@gatwech/auth 1.0.0-beta.18

package/dist/index-65G5U5DB-DSdjzreF.d.mts

@@ -0,0 +1,2543 @@
+import * as better_call0 from "better-call";
+import { CookieOptions, Endpoint, EndpointContext, InputContext, Middleware } from "better-call";
+import * as z$1 from "zod";
+import "jose";
+import { Dialect, Kysely, Migration, MysqlPool, PostgresPool, SqliteDatabase } from "kysely";
+import { BetterFetch, BetterFetchOption } from "@better-fetch/fetch";
+import { Atom, WritableAtom } from "nanostores";
+import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
+import { Database } from "bun:sqlite";
+import { DatabaseSync } from "node:sqlite";
+
+//#region ../core/dist/index-CmdhhvA2.d.mts
+
+type LogLevel = "info" | "success" | "warn" | "error" | "debug";
+interface Logger {
+  disabled?: boolean | undefined;
+  disableColors?: boolean | undefined;
+  level?: Exclude<LogLevel, "success"> | undefined;
+  log?: ((level: Exclude<LogLevel, "success">, message: string, ...args: any[]) => void) | undefined;
+}
+type LogHandlerParams = Parameters<NonNullable<Logger["log"]>> extends [LogLevel, ...infer Rest] ? Rest : never;
+type InternalLogger = { [K in LogLevel]: (...params: LogHandlerParams) => void } & {
+  get level(): LogLevel;
+};
+declare const createLogger: (options?: Logger | undefined) => InternalLogger;
+//#endregion
+//#region ../core/dist/index-65G5U5DB.d.mts
+//#region src/db/type.d.ts
+type DBPreservedModels = "user" | "account" | "session" | "verification" | "rate-limit" | "organization" | "member" | "invitation" | "jwks" | "passkey" | "two-factor";
+type DBFieldType = "string" | "number" | "boolean" | "date" | "json" | `${"string" | "number"}[]` | Array<LiteralString>;
+type DBPrimitive = string | number | boolean | Date | null | undefined | string[] | number[];
+type DBFieldAttributeConfig = {
+  /**
+   * If the field should be required on a new record.
+   * @default true
+   */
+  required?: boolean | undefined;
+  /**
+   * If the value should be returned on a response body.
+   * @default true
+   */
+  returned?: boolean | undefined;
+  /**
+   * If a value should be provided when creating a new record.
+   * @default true
+   */
+  input?: boolean | undefined;
+  /**
+   * Default value for the field
+   *
+   * Note: This will not create a default value on the database level. It will only
+   * be used when creating a new record.
+   */
+  defaultValue?: (DBPrimitive | (() => DBPrimitive)) | undefined;
+  /**
+   * Update value for the field
+   *
+   * Note: This will create an onUpdate trigger on the database level for supported adapters.
+   * It will be called when updating a record.
+   */
+  onUpdate?: (() => DBPrimitive) | undefined;
+  /**
+   * transform the value before storing it.
+   */
+  transform?: {
+    input?: (value: DBPrimitive) => DBPrimitive | Promise<DBPrimitive>;
+    output?: (value: DBPrimitive) => DBPrimitive | Promise<DBPrimitive>;
+  } | undefined;
+  /**
+   * Reference to another model.
+   */
+  references?: {
+    /**
+     * The model to reference.
+     */
+    model: string;
+    /**
+     * The field on the referenced model.
+     */
+    field: string;
+    /**
+     * The action to perform when the reference is deleted.
+     * @default "cascade"
+     */
+    onDelete?: "no action" | "restrict" | "cascade" | "set null" | "set default";
+  } | undefined;
+  unique?: boolean | undefined;
+  /**
+   * If the field should be a bigint on the database instead of integer.
+   */
+  bigint?: boolean | undefined;
+  /**
+   * A zod schema to validate the value.
+   */
+  validator?: {
+    input?: StandardSchemaV1$1;
+    output?: StandardSchemaV1$1;
+  } | undefined;
+  /**
+   * The name of the field on the database.
+   */
+  fieldName?: string | undefined;
+  /**
+   * If the field should be sortable.
+   *
+   * applicable only for `text` type.
+   * It's useful to mark fields varchar instead of text.
+   */
+  sortable?: boolean | undefined;
+};
+type DBFieldAttribute<T extends DBFieldType = DBFieldType> = {
+  type: T;
+} & DBFieldAttributeConfig;
+type PayvoAuthDBSchema = Record<string, {
+  /**
+   * The name of the table in the database
+   */
+  modelName: string;
+  /**
+   * The fields of the table
+   */
+  fields: Record<string, DBFieldAttribute>;
+  /**
+   * Whether to disable migrations for this table
+   * @default false
+   */
+  disableMigrations?: boolean | undefined;
+  /**
+   * The order of the table
+   */
+  order?: number | undefined;
+}>;
+interface SecondaryStorage {
+  /**
+   *
+   * @param key - Key to get
+   * @returns - Value of the key
+   */
+  get: (key: string) => Awaitable$1<unknown>;
+  /**
+   * Atomically get a value and delete it from storage.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. Single-use credential consumers use it when
+   * present to avoid a read-then-delete race.
+   *
+   * TODO(secondary-storage-atomic-consume): make this required in the next
+   * breaking release, or require database-backed verification storage for
+   * security-sensitive consume paths.
+   */
+  getAndDelete?: (key: string) => Awaitable$1<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
+   *
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. TODO(secondary-storage-increment-required): make
+   * this required for secondary-storage-backed rate limiting in the next minor
+   * on `next`.
+   */
+  increment?: (key: string, ttl: number) => Awaitable$1<number>;
+  set: (
+  /**
+   * Key to store
+   */
+  key: string,
+  /**
+   * Value to store
+   */
+  value: string,
+  /**
+   * Time to live in seconds
+   */
+  ttl?: number | undefined) => Awaitable$1<void | null | unknown>;
+  /**
+   *
+   * @param key - Key to delete
+   */
+  delete: (key: string) => Awaitable$1<void | null | string>;
+}
+//#endregion
+//#region src/db/plugin.d.ts
+type PayvoAuthPluginDBSchema = { [table in string]: {
+  fields: {
+    [field: string]: DBFieldAttribute;
+  };
+  disableMigration?: boolean | undefined;
+  modelName?: string | undefined;
+} };
+//#endregion
+//#region src/db/schema/account.d.ts
+declare const accountSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  providerId: z$1.ZodString;
+  accountId: z$1.ZodString;
+  userId: z$1.ZodCoercedString<unknown>;
+  accessToken: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  refreshToken: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  idToken: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  accessTokenExpiresAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodDate>>;
+  refreshTokenExpiresAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodDate>>;
+  scope: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  password: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+}, z$1.core.$strip>;
+/**
+ * Account schema type used by payvo-auth, note that it's possible that account could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type Account = z$1.infer<typeof accountSchema>;
+//#endregion
+//#region src/db/schema/rate-limit.d.ts
+declare const rateLimitSchema: z$1.ZodObject<{
+  key: z$1.ZodString;
+  count: z$1.ZodNumber;
+  lastRequest: z$1.ZodNumber;
+}, z$1.core.$strip>;
+/**
+ * Rate limit schema type used by payvo-auth for rate limiting
+ */
+type RateLimit = z$1.infer<typeof rateLimitSchema>;
+//#endregion
+//#region src/db/schema/session.d.ts
+declare const sessionSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  userId: z$1.ZodCoercedString<unknown>;
+  expiresAt: z$1.ZodDate;
+  token: z$1.ZodString;
+  ipAddress: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  userAgent: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+}, z$1.core.$strip>;
+/**
+ * Session schema type used by payvo-auth, note that it's possible that session could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type Session = z$1.infer<typeof sessionSchema>;
+//#endregion
+//#region src/db/schema/shared.d.ts
+
+//#endregion
+//#region src/db/schema/user.d.ts
+declare const userSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  email: z$1.ZodPipe<z$1.ZodString, z$1.ZodTransform<string, string>>;
+  emailVerified: z$1.ZodDefault<z$1.ZodBoolean>;
+  name: z$1.ZodString;
+  image: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+}, z$1.core.$strip>;
+/**
+ * User schema type used by payvo-auth, note that it's possible that user could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type User = z$1.infer<typeof userSchema>;
+//#endregion
+//#region src/db/schema/verification.d.ts
+declare const verificationSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  value: z$1.ZodString;
+  expiresAt: z$1.ZodDate;
+  identifier: z$1.ZodString;
+}, z$1.core.$strip>;
+/**
+ * Verification schema type used by payvo-auth, note that it's possible that verification could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type Verification = z$1.infer<typeof verificationSchema>;
+//#endregion
+//#region src/db/index.d.ts
+/**
+ * @deprecated Backport for 1.3.x, we will remove this in 1.4.x
+ */
+
+//#endregion
+//#region src/db/adapter/index.d.ts
+type DBAdapterDebugLogOption = boolean | {
+  /**
+   * Useful when you want to log only certain conditions.
+   */
+  logCondition?: (() => boolean) | undefined;
+  create?: boolean | undefined;
+  update?: boolean | undefined;
+  updateMany?: boolean | undefined;
+  findOne?: boolean | undefined;
+  findMany?: boolean | undefined;
+  delete?: boolean | undefined;
+  deleteMany?: boolean | undefined;
+  count?: boolean | undefined;
+} | {
+  /**
+   * Only used for adapter tests to show debug logs if a test fails.
+   *
+   * @deprecated Not actually deprecated. Doing this for IDEs to show this option at the very bottom and stop end-users from using this.
+   */
+  isRunningAdapterTests: boolean;
+};
+type DBAdapterSchemaCreation = {
+  /**
+   * Code to be inserted into the file
+   */
+  code: string;
+  /**
+   * Path to the file, including the file name and extension.
+   * Relative paths are supported, with the current working directory of the developer's project as the base.
+   */
+  path: string;
+  /**
+   * Append the file if it already exists.
+   * Note: This will not apply if `overwrite` is set to true.
+   */
+  append?: boolean | undefined;
+  /**
+   * Overwrite the file if it already exists
+   */
+  overwrite?: boolean | undefined;
+};
+interface DBAdapterFactoryConfig<Options extends PayvoAuthOptions = PayvoAuthOptions> {
+  /**
+   * Use plural table names.
+   *
+   * All tables will be named with an `s` at the end.
+   *
+   * @default false
+   */
+  usePlural?: boolean | undefined;
+  /**
+   * Enable debug logs.
+   *
+   * @default false
+   */
+  debugLogs?: DBAdapterDebugLogOption | undefined;
+  /**
+   * Name of the adapter.
+   *
+   * This is used to identify the adapter in the debug logs.
+   *
+   * @default `adapterId`
+   */
+  adapterName?: string | undefined;
+  /**
+   * Adapter id
+   */
+  adapterId: string;
+  /**
+   * If the database supports numeric ids, set this to `true`.
+   *
+   * @default true
+   */
+  supportsNumericIds?: boolean | undefined;
+  /**
+   * If the database doesn't support JSON columns, set this to `false`.
+   *
+   * We will handle the translation between using `JSON` columns, and saving `string`s to the database.
+   *
+   * @default false
+   */
+  supportsJSON?: boolean | undefined;
+  /**
+   * If the database doesn't support dates, set this to `false`.
+   *
+   * We will handle the translation between using `Date` objects, and saving `string`s to the database.
+   *
+   * @default true
+   */
+  supportsDates?: boolean | undefined;
+  /**
+   * If the database doesn't support booleans, set this to `false`.
+   *
+   * We will handle the translation between using `boolean`s, and saving `0`s and `1`s to the database.
+   *
+   * @default true
+   */
+  supportsBooleans?: boolean | undefined;
+  /**
+   * Execute multiple operations in a transaction.
+   *
+   * If the database doesn't support transactions, set this to `false` and operations will be executed sequentially.
+   *
+   * @default false
+   */
+  transaction?: (false | (<R>(callback: (trx: DBTransactionAdapter<Options>) => Promise<R>) => Promise<R>)) | undefined;
+  /**
+   * Disable id generation for the `create` method.
+   *
+   * This is useful for databases that don't support custom id values and would auto-generate them for you.
+   *
+   * @default false
+   */
+  disableIdGeneration?: boolean | undefined;
+  /**
+   * Map the keys of the input data.
+   *
+   * This is useful for databases that expect a different key name for a given situation.
+   *
+   * For example, MongoDB uses `_id` while in Payvo-Auth we use `id`.
+   *
+   *
+   * @example
+   * Each key represents the old key to replace.
+   * The value represents the new key
+   *
+   * This can be a partial object that only transforms some keys.
+   *
+   * ```ts
+   * mapKeysTransformInput: {
+   *  id: "_id" // We want to replace `id` to `_id` to save into MongoDB
+   * }
+   * ```
+   */
+  mapKeysTransformInput?: Record<string, string> | undefined;
+  /**
+   * Map the keys of the output data.
+   *
+   * This is useful for databases that expect a different key name for a given situation.
+   *
+   * For example, MongoDB uses `_id` while in Payvo-Auth we use `id`.
+   *
+   * @example
+   * Each key represents the old key to replace.
+   * The value represents the new key
+   *
+   * This can be a partial object that only transforms some keys.
+   *
+   * ```ts
+   * mapKeysTransformOutput: {
+   *  _id: "id" // In MongoDB, we save `id` as `_id`. So we want to replace `_id` with `id` when we get the data back.
+   * }
+   * ```
+   */
+  mapKeysTransformOutput?: Record<string, string> | undefined;
+  /**
+   * Custom transform input function.
+   *
+   * This function is used to transform the input data before it is saved to the database.
+   */
+  customTransformInput?: ((props: {
+    data: any;
+    /**
+     * The fields of the model.
+     */
+    fieldAttributes: DBFieldAttribute;
+    /**
+     * The field to transform.
+     */
+    field: string;
+    /**
+     * The action which was called from the adapter.
+     */
+    action: "create" | "update";
+    /**
+     * The model name.
+     */
+    model: string;
+    /**
+     * The schema of the user's Payvo-Auth instance.
+     */
+    schema: PayvoAuthDBSchema;
+    /**
+     * The options of the user's Payvo-Auth instance.
+     */
+    options: Options;
+  }) => any) | undefined;
+  /**
+   * Custom transform output function.
+   *
+   * This function is used to transform the output data before it is returned to the user.
+   */
+  customTransformOutput?: ((props: {
+    data: any;
+    /**
+     * The fields of the model.
+     */
+    fieldAttributes: DBFieldAttribute;
+    /**
+     * The field to transform.
+     */
+    field: string;
+    /**
+     * The fields to select.
+     */
+    select: string[];
+    /**
+     * The model name.
+     */
+    model: string;
+    /**
+     * The schema of the user's Payvo-Auth instance.
+     */
+    schema: PayvoAuthDBSchema;
+    /**
+     * The options of the user's Payvo-Auth instance.
+     */
+    options: Options;
+  }) => any) | undefined;
+  /**
+   * Custom ID generator function.
+   *
+   * By default, we can handle ID generation for you, however if the database your adapter is for only supports a specific custom id generation,
+   * then you can use this function to generate your own IDs.
+   *
+   *
+   * Notes:
+   * - If the user enabled `useNumberId`, then this option will be ignored. Unless this adapter config has `supportsNumericIds` set to `false`.
+   * - If `generateId` is `false` in the user's Payvo-Auth config, then this option will be ignored.
+   * - If `generateId` is a function, then it will override this option.
+   *
+   * @example
+   *
+   * ```ts
+   * customIdGenerator: ({ model }) => {
+   *  return "my-super-unique-id";
+   * }
+   * ```
+   */
+  customIdGenerator?: ((props: {
+    model: string;
+  }) => string) | undefined;
+  /**
+   * Whether to disable the transform output.
+   * Do not use this option unless you know what you are doing.
+   * @default false
+   */
+  disableTransformOutput?: boolean | undefined;
+  /**
+   * Whether to disable the transform input.
+   * Do not use this option unless you know what you are doing.
+   * @default false
+   */
+  disableTransformInput?: boolean | undefined;
+}
+type Where = {
+  /**
+   * @default eq
+   */
+  operator?: ("eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with") | undefined;
+  value: string | number | boolean | string[] | number[] | Date | null;
+  field: string;
+  /**
+   * @default AND
+   */
+  connector?: ("AND" | "OR") | undefined;
+};
+type DBTransactionAdapter<Options extends PayvoAuthOptions = PayvoAuthOptions> = Omit<DBAdapter<Options>, "transaction">;
+type DBAdapter<Options extends PayvoAuthOptions = PayvoAuthOptions> = {
+  id: string;
+  create: <T extends Record<string, any>, R = T>(data: {
+    model: string;
+    data: Omit<T, "id">;
+    select?: string[] | undefined;
+    /**
+     * By default, any `id` provided in `data` will be ignored.
+     *
+     * If you want to force the `id` to be the same as the `data.id`, set this to `true`.
+     */
+    forceAllowId?: boolean | undefined;
+  }) => Promise<R>;
+  findOne: <T>(data: {
+    model: string;
+    where: Where[];
+    select?: string[] | undefined;
+  }) => Promise<T | null>;
+  findMany: <T>(data: {
+    model: string;
+    where?: Where[] | undefined;
+    limit?: number | undefined;
+    sortBy?: {
+      field: string;
+      direction: "asc" | "desc";
+    } | undefined;
+    offset?: number | undefined;
+  }) => Promise<T[]>;
+  count: (data: {
+    model: string;
+    where?: Where[] | undefined;
+  }) => Promise<number>;
+  /**
+   * ⚠︎ Update may not return the updated data
+   * if multiple where clauses are provided
+   */
+  update: <T>(data: {
+    model: string;
+    where: Where[];
+    update: Record<string, any>;
+  }) => Promise<T | null>;
+  updateMany: (data: {
+    model: string;
+    where: Where[];
+    update: Record<string, any>;
+  }) => Promise<number>;
+  delete: <T>(data: {
+    model: string;
+    where: Where[];
+  }) => Promise<void>;
+  deleteMany: (data: {
+    model: string;
+    where: Where[];
+  }) => Promise<number>;
+  /**
+   * Execute multiple operations in a transaction.
+   * If the adapter doesn't support transactions, operations will be executed sequentially.
+   */
+  transaction: <R>(callback: (trx: DBTransactionAdapter<Options>) => Promise<R>) => Promise<R>;
+  /**
+   *
+   * @param options
+   * @param file - file path if provided by the user
+   */
+  createSchema?: ((options: Options, file?: string) => Promise<DBAdapterSchemaCreation>) | undefined;
+  options?: ({
+    adapterConfig: DBAdapterFactoryConfig<Options>;
+  } & CustomAdapter["options"]) | undefined;
+};
+type CleanedWhere = Required<Where>;
+interface CustomAdapter {
+  create: <T extends Record<string, any>>({
+    data,
+    model,
+    select
+  }: {
+    model: string;
+    data: T;
+    select?: string[] | undefined;
+  }) => Promise<T>;
+  update: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+    update: T;
+  }) => Promise<T | null>;
+  updateMany: (data: {
+    model: string;
+    where: CleanedWhere[];
+    update: Record<string, any>;
+  }) => Promise<number>;
+  findOne: <T>({
+    model,
+    where,
+    select
+  }: {
+    model: string;
+    where: CleanedWhere[];
+    select?: string[] | undefined;
+  }) => Promise<T | null>;
+  findMany: <T>({
+    model,
+    where,
+    limit,
+    sortBy,
+    offset
+  }: {
+    model: string;
+    where?: CleanedWhere[] | undefined;
+    limit: number;
+    sortBy?: {
+      field: string;
+      direction: "asc" | "desc";
+    } | undefined;
+    offset?: number | undefined;
+  }) => Promise<T[]>;
+  delete: ({
+    model,
+    where
+  }: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<void>;
+  deleteMany: ({
+    model,
+    where
+  }: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<number>;
+  count: ({
+    model,
+    where
+  }: {
+    model: string;
+    where?: CleanedWhere[] | undefined;
+  }) => Promise<number>;
+  createSchema?: ((props: {
+    /**
+     * The file the user may have passed in to the `generate` command as the expected schema file output path.
+     */
+    file?: string;
+    /**
+     * The tables from the user's Payvo-Auth instance schema.
+     */
+    tables: PayvoAuthDBSchema;
+  }) => Promise<DBAdapterSchemaCreation>) | undefined;
+  /**
+   * Your adapter's options.
+   */
+  options?: Record<string, any> | undefined;
+}
+interface DBAdapterInstance<Options extends PayvoAuthOptions = PayvoAuthOptions> {
+  (options: PayvoAuthOptions): DBAdapter<Options>;
+}
+//#endregion
+//#region src/oauth2/oauth-provider.d.ts
+interface OAuth2Tokens {
+  tokenType?: string | undefined;
+  accessToken?: string | undefined;
+  refreshToken?: string | undefined;
+  accessTokenExpiresAt?: Date | undefined;
+  refreshTokenExpiresAt?: Date | undefined;
+  scopes?: string[] | undefined;
+  idToken?: string | undefined;
+}
+type OAuth2UserInfo = {
+  id: string | number;
+  name?: string | undefined;
+  email?: (string | null) | undefined;
+  image?: string | undefined;
+  emailVerified: boolean;
+};
+interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
+  id: LiteralString;
+  createAuthorizationURL: (data: {
+    state: string;
+    codeVerifier: string;
+    scopes?: string[] | undefined;
+    redirectURI: string;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+  }) => Promise<URL> | URL;
+  name: string;
+  validateAuthorizationCode: (data: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens>;
+  getUserInfo: (token: OAuth2Tokens & {
+    /**
+     * The user object from the provider
+     * This is only available for some providers like Apple
+     */
+    user?: {
+      name?: {
+        firstName?: string;
+        lastName?: string;
+      };
+      email?: string;
+    } | undefined;
+  }) => Promise<{
+    user: OAuth2UserInfo;
+    data: T;
+  } | null>;
+  /**
+   * Custom function to refresh a token
+   */
+  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  revokeToken?: ((token: string) => Promise<void>) | undefined;
+  /**
+   * Verify the id token
+   * @param token - The id token
+   * @param nonce - The nonce
+   * @returns True if the id token is valid, false otherwise
+   */
+  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * Options for the provider
+   */
+  options?: O | undefined;
+}
+type ProviderOptions<Profile extends Record<string, any> = any> = {
+  /**
+   * The client ID of your application.
+   *
+   * This is usually a string but can be any type depending on the provider.
+   */
+  clientId?: unknown | undefined;
+  /**
+   * The client secret of your application
+   */
+  clientSecret?: string | undefined;
+  /**
+   * The scopes you want to request from the provider
+   */
+  scope?: string[] | undefined;
+  /**
+   * Remove default scopes of the provider
+   */
+  disableDefaultScope?: boolean | undefined;
+  /**
+   * The redirect URL for your application. This is where the provider will
+   * redirect the user after the sign in process. Make sure this URL is
+   * whitelisted in the provider's dashboard.
+   */
+  redirectURI?: string | undefined;
+  /**
+   * The client key of your application
+   * Tiktok Social Provider uses this field instead of clientId
+   */
+  clientKey?: string | undefined;
+  /**
+   * Disable provider from allowing users to sign in
+   * with this provider with an id token sent from the
+   * client.
+   */
+  disableIdTokenSignIn?: boolean | undefined;
+  /**
+   * verifyIdToken function to verify the id token
+   */
+  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  /**
+   * Custom function to get user info from the provider
+   */
+  getUserInfo?: ((token: OAuth2Tokens) => Promise<{
+    user: {
+      id: string;
+      name?: string;
+      email?: string | null;
+      image?: string;
+      emailVerified: boolean;
+      [key: string]: any;
+    };
+    data: any;
+  }>) | undefined;
+  /**
+   * Custom function to refresh a token
+   */
+  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  /**
+   * Custom function to map the provider profile to a
+   * user.
+   */
+  mapProfileToUser?: ((profile: Profile) => {
+    id?: string;
+    name?: string;
+    email?: string | null;
+    image?: string;
+    emailVerified?: boolean;
+    [key: string]: any;
+  } | Promise<{
+    id?: string;
+    name?: string;
+    email?: string | null;
+    image?: string;
+    emailVerified?: boolean;
+    [key: string]: any;
+  }>) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * The prompt to use for the authorization code request
+   */
+  prompt?: ("select_account" | "consent" | "login" | "none" | "select_account consent") | undefined;
+  /**
+   * The response mode to use for the authorization code request
+   */
+  responseMode?: ("query" | "form_post") | undefined;
+  /**
+   * If enabled, the user info will be overridden with the provider user info
+   * This is useful if you want to use the provider user info to update the user info
+   *
+   * @default false
+   */
+  overrideUserInfoOnSignIn?: boolean | undefined;
+};
+//#endregion
+//#region src/oauth2/client-credentials-token.d.ts
+
+//#endregion
+//#region src/types/cookie.d.ts
+type PayvoAuthCookies = {
+  sessionToken: {
+    name: string;
+    options: CookieOptions;
+  };
+  sessionData: {
+    name: string;
+    options: CookieOptions;
+  };
+  dontRememberToken: {
+    name: string;
+    options: CookieOptions;
+  };
+};
+//#endregion
+//#region src/types/helper.d.ts
+type Primitive = string | number | symbol | bigint | boolean | null | undefined;
+type Awaitable$1<T> = T | Promise<T>;
+type LiteralString = "" | (string & Record<never, never>);
+type LiteralUnion<LiteralType, BaseType extends Primitive> = LiteralType | (BaseType & Record<never, never>);
+//#endregion
+//#region src/social-providers/github.d.ts
+interface GithubProfile {
+  login: string;
+  id: string;
+  node_id: string;
+  avatar_url: string;
+  gravatar_id: string;
+  url: string;
+  html_url: string;
+  followers_url: string;
+  following_url: string;
+  gists_url: string;
+  starred_url: string;
+  subscriptions_url: string;
+  organizations_url: string;
+  repos_url: string;
+  events_url: string;
+  received_events_url: string;
+  type: string;
+  site_admin: boolean;
+  name: string;
+  company: string;
+  blog: string;
+  location: string;
+  email: string;
+  hireable: boolean;
+  bio: string;
+  twitter_username: string;
+  public_repos: string;
+  public_gists: string;
+  followers: string;
+  following: string;
+  created_at: string;
+  updated_at: string;
+  private_gists: string;
+  total_private_repos: string;
+  owned_private_repos: string;
+  disk_usage: string;
+  collaborators: string;
+  two_factor_authentication: boolean;
+  plan: {
+    name: string;
+    space: string;
+    private_repos: string;
+    collaborators: string;
+  };
+}
+interface GithubOptions extends ProviderOptions<GithubProfile> {
+  clientId: string;
+}
+//#endregion
+//#region src/social-providers/google.d.ts
+interface GoogleProfile {
+  aud: string;
+  azp: string;
+  email: string;
+  email_verified: boolean;
+  exp: number;
+  /**
+   * The family name of the user, or last name in most
+   * Western languages.
+   */
+  family_name: string;
+  /**
+   * The given name of the user, or first name in most
+   * Western languages.
+   */
+  given_name: string;
+  hd?: string | undefined;
+  iat: number;
+  iss: string;
+  jti?: string | undefined;
+  locale?: string | undefined;
+  name: string;
+  nbf?: number | undefined;
+  picture: string;
+  sub: string;
+}
+interface GoogleOptions extends ProviderOptions<GoogleProfile> {
+  clientId: string;
+  /**
+   * The access type to use for the authorization code request
+   */
+  accessType?: ("offline" | "online") | undefined;
+  /**
+   * The display mode to use for the authorization code request
+   */
+  display?: ("page" | "popup" | "touch" | "wap") | undefined;
+  /**
+   * The hosted domain of the user
+   */
+  hd?: string | undefined;
+}
+//#endregion
+//#region src/social-providers/index.d.ts
+declare const socialProviders: {
+  github: (options: GithubOptions) => {
+    id: "github";
+    name: string;
+    createAuthorizationURL({
+      state,
+      scopes,
+      loginHint,
+      redirectURI
+    }: {
+      state: string;
+      codeVerifier: string;
+      scopes?: string[] | undefined;
+      redirectURI: string;
+      display?: string | undefined;
+      loginHint?: string | undefined;
+    }): Promise<URL>;
+    validateAuthorizationCode: ({
+      code,
+      redirectURI
+    }: {
+      code: string;
+      redirectURI: string;
+      codeVerifier?: string | undefined;
+      deviceId?: string | undefined;
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+    getUserInfo(token: OAuth2Tokens & {
+      user?: {
+        name?: {
+          firstName?: string;
+          lastName?: string;
+        };
+        email?: string;
+      } | undefined;
+    }): Promise<{
+      user: {
+        id: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified: boolean;
+        [key: string]: any;
+      };
+      data: any;
+    } | null>;
+    options: GithubOptions;
+  };
+  google: (options: GoogleOptions) => {
+    id: "google";
+    name: string;
+    createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI,
+      loginHint,
+      display
+    }: {
+      state: string;
+      codeVerifier: string;
+      scopes?: string[] | undefined;
+      redirectURI: string;
+      display?: string | undefined;
+      loginHint?: string | undefined;
+    }): Promise<URL>;
+    validateAuthorizationCode: ({
+      code,
+      codeVerifier,
+      redirectURI
+    }: {
+      code: string;
+      redirectURI: string;
+      codeVerifier?: string | undefined;
+      deviceId?: string | undefined;
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    getUserInfo(token: OAuth2Tokens & {
+      user?: {
+        name?: {
+          firstName?: string;
+          lastName?: string;
+        };
+        email?: string;
+      } | undefined;
+    }): Promise<{
+      user: {
+        id: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified: boolean;
+        [key: string]: any;
+      };
+      data: any;
+    } | null>;
+    options: GoogleOptions;
+  };
+};
+declare const socialProviderList: ["github", ...(keyof typeof socialProviders)[]];
+type SocialProviders = { [K in SocialProviderList[number]]?: Parameters<(typeof socialProviders)[K]>[0] & {
+  enabled?: boolean | undefined;
+} };
+type SocialProviderList = typeof socialProviderList;
+//#endregion
+//#region src/types/plugin.d.ts
+type Awaitable<T> = T | Promise<T>;
+type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;
+type HookEndpointContext = Partial<EndpointContext<string, any> & Omit<InputContext<string, any>, "method">> & {
+  path: string;
+  context: AuthContext & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  };
+  headers?: Headers | undefined;
+};
+type PayvoAuthPlugin = {
+  id: LiteralString;
+  /**
+   * The init function is called when the plugin is initialized.
+   * You can return a new context or modify the existing context.
+   */
+  init?: ((ctx: AuthContext) => Awaitable<{
+    context?: DeepPartial<Omit<AuthContext, "options">>;
+    options?: Partial<PayvoAuthOptions>;
+  }> | void | Promise<void>) | undefined;
+  endpoints?: {
+    [key: string]: Endpoint;
+  } | undefined;
+  middlewares?: {
+    path: string;
+    middleware: Middleware;
+  }[] | undefined;
+  onRequest?: ((request: Request, ctx: AuthContext) => Promise<{
+    response: Response;
+  } | {
+    request: Request;
+  } | void>) | undefined;
+  onResponse?: ((response: Response, ctx: AuthContext) => Promise<{
+    response: Response;
+  } | void>) | undefined;
+  hooks?: {
+    before?: {
+      matcher: (context: HookEndpointContext) => boolean;
+      handler: AuthMiddleware;
+    }[];
+    after?: {
+      matcher: (context: HookEndpointContext) => boolean;
+      handler: AuthMiddleware;
+    }[];
+  } | undefined;
+  /**
+   * Schema the plugin needs
+   *
+   * This will also be used to migrate the database. If the fields are dynamic from the plugins
+   * configuration each time the configuration is changed a new migration will be created.
+   *
+   * NOTE: If you want to create migrations manually using
+   * migrations option or any other way you
+   * can disable migration per table basis.
+   *
+   * @example
+   * ```ts
+   * schema: {
+   * 	user: {
+   * 		fields: {
+   * 			email: {
+   * 				 type: "string",
+   * 			},
+   * 			emailVerified: {
+   * 				type: "boolean",
+   * 				defaultValue: false,
+   * 			},
+   * 		},
+   * 	}
+   * } as AuthPluginSchema
+   * ```
+   */
+  schema?: PayvoAuthPluginDBSchema | undefined;
+  /**
+   * The migrations of the plugin. If you define schema that will automatically create
+   * migrations for you.
+   *
+   * ⚠️ Only uses this if you dont't want to use the schema option and you disabled migrations for
+   * the tables.
+   */
+  migrations?: Record<string, Migration> | undefined;
+  /**
+   * The options of the plugin
+   */
+  options?: Record<string, any> | undefined;
+  /**
+   * types to be inferred
+   */
+  $Infer?: Record<string, any> | undefined;
+  /**
+   * The rate limit rules to apply to specific paths.
+   */
+  rateLimit?: {
+    window: number;
+    max: number;
+    pathMatcher: (path: string) => boolean;
+  }[] | undefined;
+  /**
+   * The error codes returned by the plugin
+   */
+  $ERROR_CODES?: Record<string, string> | undefined;
+  /**
+   * All database operations that are performed by the plugin
+   *
+   * This will override the default database operations
+   */
+  adapter?: {
+    [key: string]: (...args: any[]) => Promise<any> | any;
+  };
+};
+//#endregion
+//#region src/types/init-options.d.ts
+type KyselyDatabaseType = "postgres" | "mysql" | "sqlite" | "mssql";
+type OmitId<T extends {
+  id: unknown;
+}> = Omit<T, "id">;
+type Optional<T> = { [P in keyof T]?: T[P] | undefined };
+type GenerateIdFn = (options: {
+  model: LiteralUnion<DBPreservedModels, string>;
+  size?: number | undefined;
+}) => string | false;
+type PayvoAuthRateLimitOptions = {
+  /**
+   * By default, rate limiting is only
+   * enabled on production.
+   */
+  enabled?: boolean | undefined;
+  /**
+   * Default window to use for rate limiting. The value
+   * should be in seconds.
+   *
+   * @default 10 seconds
+   */
+  window?: number | undefined;
+  /**
+   * The default maximum number of requests allowed within the window.
+   *
+   * @default 100 requests
+   */
+  max?: number | undefined;
+  /**
+   * Custom rate limit rules to apply to
+   * specific paths.
+   */
+  customRules?: {
+    [key: string]: {
+      /**
+       * The window to use for the custom rule.
+       */
+      window: number;
+      /**
+       * The maximum number of requests allowed within the window.
+       */
+      max: number;
+    } | false | ((request: Request) => {
+      window: number;
+      max: number;
+    } | false | Promise<{
+      window: number;
+      max: number;
+    } | false>);
+  } | undefined;
+  /**
+   * Storage configuration
+   *
+   * By default, rate limiting is stored in memory. If you passed a
+   * secondary storage, rate limiting will be stored in the secondary
+   * storage.
+   *
+   * @default "memory"
+   */
+  storage?: ("memory" | "database" | "secondary-storage") | undefined;
+  /**
+   * If database is used as storage, the name of the table to
+   * use for rate limiting.
+   *
+   * @default "rateLimit"
+   */
+  modelName?: string | undefined;
+  /**
+   * Custom field names for the rate limit table
+   */
+  fields?: Record<keyof RateLimit, string> | undefined;
+  /**
+   * custom storage configuration.
+   *
+   * NOTE: If custom storage is used storage
+   * is ignored
+   */
+  customStorage?: {
+    get: (key: string) => Promise<RateLimit | undefined>;
+    set: (key: string, value: RateLimit) => Promise<void>;
+  };
+};
+type PayvoAuthAdvancedOptions = {
+  /**
+   * Ip address configuration
+   */
+  ipAddress?: {
+    /**
+     * List of headers to use for ip address
+     *
+     * Ip address is used for rate limiting and session tracking
+     *
+     * @example ["x-client-ip", "x-forwarded-for", "cf-connecting-ip"]
+     *
+     * @default
+     * @link https://github.com/payvo-auth/payvo-auth/blob/main/packages/payvo-auth/src/utils/get-request-ip.ts#L8
+     */
+    ipAddressHeaders?: string[];
+    /**
+     * Disable ip tracking
+     *
+     * ⚠︎ This is a security risk and it may expose your application to abuse
+     */
+    disableIpTracking?: boolean;
+  } | undefined;
+  /**
+   * Use secure cookies
+   *
+   * @default false
+   */
+  useSecureCookies?: boolean | undefined;
+  /**
+   * Disable trusted origins check
+   *
+   * ⚠︎ This is a security risk and it may expose your application to
+   * CSRF attacks
+   */
+  disableCSRFCheck?: boolean | undefined;
+  /**
+   * Disable origin check
+   *
+   * ⚠︎ This may allow requests from any origin to be processed by
+   * Payvo Auth. And could lead to security vulnerabilities.
+   */
+  disableOriginCheck?: boolean | undefined;
+  /**
+   * Configure cookies to be cross subdomains
+   */
+  crossSubDomainCookies?: {
+    /**
+     * Enable cross subdomain cookies
+     */
+    enabled: boolean;
+    /**
+     * Additional cookies to be shared across subdomains
+     */
+    additionalCookies?: string[];
+    /**
+     * The domain to use for the cookies
+     *
+     * By default, the domain will be the root
+     * domain from the base URL.
+     */
+    domain?: string;
+  } | undefined;
+  cookies?: {
+    [key: string]: {
+      name?: string;
+      attributes?: CookieOptions;
+    };
+  } | undefined;
+  defaultCookieAttributes?: CookieOptions | undefined;
+  /**
+   * Prefix for cookies. If a cookie name is provided
+   * in cookies config, this will be overridden.
+   *
+   * @default
+   * ```txt
+   * "appName" -> which defaults to "payvo-auth"
+   * ```
+   */
+  cookiePrefix?: string | undefined;
+  /**
+   * Database configuration.
+   */
+  database?: {
+    /**
+     * The default number of records to return from the database
+     * when using the `findMany` adapter method.
+     *
+     * @default 100
+     */
+    defaultFindManyLimit?: number;
+    /**
+     * If your database auto increments number ids, set this to `true`.
+     *
+     * Note: If enabled, we will not handle ID generation (including if you use `generateId`), and it would be expected that your database will provide the ID automatically.
+     *
+     * @default false
+     *
+     * @deprecated Please use `generateId` instead. This will be removed in future
+     * releases.
+     */
+    useNumberId?: boolean;
+    /**
+     * Custom generateId function.
+     *
+     * If not provided, random ids will be generated.
+     * If set to false, the database's auto generated id
+     * will be used.
+     *
+     * If set to "serial", the database's auto generated
+     * id will be used.
+     *
+     * If set to "uuid", we generate a random UUID for
+     * the id. If postgres, we use the `gen_random_uuid()
+     * ` function. If mysql or mssql, we use the `uuid()`
+     * function.
+     */
+    generateId?: GenerateIdFn | false | "serial" | "uuid";
+  } | undefined;
+  /**
+   * OAuth configuration
+   */
+  oauthConfig?: {
+    /**
+     * Skip state cookie check
+     *
+     * ⚠︎ this has security implications and should only be enabled if you know what you are doing.
+     * @default false
+     */
+    skipStateCookieCheck?: boolean;
+    /**
+     * Strategy for storing OAuth state
+     *
+     * - "cookie": Store state in an encrypted cookie (stateless)
+     * - "database": Store state in the database
+     *
+     * @default "cookie"
+     */
+    storeStateStrategy?: "database" | "cookie";
+  } | undefined;
+};
+type PayvoAuthOptions = {
+  /**
+   * The name of the application
+   *
+   * process.env.APP_NAME
+   *
+   * @default "Payvo Auth"
+   */
+  appName?: string | undefined;
+  /**
+   * Base URL for the Payvo Auth. This is typically the
+   * root URL where your application server is hosted.
+   * If not explicitly set,
+   * the system will check the following environment variable:
+   *
+   * process.env.PAYVO_AUTH_URL
+   */
+  baseURL?: string | undefined;
+  /**
+   * Base path for the Payvo Auth. This is typically
+   * the path where the
+   * Payvo Auth routes are mounted.
+   *
+   * @default "/api/auth"
+   */
+  basePath?: string | undefined;
+  /**
+   * The secret to use for encryption,
+   * signing and hashing.
+   *
+   * By default Payvo Auth will look for
+   * the following environment variables:
+   * process.env.PAYVO_AUTH_SECRET,
+   * process.env.AUTH_SECRET
+   * If none of these environment
+   * variables are set,
+   * it will default to
+   * "payvo-auth-secret-123456789".
+   *
+   * on production if it's not set
+   * it will throw an error.
+   *
+   * you can generate a good secret
+   * using the following command:
+   * @example
+   * ```bash
+   * openssl rand -base64 32
+   * ```
+   */
+  secret?: string | undefined;
+  /**
+   * Database configuration
+   */
+  database?: (PostgresPool | MysqlPool | SqliteDatabase | Dialect | DBAdapterInstance | Database | DatabaseSync | {
+    dialect: Dialect;
+    type: KyselyDatabaseType;
+    /**
+     * casing for table names
+     *
+     * @default "camel"
+     */
+    casing?: "snake" | "camel";
+    /**
+     * Enable debug logs for the adapter
+     *
+     * @default false
+     */
+    debugLogs?: DBAdapterDebugLogOption;
+    /**
+     * Whether to execute multiple operations in a transaction.
+     * If the database doesn't support transactions,
+     * set this to `false` and operations will be executed sequentially.
+     * @default true
+     */
+    transaction?: boolean;
+  } | {
+    /**
+     * Kysely instance
+     */
+    db: Kysely<any>;
+    /**
+     * Database type between postgres, mysql and sqlite
+     */
+    type: KyselyDatabaseType;
+    /**
+     * casing for table names
+     *
+     * @default "camel"
+     */
+    casing?: "snake" | "camel";
+    /**
+     * Enable debug logs for the adapter
+     *
+     * @default false
+     */
+    debugLogs?: DBAdapterDebugLogOption;
+    /**
+     * Whether to execute multiple operations in a transaction.
+     * If the database doesn't support transactions,
+     * set this to `false` and operations will be executed sequentially.
+     * @default true
+     */
+    transaction?: boolean;
+  }) | undefined;
+  /**
+   * Secondary storage configuration
+   *
+   * This is used to store session and rate limit data.
+   */
+  secondaryStorage?: SecondaryStorage | undefined;
+  /**
+   * Email verification configuration
+   */
+  emailVerification?: {
+    /**
+     * Send a verification email
+     * @param data the data object
+     * @param request the request object
+     */
+    sendVerificationEmail?: (
+    /**
+     * @param user the user to send the
+     * verification email to
+     * @param url the URL to send the verification email to
+     * it contains the token as well
+     * @param token the token to send the verification email to
+     */
+    data: {
+      user: User;
+      url: string;
+      token: string;
+    },
+    /**
+     * The request object
+     */
+    request?: Request) => Promise<void>;
+    /**
+     * Send a verification email automatically
+     * after sign up
+     *
+     * @default false
+     */
+    sendOnSignUp?: boolean;
+    /**
+     * Send a verification email automatically
+     * on sign in when the user's email is not verified
+     *
+     * @default false
+     */
+    sendOnSignIn?: boolean;
+    /**
+     * Auto signin the user after they verify their email
+     */
+    autoSignInAfterVerification?: boolean;
+    /**
+     * Number of seconds the verification token is
+     * valid for.
+     * @default 3600 seconds (1 hour)
+     */
+    expiresIn?: number;
+    /**
+     * A function that is called when a user verifies their email
+     * @param user the user that verified their email
+     * @param request the request object
+     */
+    onEmailVerification?: (user: User, request?: Request) => Promise<void>;
+    /**
+     * A function that is called when a user's email is updated to verified
+     * @param user the user that verified their email
+     * @param request the request object
+     */
+    afterEmailVerification?: (user: User, request?: Request) => Promise<void>;
+  } | undefined;
+  /**
+   * Email and password authentication
+   */
+  emailAndPassword?: {
+    /**
+     * Enable email and password authentication
+     *
+     * @default false
+     */
+    enabled: boolean;
+    /**
+     * Disable email and password sign up
+     *
+     * @default false
+     */
+    disableSignUp?: boolean;
+    /**
+     * Require email verification before a session
+     * can be created for the user.
+     *
+     * if the user is not verified, the user will not be able to sign in
+     * and on sign in attempts, the user will be prompted to verify their email.
+     */
+    requireEmailVerification?: boolean;
+    /**
+     * The maximum length of the password.
+     *
+     * @default 128
+     */
+    maxPasswordLength?: number;
+    /**
+     * The minimum length of the password.
+     *
+     * @default 8
+     */
+    minPasswordLength?: number;
+    /**
+     * send reset password
+     */
+    sendResetPassword?: (
+    /**
+     * @param user the user to send the
+     * reset password email to
+     * @param url the URL to send the reset password email to
+     * @param token the token to send to the user (could be used instead of sending the url
+     * if you need to redirect the user to custom route)
+     */
+    data: {
+      user: User;
+      url: string;
+      token: string;
+    },
+    /**
+     * The request object
+     */
+    request?: Request) => Promise<void>;
+    /**
+     * Number of seconds the reset password token is
+     * valid for.
+     * @default 1 hour (60 * 60)
+     */
+    resetPasswordTokenExpiresIn?: number;
+    /**
+     * A callback function that is triggered
+     * when a user's password is changed successfully.
+     */
+    onPasswordReset?: (data: {
+      user: User;
+    }, request?: Request) => Promise<void>;
+    /**
+     * Password hashing and verification
+     *
+     * By default Scrypt is used for password hashing and
+     * verification. You can provide your own hashing and
+     * verification function. if you want to use a
+     * different algorithm.
+     */
+    password?: {
+      hash?: (password: string) => Promise<string>;
+      verify?: (data: {
+        hash: string;
+        password: string;
+      }) => Promise<boolean>;
+    };
+    /**
+     * Automatically sign in the user after sign up
+     *
+     * @default true
+     */
+    autoSignIn?: boolean;
+    /**
+     * Whether to revoke all other sessions when resetting password
+     * @default false
+     */
+    revokeSessionsOnPasswordReset?: boolean;
+  } | undefined;
+  /**
+   * list of social providers
+   */
+  socialProviders?: SocialProviders | undefined;
+  /**
+   * List of Payvo Auth plugins
+   */
+  plugins?: ([] | PayvoAuthPlugin[]) | undefined;
+  /**
+   * User configuration
+   */
+  user?: {
+    /**
+     * The model name for the user. Defaults to "user".
+     */
+    modelName?: string;
+    /**
+     * Map fields
+     *
+     * @example
+     * ```ts
+     * {
+     *  userId: "user_id"
+     * }
+     * ```
+     */
+    fields?: Partial<Record<keyof OmitId<User>, string>>;
+    /**
+     * Additional fields for the user
+     */
+    additionalFields?: {
+      [key: string]: DBFieldAttribute;
+    };
+    /**
+     * Changing email configuration
+     */
+    changeEmail?: {
+      /**
+       * Enable changing email
+       * @default false
+       */
+      enabled: boolean;
+      /**
+       * Send a verification email when the user changes their email.
+       * @param data the data object
+       * @param request the request object
+       */
+      sendChangeEmailVerification?: (data: {
+        user: User;
+        newEmail: string;
+        url: string;
+        token: string;
+      }, request?: Request) => Promise<void>;
+    };
+    /**
+     * User deletion configuration
+     */
+    deleteUser?: {
+      /**
+       * Enable user deletion
+       */
+      enabled?: boolean;
+      /**
+       * Send a verification email when the user deletes their account.
+       *
+       * if this is not set, the user will be deleted immediately.
+       * @param data the data object
+       * @param request the request object
+       */
+      sendDeleteAccountVerification?: (data: {
+        user: User;
+        url: string;
+        token: string;
+      }, request?: Request) => Promise<void>;
+      /**
+       * A function that is called before a user is deleted.
+       *
+       * to interrupt with error you can throw `APIError`
+       */
+      beforeDelete?: (user: User, request?: Request) => Promise<void>;
+      /**
+       * A function that is called after a user is deleted.
+       *
+       * This is useful for cleaning up user data
+       */
+      afterDelete?: (user: User, request?: Request) => Promise<void>;
+      /**
+       * The expiration time for the delete token.
+       *
+       * @default 1 day (60 * 60 * 24) in seconds
+       */
+      deleteTokenExpiresIn?: number;
+    };
+  } | undefined;
+  session?: {
+    /**
+     * The model name for the session.
+     *
+     * @default "session"
+     */
+    modelName?: string;
+    /**
+     * Map fields
+     *
+     * @example
+     * ```ts
+     * {
+     *  userId: "user_id"
+     * }
+     */
+    fields?: Partial<Record<keyof OmitId<Session>, string>>;
+    /**
+     * Expiration time for the session token. The value
+     * should be in seconds.
+     * @default 7 days (60 * 60 * 24 * 7)
+     */
+    expiresIn?: number;
+    /**
+     * How often the session should be refreshed. The value
+     * should be in seconds.
+     * If set 0 the session will be refreshed every time it is used.
+     * @default 1 day (60 * 60 * 24)
+     */
+    updateAge?: number;
+    /**
+     * Disable session refresh so that the session is not updated
+     * regardless of the `updateAge` option.
+     *
+     * @default false
+     */
+    disableSessionRefresh?: boolean;
+    /**
+     * Additional fields for the session
+     */
+    additionalFields?: {
+      [key: string]: DBFieldAttribute;
+    };
+    /**
+     * By default if secondary storage is provided
+     * the session is stored in the secondary storage.
+     *
+     * Set this to true to store the session in the database
+     * as well.
+     *
+     * Reads are always done from the secondary storage.
+     *
+     * @default false
+     */
+    storeSessionInDatabase?: boolean;
+    /**
+     * By default, sessions are deleted from the database when secondary storage
+     * is provided when session is revoked.
+     *
+     * Set this to true to preserve session records in the database,
+     * even if they are deleted from the secondary storage.
+     *
+     * @default false
+     */
+    preserveSessionInDatabase?: boolean;
+    /**
+     * Enable caching session in cookie
+     */
+    cookieCache?: {
+      /**
+       * max age of the cookie
+       * @default 5 minutes (5 * 60)
+       */
+      maxAge?: number;
+      /**
+       * Enable caching session in cookie
+       * @default false
+       */
+      enabled?: boolean;
+      /**
+       * Strategy for encoding/decoding cookie cache
+       *
+       * - "compact": Uses base64url encoding with HMAC-SHA256 signature (compact format, no JWT spec overhead)
+       * - "jwt": Uses JWT with HMAC signature (no encryption, follows JWT spec)
+       * - "jwe": Uses JWE (JSON Web Encryption) with A256CBC-HS512 and HKDF key derivation for secure encrypted tokens
+       *
+       * @default "compact"
+       */
+      strategy?: "compact" | "jwt" | "jwe";
+      /**
+       * Controls stateless cookie cache refresh behavior.
+       *
+       * When enabled, the cookie cache will be automatically refreshed before expiry
+       * WITHOUT querying the database. This is essential for fully stateless or DB-less scenarios.
+       *
+       * - `false`: Disable automatic refresh. Cache is only invalidated when it reaches maxAge expiry.
+       * - `true`: Enable automatic refresh with default settings (refreshes when 80% of maxAge is reached).
+       * - `object`: Custom refresh configuration with either `updateAge` or `shouldRefresh` function
+       *
+       * Note: When the cache expires (reaches maxAge), it will attempt to fetch from database if available.
+       * The refreshCache option is specifically for refreshing BEFORE expiry in a stateless manner.
+       *
+       * @default false
+       */
+      refreshCache?: boolean | {
+        /**
+         * Time in seconds before expiry when the cache should be refreshed.
+         * For example, if maxAge is 300 (5 minutes) and updateAge is 60,
+         * the cache will be refreshed when it has 60 seconds left before expiry.
+         *
+         * @default 20% of maxAge
+         */
+        updateAge?: number;
+      };
+      /**
+       * Version of the cookie cache
+       *
+       * If a cookie cache version is changed, all existing cookie caches with the old version
+       * will be invalidated.
+       *
+       * It can be a string or a function that returns a string or a promise that returns a string.
+       * If it's a function, it will be called with the session and user data
+       *
+       * @default "1"
+       */
+      version?: string | ((session: Session & Record<string, any>, user: User & Record<string, any>) => string) | ((session: Session & Record<string, any>, user: User & Record<string, any>) => Promise<string>);
+    };
+    /**
+     * The age of the session to consider it fresh.
+     *
+     * This is used to check if the session is fresh
+     * for sensitive operations. (e.g. deleting an account)
+     *
+     * If the session is not fresh, the user should be prompted
+     * to sign in again.
+     *
+     * If set to 0, the session will be considered fresh every time. (⚠︎ not recommended)
+     *
+     * @default 1 day (60 * 60 * 24)
+     */
+    freshAge?: number;
+  } | undefined;
+  account?: {
+    /**
+     * The model name for the account. Defaults to "account".
+     */
+    modelName?: string;
+    /**
+     * Map fields
+     */
+    fields?: Partial<Record<keyof OmitId<Account>, string>>;
+    /**
+     * Additional fields for the account
+     */
+    additionalFields?: {
+      [key: string]: DBFieldAttribute;
+    };
+    /**
+     * When enabled (true), the user account data (accessToken, idToken, refreshToken, etc.)
+     * will be updated on sign in with the latest data from the provider.
+     *
+     * @default true
+     */
+    updateAccountOnSignIn?: boolean;
+    /**
+     * Configuration for account linking.
+     */
+    accountLinking?: {
+      /**
+       * Enable account linking
+       *
+       * @default true
+       */
+      enabled?: boolean;
+      /**
+       * List of trusted providers
+       */
+      trustedProviders?: Array<LiteralUnion<SocialProviderList[number] | "email-password", string>>;
+      /**
+       * If enabled (true), this will allow users to manually linking accounts with different email addresses than the main user.
+       *
+       * @default false
+       *
+       * ⚠️ Warning: enabling this might lead to account takeovers, so proceed with caution.
+       */
+      allowDifferentEmails?: boolean;
+      /**
+       * If enabled (true), this will allow users to unlink all accounts.
+       *
+       * @default false
+       */
+      allowUnlinkingAll?: boolean;
+      /**
+       * If enabled (true), this will update the user information based on the newly linked account
+       *
+       * @default false
+       */
+      updateUserInfoOnLink?: boolean;
+    };
+    /**
+     * Encrypt OAuth tokens
+     *
+     * By default, OAuth tokens (access tokens, refresh tokens, ID tokens) are stored in plain text in the database.
+     * This poses a security risk if your database is compromised, as attackers could gain access to user accounts
+     * on external services.
+     *
+     * When enabled, tokens are encrypted using AES-256-GCM before storage, providing protection against:
+     * - Database breaches and unauthorized access to raw token data
+     * - Internal threats from database administrators or compromised credentials
+     * - Token exposure in database backups and logs
+     * @default false
+     */
+    encryptOAuthTokens?: boolean;
+  } | undefined;
+  /**
+   * Verification configuration
+   */
+  verification?: {
+    /**
+     * Change the modelName of the verification table
+     */
+    modelName?: string;
+    /**
+     * Map verification fields
+     */
+    fields?: Partial<Record<keyof OmitId<Verification>, string>>;
+    /**
+     * disable cleaning up expired values when a verification value is
+     * fetched
+     */
+    disableCleanup?: boolean;
+  } | undefined;
+  /**
+   * List of trusted origins.
+   */
+  trustedOrigins?: (string[] | ((request: Request) => string[] | Promise<string[]>)) | undefined;
+  /**
+   * Rate limiting configuration
+   */
+  rateLimit?: PayvoAuthRateLimitOptions | undefined;
+  /**
+   * Advanced options
+   */
+  advanced?: (PayvoAuthAdvancedOptions & {
+    /**
+     * @deprecated Please use `database.generateId` instead.
+     */
+    generateId?: never;
+  }) | undefined;
+  logger?: Logger | undefined;
+  /**
+   * allows you to define custom hooks that can be
+   * executed during lifecycle of core database
+   * operations.
+   */
+  databaseHooks?: {
+    /**
+     * User hooks
+     */
+    user?: {
+      create?: {
+        /**
+         * Hook that is called before a user is created.
+         * if the hook returns false, the user will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<User> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a user is created.
+         */
+        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      update?: {
+        /**
+         * Hook that is called before a user is updated.
+         * if the hook returns false, the user will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (user: Partial<User> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<User & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a user is updated.
+         */
+        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before a user is deleted.
+         * if the hook returns false, the user will not be deleted.
+         */
+        before?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after a user is deleted.
+         */
+        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+    /**
+     * Session Hook
+     */
+    session?: {
+      create?: {
+        /**
+         * Hook that is called before a session is created.
+         * if the hook returns false, the session will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Session> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a session is created.
+         */
+        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      /**
+       * Update hook
+       */
+      update?: {
+        /**
+         * Hook that is called before a user is updated.
+         * if the hook returns false, the session will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (session: Partial<Session> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Session & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a session is updated.
+         */
+        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before a session is deleted.
+         * if the hook returns false, the session will not be deleted.
+         */
+        before?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after a session is deleted.
+         */
+        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+    /**
+     * Account Hook
+     */
+    account?: {
+      create?: {
+        /**
+         * Hook that is called before a account is created.
+         * If the hook returns false, the account will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (account: Account, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Account> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a account is created.
+         */
+        after?: (account: Account, context?: GenericEndpointContext) => Promise<void>;
+      };
+      /**
+       * Update hook
+       */
+      update?: {
+        /**
+         * Hook that is called before a account is update.
+         * If the hook returns false, the user will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (account: Partial<Account> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Account & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a account is updated.
+         */
+        after?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before an account is deleted.
+         * if the hook returns false, the account will not be deleted.
+         */
+        before?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after an account is deleted.
+         */
+        after?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+    /**
+     * Verification Hook
+     */
+    verification?: {
+      create?: {
+        /**
+         * Hook that is called before a verification is created.
+         * if the hook returns false, the verification will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Verification> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a verification is created.
+         */
+        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      update?: {
+        /**
+         * Hook that is called before a verification is updated.
+         * if the hook returns false, the verification will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (verification: Partial<Verification> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Verification & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a verification is updated.
+         */
+        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before a verification is deleted.
+         * if the hook returns false, the verification will not be deleted.
+         */
+        before?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after a verification is deleted.
+         */
+        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+  } | undefined;
+  /**
+   * API error handling
+   */
+  onAPIError?: {
+    /**
+     * Throw an error on API error
+     *
+     * @default false
+     */
+    throw?: boolean;
+    /**
+     * Custom error handler
+     *
+     * @param error
+     * @param ctx - Auth context
+     */
+    onError?: (error: unknown, ctx: AuthContext) => void | Promise<void>;
+    /**
+     * The URL to redirect to on error
+     *
+     * When errorURL is provided, the error will be added to the URL as a query parameter
+     * and the user will be redirected to the errorURL.
+     *
+     * @default - "/api/auth/error"
+     */
+    errorURL?: string;
+    /**
+     * Configure the default error page provided by Payvo-Auth
+     * Start your dev server and go to /api/auth/error to see the error page.
+     */
+    customizeDefaultErrorPage?: {
+      colors?: {
+        background?: string;
+        foreground?: string;
+        primary?: string;
+        primaryForeground?: string;
+        mutedForeground?: string;
+        border?: string;
+        destructive?: string;
+        titleBorder?: string;
+        titleColor?: string;
+        gridColor?: string;
+        cardBackground?: string;
+        cornerBorder?: string;
+      };
+      size?: {
+        radiusSm?: string;
+        radiusMd?: string;
+        radiusLg?: string;
+        textSm?: string;
+        text2xl?: string;
+        text4xl?: string;
+        text6xl?: string;
+      };
+      font?: {
+        defaultFamily?: string;
+        monoFamily?: string;
+      };
+      disableTitleBorder?: boolean;
+      disableCornerDecorations?: boolean;
+      disableBackgroundGrid?: boolean;
+    };
+  } | undefined;
+  /**
+   * Hooks
+   */
+  hooks?: {
+    /**
+     * Before a request is processed
+     */
+    before?: AuthMiddleware;
+    /**
+     * After a request is processed
+     */
+    after?: AuthMiddleware;
+  } | undefined;
+  /**
+   * Disabled paths
+   *
+   * Paths you want to disable.
+   */
+  disabledPaths?: string[] | undefined;
+  /**
+   * Telemetry configuration
+   */
+  telemetry?: {
+    /**
+     * Enable telemetry collection
+     *
+     * @default false
+     */
+    enabled?: boolean;
+    /**
+     * Enable debug mode
+     *
+     * @default false
+     */
+    debug?: boolean;
+  } | undefined;
+};
+//#endregion
+//#region src/types/context.d.ts
+type GenericEndpointContext<Options extends PayvoAuthOptions = PayvoAuthOptions> = EndpointContext<string, any> & {
+  context: AuthContext<Options>;
+};
+interface InternalAdapter<Options extends PayvoAuthOptions = PayvoAuthOptions> {
+  createOAuthUser(user: Omit<User, "id" | "createdAt" | "updatedAt">, account: Omit<Account, "userId" | "id" | "createdAt" | "updatedAt"> & Partial<Account>): Promise<{
+    user: User;
+    account: Account;
+  }>;
+  createUser<T extends Record<string, any>>(user: Omit<User, "id" | "createdAt" | "updatedAt" | "emailVerified"> & Partial<User> & Record<string, any>): Promise<T & User>;
+  createAccount<T extends Record<string, any>>(account: Omit<Account, "id" | "createdAt" | "updatedAt"> & Partial<Account> & T): Promise<T & Account>;
+  listSessions(userId: string): Promise<Session[]>;
+  listUsers(limit?: number | undefined, offset?: number | undefined, sortBy?: {
+    field: string;
+    direction: "asc" | "desc";
+  } | undefined, where?: Where[] | undefined): Promise<User[]>;
+  countTotalUsers(where?: Where[] | undefined): Promise<number>;
+  deleteUser(userId: string): Promise<void>;
+  createSession(userId: string, dontRememberMe?: boolean | undefined, override?: (Partial<Session> & Record<string, any>) | undefined, overrideAll?: boolean | undefined): Promise<Session>;
+  findSession(token: string): Promise<{
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null>;
+  findSessions(sessionTokens: string[]): Promise<{
+    session: Session;
+    user: User;
+  }[]>;
+  updateSession(sessionToken: string, session: Partial<Session> & Record<string, any>): Promise<Session | null>;
+  deleteSession(token: string): Promise<void>;
+  deleteAccounts(userId: string): Promise<void>;
+  deleteAccount(accountId: string): Promise<void>;
+  deleteSessions(userIdOrSessionTokens: string | string[]): Promise<void>;
+  findOAuthUser(email: string, accountId: string, providerId: string): Promise<{
+    user: User;
+    accounts: Account[];
+  } | null>;
+  findUserByEmail(email: string, options?: {
+    includeAccounts: boolean;
+  } | undefined): Promise<{
+    user: User;
+    accounts: Account[];
+  } | null>;
+  findUserById(userId: string): Promise<User | null>;
+  linkAccount(account: Omit<Account, "id" | "createdAt" | "updatedAt"> & Partial<Account>): Promise<Account>;
+  updateUser(userId: string, data: Partial<User> & Record<string, any>): Promise<any>;
+  updateUserByEmail(email: string, data: Partial<User & Record<string, any>>): Promise<User>;
+  updatePassword(userId: string, password: string): Promise<void>;
+  findAccounts(userId: string): Promise<Account[]>;
+  findAccount(accountId: string): Promise<Account | null>;
+  findAccountByProviderId(accountId: string, providerId: string): Promise<Account | null>;
+  findAccountByUserId(userId: string): Promise<Account[]>;
+  updateAccount(id: string, data: Partial<Account>): Promise<Account>;
+  createVerificationValue(data: Omit<Verification, "createdAt" | "id" | "updatedAt"> & Partial<Verification>): Promise<Verification>;
+  findVerificationValue(identifier: string): Promise<Verification | null>;
+  deleteVerificationValue(id: string): Promise<void>;
+  deleteVerificationByIdentifier(identifier: string): Promise<void>;
+  updateVerificationValue(id: string, data: Partial<Verification>): Promise<Verification>;
+}
+type CreateCookieGetterFn = (cookieName: string, overrideAttributes?: Partial<CookieOptions> | undefined) => {
+  name: string;
+  attributes: CookieOptions;
+};
+type CheckPasswordFn<Options extends PayvoAuthOptions = PayvoAuthOptions> = (userId: string, ctx: GenericEndpointContext<Options>) => Promise<boolean>;
+type AuthContext<Options extends PayvoAuthOptions = PayvoAuthOptions> = {
+  options: Options;
+  appName: string;
+  baseURL: string;
+  trustedOrigins: string[];
+  oauthConfig: {
+    /**
+     * This is dangerous and should only be used in dev or staging environments.
+     */
+    skipStateCookieCheck?: boolean | undefined;
+    /**
+     * Strategy for storing OAuth state
+     *
+     * - "cookie": Store state in an encrypted cookie (stateless)
+     * - "database": Store state in the database
+     *
+     * @default "cookie"
+     */
+    storeStateStrategy: "database" | "cookie";
+  };
+  /**
+   * New session that will be set after the request
+   * meaning: there is a `set-cookie` header that will set
+   * the session cookie. This is the fetched session. And it's set
+   * by `setNewSession` method.
+   */
+  newSession: {
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null;
+  session: {
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null;
+  setNewSession: (session: {
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null) => void;
+  socialProviders: OAuthProvider[];
+  authCookies: PayvoAuthCookies;
+  logger: ReturnType<typeof createLogger>;
+  rateLimit: {
+    enabled: boolean;
+    window: number;
+    max: number;
+    storage: "memory" | "database" | "secondary-storage";
+  } & PayvoAuthRateLimitOptions;
+  adapter: DBAdapter<Options>;
+  internalAdapter: InternalAdapter<Options>;
+  createAuthCookie: CreateCookieGetterFn;
+  secret: string;
+  sessionConfig: {
+    updateAge: number;
+    expiresIn: number;
+    freshAge: number;
+    cookieRefreshCache: false | {
+      enabled: true;
+      updateAge: number;
+    };
+  };
+  generateId: (options: {
+    model: LiteralUnion<DBPreservedModels, string>;
+    size?: number | undefined;
+  }) => string | false;
+  secondaryStorage: SecondaryStorage | undefined;
+  password: {
+    hash: (password: string) => Promise<string>;
+    verify: (data: {
+      password: string;
+      hash: string;
+    }) => Promise<boolean>;
+    config: {
+      minPasswordLength: number;
+      maxPasswordLength: number;
+    };
+    checkPassword: CheckPasswordFn<Options>;
+  };
+  tables: PayvoAuthDBSchema;
+  runMigrations: () => Promise<void>;
+  publishTelemetry: (event: {
+    type: string;
+    anonymousId?: string | undefined;
+    payload: Record<string, any>;
+  }) => Promise<void>;
+  /**
+   * This skips the origin check for all requests.
+   *
+   * set to true by default for `test` environments and `false`
+   * for other environments.
+   *
+   * It's inferred from the `options.advanced?.disableCSRFCheck`
+   * option or `options.advanced?.disableOriginCheck` option.
+   *
+   * @default false
+   */
+  skipOriginCheck: boolean;
+  /**
+   * This skips the CSRF check for all requests.
+   *
+   * This is inferred from the `options.advanced?.
+   * disableCSRFCheck` option.
+   *
+   * @default false
+   */
+  skipCSRFCheck: boolean;
+};
+//#endregion
+//#region src/types/plugin-client.d.ts
+
+declare const createAuthMiddleware: {
+  <Options extends better_call0.MiddlewareOptions, R>(options: Options, handler: (ctx: better_call0.MiddlewareContext<Options, AuthContext & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  }>) => Promise<R>): (inputContext: better_call0.MiddlewareInputContext<Options>) => Promise<R>;
+  <Options extends better_call0.MiddlewareOptions, R_1>(handler: (ctx: better_call0.MiddlewareContext<Options, AuthContext & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  }>) => Promise<R_1>): (inputContext: better_call0.MiddlewareInputContext<Options>) => Promise<R_1>;
+};
+type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
+//#endregion
+//#endregion
+export { OAuth2UserInfo as a, OAuth2Tokens as i, DBPrimitive as n, Session as o, GenericEndpointContext as r, User as s, DBAdapter as t };