@astralarium/repo-auth 0.0.0-stage → 0.2.0

package/dist/index.server.d.ts

@@ -0,0 +1,645 @@
+import { type BetterAuthOptions, type BetterAuthPlugin, type Session, type User } from "better-auth";
+import { type Dialect } from "kysely";
+import { z } from "zod";
+import type { DevProviderSignIn } from "./dev-sign-in/sign-in.ts";
+import type { AuthProviderCredentials, AuthProviders } from "./providers/provider.ts";
+import type { SessionLike } from "./types.ts";
+/** `auth.users` columns beside better-auth's core fields. */
+export type AdditionalFields = NonNullable<NonNullable<BetterAuthOptions["user"]>["additionalFields"]>;
+/** App identity and schema; stable across requests. */
+export interface ShellAuthApp<Fields extends AdditionalFields, Projected extends SessionLike> {
+    /** Shown on consent screens and in emails. */
+    appName: string;
+    /** `auth.users` columns beside the core fields, as better-auth field
+     *  attributes keyed by column. */
+    additionalFields: Fields;
+    /** Browser-visible session: the `get-session` response and client store. */
+    projectSession: (session: ShellSession<Fields>) => Projected;
+    /** Session lifetime and refresh age in seconds; better-auth's defaults
+     *  when omitted. */
+    session?: Pick<NonNullable<BetterAuthOptions["session"]>, "expiresIn" | "updateAge">;
+    /** OAuth sign-in providers (`defineAuthProviders`); each turns on with
+     *  its deployment's credentials. */
+    providers?: AuthProviders;
+    /** Signed-in users link more provider accounts (`/link-social`). */
+    linkSocial?: boolean;
+    /**
+     * Dev sign-in as any account of a provider (`devProviderSignIn`): `POST
+     * /api/auth/dev/sign-in` grants a session for any account id to any
+     * caller reaching the server; its trusted-origin `Origin` check is the
+     * one gate. Build it under the dev build flag alone
+     * (`import.meta.env.DEV`), which drops it from production bundles;
+     * `testProductionAuth` proves the production build serves no dev
+     * sign-in.
+     */
+    devSignIn?: DevProviderSignIn;
+    /** Page OAuth failures redirect to, with `error` and `error_description`
+     *  query params. */
+    errorURL: string;
+    /** Account options beside the table mapping, e.g. `accountLinking`. */
+    account?: Omit<NonNullable<BetterAuthOptions["account"]>, "modelName" | "fields">;
+    /** better-auth hooks around `auth.*` row creates, updates, and deletes. */
+    databaseHooks?: BetterAuthOptions["databaseHooks"];
+}
+/** `shellAuth`'s config: the app plus its deployment's origin, secret, and
+ *  provider credentials. */
+export interface ShellAuthConfig<Fields extends AdditionalFields, Projected extends SessionLike> extends ShellAuthApp<Fields, Projected> {
+    /** Public origin, or per-request origins constrained to allowed hosts. */
+    baseURL: NonNullable<BetterAuthOptions["baseURL"]>;
+    /** Signing secret from `configure`'s `env`, so the instance depends on
+     *  that object alone; required over better-auth's `BETTER_AUTH_SECRET`
+     *  process-env fallback. */
+    secret: string;
+    /** Credentials of `providers` (`providers.credentials(env)`); a provider
+     *  without them stays off. */
+    credentials?: AuthProviderCredentials;
+    /** better-auth plugins after the session projection and provider
+     *  plugins. */
+    plugins?: BetterAuthPlugin[];
+}
+/** The app's auth declaration, validated; infers `Fields` and
+ *  `Projected` from the literal. Throws `ExpectedError` naming each
+ *  invalid value. */
+export declare function defineShellAuthApp<const Fields extends AdditionalFields, Projected extends SessionLike>(app: ShellAuthApp<Fields, Projected>): ShellAuthApp<Fields, Projected>;
+/** `auth.*` table mapping and the app's user columns. */
+declare function schemaOptions<Fields extends AdditionalFields>({ appName, additionalFields, session, account, databaseHooks, }: ShellAuthApp<Fields, SessionLike>): {
+    appName: string;
+    advanced: {
+        disableOriginCheck: false;
+        database: {
+            generateId: false;
+            validateSchema: false;
+        };
+    };
+    rateLimit: {
+        enabled: false;
+    };
+    databaseHooks: {
+        user?: {
+            create?: {
+                before?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (user: Partial<User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    };
+                }>;
+                after?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        session?: {
+            create?: {
+                before?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (session: Partial<Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                }>;
+                after?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        account?: {
+            create?: {
+                before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    };
+                }>;
+                after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        verification?: {
+            create?: {
+                before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    };
+                }>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+    } | undefined;
+    session: {
+        cookieCache: {
+            enabled: true;
+            maxAge: number;
+        };
+        modelName: "auth.session";
+        fields: {
+            userId: string;
+            expiresAt: string;
+            ipAddress: string;
+            userAgent: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+        expiresIn?: number;
+        updateAge?: number;
+    };
+    user: {
+        modelName: "auth.users";
+        fields: {
+            name: string;
+            email: string;
+            emailVerified: string;
+            image: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+        additionalFields: Fields;
+    };
+    account: {
+        modelName: "auth.account";
+        fields: {
+            userId: string;
+            providerId: string;
+            accountId: string;
+            accessToken: string;
+            refreshToken: string;
+            accessTokenExpiresAt: string;
+            refreshTokenExpiresAt: string;
+            scope: string;
+            idToken: string;
+            password: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+        additionalFields?: {
+            [x: string]: import("better-auth").DBFieldAttribute;
+        } | undefined;
+        updateAccountOnSignIn?: boolean;
+        accountLinking?: {
+            enabled?: boolean;
+            disableImplicitLinking?: boolean;
+            requireLocalEmailVerified?: boolean;
+            trustedProviders?: Array<import("better-auth").LiteralUnion<import("better-auth").SocialProviderList[number] | "email-password", string>> | ((request?: Request | undefined) => import("better-auth").Awaitable<Array<import("better-auth").LiteralUnion<import("better-auth").SocialProviderList[number] | "email-password", string>>>);
+            allowDifferentEmails?: boolean;
+            allowUnlinkingAll?: boolean;
+            updateUserInfoOnLink?: boolean;
+        };
+        encryptOAuthTokens?: boolean;
+        skipStateCookieCheck?: boolean;
+        storeStateStrategy?: "database" | "cookie";
+        storeAccountCookie?: boolean;
+    };
+    verification: {
+        modelName: "auth.verification";
+        fields: {
+            identifier: string;
+            value: string;
+            expiresAt: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+    };
+};
+type SchemaOptions<Fields extends AdditionalFields> = ReturnType<typeof schemaOptions<Fields>>;
+/** A native session read: the row with the app's user columns. */
+export interface ShellSession<Fields extends AdditionalFields> {
+    session: Session<SchemaOptions<Fields>["session"]>;
+    user: User<SchemaOptions<Fields>["user"]>;
+}
+/** better-auth for `config` over the running scope's database: the `auth.*`
+ *  schema, the session projection, the providers' plugins, dev sign-in,
+ *  then `config.plugins`. */
+declare function buildAuth<Fields extends AdditionalFields, Projected extends SessionLike>(config: ShellAuthConfig<Fields, Projected>): import("better-auth").Auth<{
+    baseURL: NonNullable<import("better-auth").BaseURLConfig | undefined>;
+    secret: string;
+    database: {
+        dialect: Dialect;
+        type: string;
+        transaction: boolean;
+    };
+    socialProviders: import("better-auth").SocialProviders;
+    plugins: [{
+        id: "session-projection";
+        endpoints: {
+            getSession: import("better-auth").StrictEndpoint<"/get-session", {
+                metadata: {
+                    CUSTOM_SESSION: boolean;
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+                method: ("GET" | "POST")[];
+                operationId: string;
+                query: z.ZodOptional<z.ZodObject<{
+                    disableCookieCache: z.ZodOptional<z.ZodCoercedBoolean<unknown>>;
+                    disableRefresh: z.ZodOptional<z.ZodCoercedBoolean<unknown>>;
+                }, z.core.$strip>>;
+                requireHeaders: true;
+            }, Projected | null>;
+        };
+        $Infer: {
+            Session: Projected;
+        };
+    }, ...(BetterAuthPlugin | {
+        id: "dev-provider-sign-in";
+        endpoints: {
+            devProviderSignIn: import("better-auth").StrictEndpoint<"/dev/sign-in", {
+                method: "POST";
+                body: z.ZodObject<{
+                    accountId: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+                }, z.core.$strip>;
+                requireRequest: true;
+                metadata: {
+                    allowedMediaTypes: string[];
+                };
+            }, {
+                token: string;
+                user: {
+                    id: string;
+                };
+            }>;
+        };
+    })[]];
+    onAPIError: {
+        errorURL: string;
+    };
+    appName: string;
+    advanced: {
+        disableOriginCheck: false;
+        database: {
+            generateId: false;
+            validateSchema: false;
+        };
+    };
+    rateLimit: {
+        enabled: false;
+    };
+    databaseHooks: {
+        user?: {
+            create?: {
+                before?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (user: Partial<User> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        email?: string | undefined;
+                        emailVerified?: boolean | undefined;
+                        name?: string | undefined;
+                        image?: string | null | undefined;
+                    };
+                }>;
+                after?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (user: User & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        session?: {
+            create?: {
+                before?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (session: Partial<Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        userId?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        token?: string | undefined;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                }>;
+                after?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (session: Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        account?: {
+            create?: {
+                before?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (account: import("better-auth").Account, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (account: Partial<import("better-auth").Account> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        providerId?: string | undefined;
+                        accountId?: string | undefined;
+                        userId?: string | undefined;
+                        accessToken?: string | null | undefined;
+                        refreshToken?: string | null | undefined;
+                        idToken?: string | null | undefined;
+                        accessTokenExpiresAt?: Date | null | undefined;
+                        refreshTokenExpiresAt?: Date | null | undefined;
+                        scope?: string | null | undefined;
+                        password?: string | null | undefined;
+                    };
+                }>;
+                after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (account: import("better-auth").Account & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+        verification?: {
+            create?: {
+                before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    } & Record<string, any>;
+                }>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            update?: {
+                before?: (verification: Partial<import("better-auth").Verification> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+                    data: {
+                        [x: string]: any;
+                        id?: string | undefined;
+                        createdAt?: Date | undefined;
+                        updatedAt?: Date | undefined;
+                        value?: string | undefined;
+                        expiresAt?: Date | undefined;
+                        identifier?: string | undefined;
+                    };
+                }>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+            delete?: {
+                before?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+                after?: (verification: import("better-auth").Verification & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+            };
+        };
+    } | undefined;
+    session: {
+        cookieCache: {
+            enabled: true;
+            maxAge: number;
+        };
+        modelName: "auth.session";
+        fields: {
+            userId: string;
+            expiresAt: string;
+            ipAddress: string;
+            userAgent: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+        expiresIn?: number;
+        updateAge?: number;
+    };
+    user: {
+        modelName: "auth.users";
+        fields: {
+            name: string;
+            email: string;
+            emailVerified: string;
+            image: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+        additionalFields: Fields;
+    };
+    account: {
+        modelName: "auth.account";
+        fields: {
+            userId: string;
+            providerId: string;
+            accountId: string;
+            accessToken: string;
+            refreshToken: string;
+            accessTokenExpiresAt: string;
+            refreshTokenExpiresAt: string;
+            scope: string;
+            idToken: string;
+            password: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+        additionalFields?: {
+            [x: string]: import("better-auth").DBFieldAttribute;
+        } | undefined;
+        updateAccountOnSignIn?: boolean;
+        accountLinking?: {
+            enabled?: boolean;
+            disableImplicitLinking?: boolean;
+            requireLocalEmailVerified?: boolean;
+            trustedProviders?: Array<import("better-auth").LiteralUnion<import("better-auth").SocialProviderList[number] | "email-password", string>> | ((request?: Request | undefined) => import("better-auth").Awaitable<Array<import("better-auth").LiteralUnion<import("better-auth").SocialProviderList[number] | "email-password", string>>>);
+            allowDifferentEmails?: boolean;
+            allowUnlinkingAll?: boolean;
+            updateUserInfoOnLink?: boolean;
+        };
+        encryptOAuthTokens?: boolean;
+        skipStateCookieCheck?: boolean;
+        storeStateStrategy?: "database" | "cookie";
+        storeAccountCookie?: boolean;
+    };
+    verification: {
+        modelName: "auth.verification";
+        fields: {
+            identifier: string;
+            value: string;
+            expiresAt: string;
+            createdAt: string;
+            updatedAt: string;
+        };
+    };
+}>;
+/** The auth instance `shellAuth` builds for `App`. */
+export type ShellAuth<App extends ShellAuthApp<AdditionalFields, SessionLike>> = App extends ShellAuthApp<infer Fields, infer Projected> ? ReturnType<typeof buildAuth<Fields, Projected>> : never;
+/**
+ * The auth instance of `configure(env)`, built once per `env` object: one per
+ * isolate on Workers, so plugin init runs once. Queries run inside
+ * `withShellAuth`. An invalid config throws `ExpectedError` naming each
+ * invalid value. A failed init drops the instance; the next call rebuilds
+ * it.
+ */
+export declare function shellAuth<Env extends object, Fields extends AdditionalFields, Projected extends SessionLike>(configure: (env: Env) => ShellAuthConfig<Fields, Projected>): (env: Env) => ReturnType<typeof buildAuth<Fields, Projected>>;
+/**
+ * Runs `fn` with `shellAuth` queries on a pool over `db`; the pool closes
+ * when `fn` settles. `fn` finishes its database reads first: a Response streaming
+ * lazily from the database fails.
+ */
+export declare function withShellAuth<T>(db: string, fn: () => Promise<T>): Promise<T>;
+export {};