@@ -98,3 +99,7 @@ export interface LineIdTokenPayload {
 				},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
@@ -104,3 +109,3 @@ return false;
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
@@ -107,0 +112,0 @@ const body = new URLSearchParams();

src/social-providers/microsoft-entra-id.ts

@@ -13,2 +13,3 @@ import { base64 } from "@better-auth/utils/base64";
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
@@ -204,3 +205,7 @@ /**
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
@@ -210,3 +215,3 @@ return false;
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
@@ -213,0 +218,0 @@

src/social-providers/paypal.ts

@@ -8,2 +8,3 @@ import { base64 } from "@better-auth/utils/base64";
 import { createAuthorizationURL } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
@@ -221,3 +222,7 @@ /**
 
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
@@ -227,3 +232,3 @@ return false;
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
@@ -230,0 +235,0 @@

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1040385

0.47%

Lines of code

22554

0.49%

No dependency changes