@gatwech/core 0.0.10 → 1.0.0-beta.18

package/dist/index-65G5U5DB.d.mts

@@ -0,0 +1,3002 @@
+import { i as Logger, o as createLogger } from "./index-CmdhhvA2.mjs";
+import * as better_call0 from "better-call";
+import { CookieOptions, Endpoint, EndpointContext, EndpointOptions, InputContext, Middleware } from "better-call";
+import * as z$1 from "zod";
+import { BetterFetch, BetterFetchOption, BetterFetchPlugin } from "@better-fetch/fetch";
+import * as jose0 from "jose";
+import { StandardSchemaV1, StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
+import { Database } from "bun:sqlite";
+import { DatabaseSync } from "node:sqlite";
+import { Dialect, Kysely, Migration, MysqlPool, PostgresPool, SqliteDatabase } from "kysely";
+import { Atom, WritableAtom } from "nanostores";
+
+//#region src/db/type.d.ts
+type DBPreservedModels = "user" | "account" | "session" | "verification" | "rate-limit" | "organization" | "member" | "invitation" | "jwks" | "passkey" | "two-factor";
+type DBFieldType = "string" | "number" | "boolean" | "date" | "json" | `${"string" | "number"}[]` | Array<LiteralString>;
+type DBPrimitive = string | number | boolean | Date | null | undefined | string[] | number[];
+type DBFieldAttributeConfig = {
+  /**
+   * If the field should be required on a new record.
+   * @default true
+   */
+  required?: boolean | undefined;
+  /**
+   * If the value should be returned on a response body.
+   * @default true
+   */
+  returned?: boolean | undefined;
+  /**
+   * If a value should be provided when creating a new record.
+   * @default true
+   */
+  input?: boolean | undefined;
+  /**
+   * Default value for the field
+   *
+   * Note: This will not create a default value on the database level. It will only
+   * be used when creating a new record.
+   */
+  defaultValue?: (DBPrimitive | (() => DBPrimitive)) | undefined;
+  /**
+   * Update value for the field
+   *
+   * Note: This will create an onUpdate trigger on the database level for supported adapters.
+   * It will be called when updating a record.
+   */
+  onUpdate?: (() => DBPrimitive) | undefined;
+  /**
+   * transform the value before storing it.
+   */
+  transform?: {
+    input?: (value: DBPrimitive) => DBPrimitive | Promise<DBPrimitive>;
+    output?: (value: DBPrimitive) => DBPrimitive | Promise<DBPrimitive>;
+  } | undefined;
+  /**
+   * Reference to another model.
+   */
+  references?: {
+    /**
+     * The model to reference.
+     */
+    model: string;
+    /**
+     * The field on the referenced model.
+     */
+    field: string;
+    /**
+     * The action to perform when the reference is deleted.
+     * @default "cascade"
+     */
+    onDelete?: "no action" | "restrict" | "cascade" | "set null" | "set default";
+  } | undefined;
+  unique?: boolean | undefined;
+  /**
+   * If the field should be a bigint on the database instead of integer.
+   */
+  bigint?: boolean | undefined;
+  /**
+   * A zod schema to validate the value.
+   */
+  validator?: {
+    input?: StandardSchemaV1;
+    output?: StandardSchemaV1;
+  } | undefined;
+  /**
+   * The name of the field on the database.
+   */
+  fieldName?: string | undefined;
+  /**
+   * If the field should be sortable.
+   *
+   * applicable only for `text` type.
+   * It's useful to mark fields varchar instead of text.
+   */
+  sortable?: boolean | undefined;
+};
+type DBFieldAttribute<T extends DBFieldType = DBFieldType> = {
+  type: T;
+} & DBFieldAttributeConfig;
+type PayvoAuthDBSchema = Record<string, {
+  /**
+   * The name of the table in the database
+   */
+  modelName: string;
+  /**
+   * The fields of the table
+   */
+  fields: Record<string, DBFieldAttribute>;
+  /**
+   * Whether to disable migrations for this table
+   * @default false
+   */
+  disableMigrations?: boolean | undefined;
+  /**
+   * The order of the table
+   */
+  order?: number | undefined;
+}>;
+interface SecondaryStorage {
+  /**
+   *
+   * @param key - Key to get
+   * @returns - Value of the key
+   */
+  get: (key: string) => Awaitable$1<unknown>;
+  /**
+   * Atomically get a value and delete it from storage.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. Single-use credential consumers use it when
+   * present to avoid a read-then-delete race.
+   *
+   * TODO(secondary-storage-atomic-consume): make this required in the next
+   * breaking release, or require database-backed verification storage for
+   * security-sensitive consume paths.
+   */
+  getAndDelete?: (key: string) => Awaitable$1<unknown>;
+  /**
+   * Atomically increment the counter at `key` by one, returning the
+   * post-increment value.
+   *
+   * When the key is absent, it is created with a value of `1` and the given
+   * `ttl` (in SECONDS). The TTL is applied only on creation; later increments
+   * never extend it, so the counter expires a fixed window after it was first
+   * created.
+   *
+   * This is optional for backwards compatibility with existing secondary
+   * storage implementations. TODO(secondary-storage-increment-required): make
+   * this required for secondary-storage-backed rate limiting in the next minor
+   * on `next`.
+   */
+  increment?: (key: string, ttl: number) => Awaitable$1<number>;
+  set: (
+  /**
+   * Key to store
+   */
+  key: string,
+  /**
+   * Value to store
+   */
+  value: string,
+  /**
+   * Time to live in seconds
+   */
+  ttl?: number | undefined) => Awaitable$1<void | null | unknown>;
+  /**
+   *
+   * @param key - Key to delete
+   */
+  delete: (key: string) => Awaitable$1<void | null | string>;
+}
+//#endregion
+//#region src/db/plugin.d.ts
+type PayvoAuthPluginDBSchema = { [table in string]: {
+  fields: {
+    [field: string]: DBFieldAttribute;
+  };
+  disableMigration?: boolean | undefined;
+  modelName?: string | undefined;
+} };
+//#endregion
+//#region src/db/schema/account.d.ts
+declare const accountSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  providerId: z$1.ZodString;
+  accountId: z$1.ZodString;
+  userId: z$1.ZodCoercedString<unknown>;
+  accessToken: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  refreshToken: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  idToken: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  accessTokenExpiresAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodDate>>;
+  refreshTokenExpiresAt: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodDate>>;
+  scope: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  password: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+}, z$1.core.$strip>;
+/**
+ * Account schema type used by payvo-auth, note that it's possible that account could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type Account = z$1.infer<typeof accountSchema>;
+//#endregion
+//#region src/db/schema/rate-limit.d.ts
+declare const rateLimitSchema: z$1.ZodObject<{
+  key: z$1.ZodString;
+  count: z$1.ZodNumber;
+  lastRequest: z$1.ZodNumber;
+}, z$1.core.$strip>;
+/**
+ * Rate limit schema type used by payvo-auth for rate limiting
+ */
+type RateLimit = z$1.infer<typeof rateLimitSchema>;
+//#endregion
+//#region src/db/schema/session.d.ts
+declare const sessionSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  userId: z$1.ZodCoercedString<unknown>;
+  expiresAt: z$1.ZodDate;
+  token: z$1.ZodString;
+  ipAddress: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+  userAgent: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+}, z$1.core.$strip>;
+/**
+ * Session schema type used by payvo-auth, note that it's possible that session could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type Session = z$1.infer<typeof sessionSchema>;
+//#endregion
+//#region src/db/schema/shared.d.ts
+declare const coreSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+}, z$1.core.$strip>;
+//#endregion
+//#region src/db/schema/user.d.ts
+declare const userSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  email: z$1.ZodPipe<z$1.ZodString, z$1.ZodTransform<string, string>>;
+  emailVerified: z$1.ZodDefault<z$1.ZodBoolean>;
+  name: z$1.ZodString;
+  image: z$1.ZodOptional<z$1.ZodNullable<z$1.ZodString>>;
+}, z$1.core.$strip>;
+/**
+ * User schema type used by payvo-auth, note that it's possible that user could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type User = z$1.infer<typeof userSchema>;
+//#endregion
+//#region src/db/schema/verification.d.ts
+declare const verificationSchema: z$1.ZodObject<{
+  id: z$1.ZodString;
+  createdAt: z$1.ZodDefault<z$1.ZodDate>;
+  updatedAt: z$1.ZodDefault<z$1.ZodDate>;
+  value: z$1.ZodString;
+  expiresAt: z$1.ZodDate;
+  identifier: z$1.ZodString;
+}, z$1.core.$strip>;
+/**
+ * Verification schema type used by payvo-auth, note that it's possible that verification could have additional fields
+ *
+ * todo: we should use generics to extend this type with additional fields from plugins and options in the future
+ */
+type Verification = z$1.infer<typeof verificationSchema>;
+//#endregion
+//#region src/db/index.d.ts
+/**
+ * @deprecated Backport for 1.3.x, we will remove this in 1.4.x
+ */
+type AuthPluginSchema = PayvoAuthPluginDBSchema;
+/**
+ * @deprecated Backport for 1.3.x, we will remove this in 1.4.x
+ */
+type FieldAttribute = DBFieldAttribute;
+/**
+ * @deprecated Backport for 1.3.x, we will remove this in 1.4.x
+ */
+type FieldAttributeConfig = DBFieldAttributeConfig;
+/**
+ * @deprecated Backport for 1.3.x, we will remove this in 1.4.x
+ */
+type FieldType = DBFieldType;
+/**
+ * @deprecated Backport for 1.3.x, we will remove this in 1.4.x
+ */
+type Primitive$1 = DBPrimitive;
+/**
+ * @deprecated Backport for 1.3.x, we will remove this in 1.4.x
+ */
+type PayvoAuthDbSchema = PayvoAuthDBSchema;
+//#endregion
+//#region src/db/adapter/index.d.ts
+type DBAdapterDebugLogOption = boolean | {
+  /**
+   * Useful when you want to log only certain conditions.
+   */
+  logCondition?: (() => boolean) | undefined;
+  create?: boolean | undefined;
+  update?: boolean | undefined;
+  updateMany?: boolean | undefined;
+  findOne?: boolean | undefined;
+  findMany?: boolean | undefined;
+  delete?: boolean | undefined;
+  deleteMany?: boolean | undefined;
+  count?: boolean | undefined;
+} | {
+  /**
+   * Only used for adapter tests to show debug logs if a test fails.
+   *
+   * @deprecated Not actually deprecated. Doing this for IDEs to show this option at the very bottom and stop end-users from using this.
+   */
+  isRunningAdapterTests: boolean;
+};
+type DBAdapterSchemaCreation = {
+  /**
+   * Code to be inserted into the file
+   */
+  code: string;
+  /**
+   * Path to the file, including the file name and extension.
+   * Relative paths are supported, with the current working directory of the developer's project as the base.
+   */
+  path: string;
+  /**
+   * Append the file if it already exists.
+   * Note: This will not apply if `overwrite` is set to true.
+   */
+  append?: boolean | undefined;
+  /**
+   * Overwrite the file if it already exists
+   */
+  overwrite?: boolean | undefined;
+};
+interface DBAdapterFactoryConfig<Options extends PayvoAuthOptions = PayvoAuthOptions> {
+  /**
+   * Use plural table names.
+   *
+   * All tables will be named with an `s` at the end.
+   *
+   * @default false
+   */
+  usePlural?: boolean | undefined;
+  /**
+   * Enable debug logs.
+   *
+   * @default false
+   */
+  debugLogs?: DBAdapterDebugLogOption | undefined;
+  /**
+   * Name of the adapter.
+   *
+   * This is used to identify the adapter in the debug logs.
+   *
+   * @default `adapterId`
+   */
+  adapterName?: string | undefined;
+  /**
+   * Adapter id
+   */
+  adapterId: string;
+  /**
+   * If the database supports numeric ids, set this to `true`.
+   *
+   * @default true
+   */
+  supportsNumericIds?: boolean | undefined;
+  /**
+   * If the database doesn't support JSON columns, set this to `false`.
+   *
+   * We will handle the translation between using `JSON` columns, and saving `string`s to the database.
+   *
+   * @default false
+   */
+  supportsJSON?: boolean | undefined;
+  /**
+   * If the database doesn't support dates, set this to `false`.
+   *
+   * We will handle the translation between using `Date` objects, and saving `string`s to the database.
+   *
+   * @default true
+   */
+  supportsDates?: boolean | undefined;
+  /**
+   * If the database doesn't support booleans, set this to `false`.
+   *
+   * We will handle the translation between using `boolean`s, and saving `0`s and `1`s to the database.
+   *
+   * @default true
+   */
+  supportsBooleans?: boolean | undefined;
+  /**
+   * Execute multiple operations in a transaction.
+   *
+   * If the database doesn't support transactions, set this to `false` and operations will be executed sequentially.
+   *
+   * @default false
+   */
+  transaction?: (false | (<R>(callback: (trx: DBTransactionAdapter<Options>) => Promise<R>) => Promise<R>)) | undefined;
+  /**
+   * Disable id generation for the `create` method.
+   *
+   * This is useful for databases that don't support custom id values and would auto-generate them for you.
+   *
+   * @default false
+   */
+  disableIdGeneration?: boolean | undefined;
+  /**
+   * Map the keys of the input data.
+   *
+   * This is useful for databases that expect a different key name for a given situation.
+   *
+   * For example, MongoDB uses `_id` while in Payvo-Auth we use `id`.
+   *
+   *
+   * @example
+   * Each key represents the old key to replace.
+   * The value represents the new key
+   *
+   * This can be a partial object that only transforms some keys.
+   *
+   * ```ts
+   * mapKeysTransformInput: {
+   *  id: "_id" // We want to replace `id` to `_id` to save into MongoDB
+   * }
+   * ```
+   */
+  mapKeysTransformInput?: Record<string, string> | undefined;
+  /**
+   * Map the keys of the output data.
+   *
+   * This is useful for databases that expect a different key name for a given situation.
+   *
+   * For example, MongoDB uses `_id` while in Payvo-Auth we use `id`.
+   *
+   * @example
+   * Each key represents the old key to replace.
+   * The value represents the new key
+   *
+   * This can be a partial object that only transforms some keys.
+   *
+   * ```ts
+   * mapKeysTransformOutput: {
+   *  _id: "id" // In MongoDB, we save `id` as `_id`. So we want to replace `_id` with `id` when we get the data back.
+   * }
+   * ```
+   */
+  mapKeysTransformOutput?: Record<string, string> | undefined;
+  /**
+   * Custom transform input function.
+   *
+   * This function is used to transform the input data before it is saved to the database.
+   */
+  customTransformInput?: ((props: {
+    data: any;
+    /**
+     * The fields of the model.
+     */
+    fieldAttributes: DBFieldAttribute;
+    /**
+     * The field to transform.
+     */
+    field: string;
+    /**
+     * The action which was called from the adapter.
+     */
+    action: "create" | "update";
+    /**
+     * The model name.
+     */
+    model: string;
+    /**
+     * The schema of the user's Payvo-Auth instance.
+     */
+    schema: PayvoAuthDBSchema;
+    /**
+     * The options of the user's Payvo-Auth instance.
+     */
+    options: Options;
+  }) => any) | undefined;
+  /**
+   * Custom transform output function.
+   *
+   * This function is used to transform the output data before it is returned to the user.
+   */
+  customTransformOutput?: ((props: {
+    data: any;
+    /**
+     * The fields of the model.
+     */
+    fieldAttributes: DBFieldAttribute;
+    /**
+     * The field to transform.
+     */
+    field: string;
+    /**
+     * The fields to select.
+     */
+    select: string[];
+    /**
+     * The model name.
+     */
+    model: string;
+    /**
+     * The schema of the user's Payvo-Auth instance.
+     */
+    schema: PayvoAuthDBSchema;
+    /**
+     * The options of the user's Payvo-Auth instance.
+     */
+    options: Options;
+  }) => any) | undefined;
+  /**
+   * Custom ID generator function.
+   *
+   * By default, we can handle ID generation for you, however if the database your adapter is for only supports a specific custom id generation,
+   * then you can use this function to generate your own IDs.
+   *
+   *
+   * Notes:
+   * - If the user enabled `useNumberId`, then this option will be ignored. Unless this adapter config has `supportsNumericIds` set to `false`.
+   * - If `generateId` is `false` in the user's Payvo-Auth config, then this option will be ignored.
+   * - If `generateId` is a function, then it will override this option.
+   *
+   * @example
+   *
+   * ```ts
+   * customIdGenerator: ({ model }) => {
+   *  return "my-super-unique-id";
+   * }
+   * ```
+   */
+  customIdGenerator?: ((props: {
+    model: string;
+  }) => string) | undefined;
+  /**
+   * Whether to disable the transform output.
+   * Do not use this option unless you know what you are doing.
+   * @default false
+   */
+  disableTransformOutput?: boolean | undefined;
+  /**
+   * Whether to disable the transform input.
+   * Do not use this option unless you know what you are doing.
+   * @default false
+   */
+  disableTransformInput?: boolean | undefined;
+}
+type Where = {
+  /**
+   * @default eq
+   */
+  operator?: ("eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "in" | "not_in" | "contains" | "starts_with" | "ends_with") | undefined;
+  value: string | number | boolean | string[] | number[] | Date | null;
+  field: string;
+  /**
+   * @default AND
+   */
+  connector?: ("AND" | "OR") | undefined;
+};
+type DBTransactionAdapter<Options extends PayvoAuthOptions = PayvoAuthOptions> = Omit<DBAdapter<Options>, "transaction">;
+type DBAdapter<Options extends PayvoAuthOptions = PayvoAuthOptions> = {
+  id: string;
+  create: <T extends Record<string, any>, R = T>(data: {
+    model: string;
+    data: Omit<T, "id">;
+    select?: string[] | undefined;
+    /**
+     * By default, any `id` provided in `data` will be ignored.
+     *
+     * If you want to force the `id` to be the same as the `data.id`, set this to `true`.
+     */
+    forceAllowId?: boolean | undefined;
+  }) => Promise<R>;
+  findOne: <T>(data: {
+    model: string;
+    where: Where[];
+    select?: string[] | undefined;
+  }) => Promise<T | null>;
+  findMany: <T>(data: {
+    model: string;
+    where?: Where[] | undefined;
+    limit?: number | undefined;
+    sortBy?: {
+      field: string;
+      direction: "asc" | "desc";
+    } | undefined;
+    offset?: number | undefined;
+  }) => Promise<T[]>;
+  count: (data: {
+    model: string;
+    where?: Where[] | undefined;
+  }) => Promise<number>;
+  /**
+   * ⚠︎ Update may not return the updated data
+   * if multiple where clauses are provided
+   */
+  update: <T>(data: {
+    model: string;
+    where: Where[];
+    update: Record<string, any>;
+  }) => Promise<T | null>;
+  updateMany: (data: {
+    model: string;
+    where: Where[];
+    update: Record<string, any>;
+  }) => Promise<number>;
+  delete: <T>(data: {
+    model: string;
+    where: Where[];
+  }) => Promise<void>;
+  deleteMany: (data: {
+    model: string;
+    where: Where[];
+  }) => Promise<number>;
+  /**
+   * Execute multiple operations in a transaction.
+   * If the adapter doesn't support transactions, operations will be executed sequentially.
+   */
+  transaction: <R>(callback: (trx: DBTransactionAdapter<Options>) => Promise<R>) => Promise<R>;
+  /**
+   *
+   * @param options
+   * @param file - file path if provided by the user
+   */
+  createSchema?: ((options: Options, file?: string) => Promise<DBAdapterSchemaCreation>) | undefined;
+  options?: ({
+    adapterConfig: DBAdapterFactoryConfig<Options>;
+  } & CustomAdapter["options"]) | undefined;
+};
+type CleanedWhere = Required<Where>;
+interface CustomAdapter {
+  create: <T extends Record<string, any>>({
+    data,
+    model,
+    select
+  }: {
+    model: string;
+    data: T;
+    select?: string[] | undefined;
+  }) => Promise<T>;
+  update: <T>(data: {
+    model: string;
+    where: CleanedWhere[];
+    update: T;
+  }) => Promise<T | null>;
+  updateMany: (data: {
+    model: string;
+    where: CleanedWhere[];
+    update: Record<string, any>;
+  }) => Promise<number>;
+  findOne: <T>({
+    model,
+    where,
+    select
+  }: {
+    model: string;
+    where: CleanedWhere[];
+    select?: string[] | undefined;
+  }) => Promise<T | null>;
+  findMany: <T>({
+    model,
+    where,
+    limit,
+    sortBy,
+    offset
+  }: {
+    model: string;
+    where?: CleanedWhere[] | undefined;
+    limit: number;
+    sortBy?: {
+      field: string;
+      direction: "asc" | "desc";
+    } | undefined;
+    offset?: number | undefined;
+  }) => Promise<T[]>;
+  delete: ({
+    model,
+    where
+  }: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<void>;
+  deleteMany: ({
+    model,
+    where
+  }: {
+    model: string;
+    where: CleanedWhere[];
+  }) => Promise<number>;
+  count: ({
+    model,
+    where
+  }: {
+    model: string;
+    where?: CleanedWhere[] | undefined;
+  }) => Promise<number>;
+  createSchema?: ((props: {
+    /**
+     * The file the user may have passed in to the `generate` command as the expected schema file output path.
+     */
+    file?: string;
+    /**
+     * The tables from the user's Payvo-Auth instance schema.
+     */
+    tables: PayvoAuthDBSchema;
+  }) => Promise<DBAdapterSchemaCreation>) | undefined;
+  /**
+   * Your adapter's options.
+   */
+  options?: Record<string, any> | undefined;
+}
+interface DBAdapterInstance<Options extends PayvoAuthOptions = PayvoAuthOptions> {
+  (options: PayvoAuthOptions): DBAdapter<Options>;
+}
+//#endregion
+//#region src/oauth2/oauth-provider.d.ts
+interface OAuth2Tokens {
+  tokenType?: string | undefined;
+  accessToken?: string | undefined;
+  refreshToken?: string | undefined;
+  accessTokenExpiresAt?: Date | undefined;
+  refreshTokenExpiresAt?: Date | undefined;
+  scopes?: string[] | undefined;
+  idToken?: string | undefined;
+}
+type OAuth2UserInfo = {
+  id: string | number;
+  name?: string | undefined;
+  email?: (string | null) | undefined;
+  image?: string | undefined;
+  emailVerified: boolean;
+};
+interface OAuthProvider<T extends Record<string, any> = Record<string, any>, O extends Record<string, any> = Partial<ProviderOptions>> {
+  id: LiteralString;
+  createAuthorizationURL: (data: {
+    state: string;
+    codeVerifier: string;
+    scopes?: string[] | undefined;
+    redirectURI: string;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+  }) => Promise<URL> | URL;
+  name: string;
+  validateAuthorizationCode: (data: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens>;
+  getUserInfo: (token: OAuth2Tokens & {
+    /**
+     * The user object from the provider
+     * This is only available for some providers like Apple
+     */
+    user?: {
+      name?: {
+        firstName?: string;
+        lastName?: string;
+      };
+      email?: string;
+    } | undefined;
+  }) => Promise<{
+    user: OAuth2UserInfo;
+    data: T;
+  } | null>;
+  /**
+   * Custom function to refresh a token
+   */
+  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  revokeToken?: ((token: string) => Promise<void>) | undefined;
+  /**
+   * Verify the id token
+   * @param token - The id token
+   * @param nonce - The nonce
+   * @returns True if the id token is valid, false otherwise
+   */
+  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * Options for the provider
+   */
+  options?: O | undefined;
+}
+type ProviderOptions<Profile extends Record<string, any> = any> = {
+  /**
+   * The client ID of your application.
+   *
+   * This is usually a string but can be any type depending on the provider.
+   */
+  clientId?: unknown | undefined;
+  /**
+   * The client secret of your application
+   */
+  clientSecret?: string | undefined;
+  /**
+   * The scopes you want to request from the provider
+   */
+  scope?: string[] | undefined;
+  /**
+   * Remove default scopes of the provider
+   */
+  disableDefaultScope?: boolean | undefined;
+  /**
+   * The redirect URL for your application. This is where the provider will
+   * redirect the user after the sign in process. Make sure this URL is
+   * whitelisted in the provider's dashboard.
+   */
+  redirectURI?: string | undefined;
+  /**
+   * The client key of your application
+   * Tiktok Social Provider uses this field instead of clientId
+   */
+  clientKey?: string | undefined;
+  /**
+   * Disable provider from allowing users to sign in
+   * with this provider with an id token sent from the
+   * client.
+   */
+  disableIdTokenSignIn?: boolean | undefined;
+  /**
+   * verifyIdToken function to verify the id token
+   */
+  verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+  /**
+   * Custom function to get user info from the provider
+   */
+  getUserInfo?: ((token: OAuth2Tokens) => Promise<{
+    user: {
+      id: string;
+      name?: string;
+      email?: string | null;
+      image?: string;
+      emailVerified: boolean;
+      [key: string]: any;
+    };
+    data: any;
+  }>) | undefined;
+  /**
+   * Custom function to refresh a token
+   */
+  refreshAccessToken?: ((refreshToken: string) => Promise<OAuth2Tokens>) | undefined;
+  /**
+   * Custom function to map the provider profile to a
+   * user.
+   */
+  mapProfileToUser?: ((profile: Profile) => {
+    id?: string;
+    name?: string;
+    email?: string | null;
+    image?: string;
+    emailVerified?: boolean;
+    [key: string]: any;
+  } | Promise<{
+    id?: string;
+    name?: string;
+    email?: string | null;
+    image?: string;
+    emailVerified?: boolean;
+    [key: string]: any;
+  }>) | undefined;
+  /**
+   * Disable implicit sign up for new users. When set to true for the provider,
+   * sign-in need to be called with with requestSignUp as true to create new users.
+   */
+  disableImplicitSignUp?: boolean | undefined;
+  /**
+   * Disable sign up for new users.
+   */
+  disableSignUp?: boolean | undefined;
+  /**
+   * The prompt to use for the authorization code request
+   */
+  prompt?: ("select_account" | "consent" | "login" | "none" | "select_account consent") | undefined;
+  /**
+   * The response mode to use for the authorization code request
+   */
+  responseMode?: ("query" | "form_post") | undefined;
+  /**
+   * If enabled, the user info will be overridden with the provider user info
+   * This is useful if you want to use the provider user info to update the user info
+   *
+   * @default false
+   */
+  overrideUserInfoOnSignIn?: boolean | undefined;
+};
+//#endregion
+//#region src/oauth2/client-credentials-token.d.ts
+declare function createClientCredentialsTokenRequest({
+  options,
+  scope,
+  authentication,
+  resource
+}: {
+  options: ProviderOptions & {
+    clientSecret: string;
+  };
+  scope?: string | undefined;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): {
+  body: URLSearchParams;
+  headers: Record<string, any>;
+};
+declare function clientCredentialsToken({
+  options,
+  tokenEndpoint,
+  scope,
+  authentication,
+  resource
+}: {
+  options: ProviderOptions & {
+    clientSecret: string;
+  };
+  tokenEndpoint: string;
+  scope: string;
+  authentication?: ("basic" | "post") | undefined;
+  resource?: (string | string[]) | undefined;
+}): Promise<OAuth2Tokens>;
+//#endregion
+//#region src/oauth2/create-authorization-url.d.ts
+declare function createAuthorizationURL({
+  id,
+  options,
+  authorizationEndpoint,
+  state,
+  codeVerifier,
+  scopes,
+  claims,
+  redirectURI,
+  duration,
+  prompt,
+  accessType,
+  responseType,
+  display,
+  loginHint,
+  hd,
+  responseMode,
+  additionalParams,
+  scopeJoiner
+}: {
+  id: string;
+  options: ProviderOptions;
+  redirectURI: string;
+  authorizationEndpoint: string;
+  state: string;
+  codeVerifier?: string | undefined;
+  scopes: string[];
+  claims?: string[] | undefined;
+  duration?: string | undefined;
+  prompt?: string | undefined;
+  accessType?: string | undefined;
+  responseType?: string | undefined;
+  display?: string | undefined;
+  loginHint?: string | undefined;
+  hd?: string | undefined;
+  responseMode?: string | undefined;
+  additionalParams?: Record<string, string> | undefined;
+  scopeJoiner?: string | undefined;
+}): Promise<URL>;
+//#endregion
+//#region src/oauth2/refresh-access-token.d.ts
+declare function createRefreshAccessTokenRequest({
+  refreshToken,
+  options,
+  authentication,
+  extraParams,
+  resource
+}: {
+  refreshToken: string;
+  options: Partial<ProviderOptions>;
+  authentication?: ("basic" | "post") | undefined;
+  extraParams?: Record<string, string> | undefined;
+  resource?: (string | string[]) | undefined;
+}): {
+  body: URLSearchParams;
+  headers: Record<string, any>;
+};
+declare function refreshAccessToken({
+  refreshToken,
+  options,
+  tokenEndpoint,
+  authentication,
+  extraParams
+}: {
+  refreshToken: string;
+  options: Partial<ProviderOptions>;
+  tokenEndpoint: string;
+  authentication?: ("basic" | "post") | undefined;
+  extraParams?: Record<string, string> | undefined;
+  /** @deprecated always "refresh_token" */
+  grantType?: string | undefined;
+}): Promise<OAuth2Tokens>;
+//#endregion
+//#region src/oauth2/utils.d.ts
+declare function getOAuth2Tokens(data: Record<string, any>): OAuth2Tokens;
+declare function generateCodeChallenge(codeVerifier: string): Promise<string>;
+//#endregion
+//#region src/oauth2/validate-authorization-code.d.ts
+declare function createAuthorizationCodeRequest({
+  code,
+  codeVerifier,
+  redirectURI,
+  options,
+  authentication,
+  deviceId,
+  headers,
+  additionalParams,
+  resource
+}: {
+  code: string;
+  redirectURI: string;
+  options: Partial<ProviderOptions>;
+  codeVerifier?: string | undefined;
+  deviceId?: string | undefined;
+  authentication?: ("basic" | "post") | undefined;
+  headers?: Record<string, string> | undefined;
+  additionalParams?: Record<string, string> | undefined;
+  resource?: (string | string[]) | undefined;
+}): {
+  body: URLSearchParams;
+  headers: Record<string, any>;
+};
+declare function validateAuthorizationCode({
+  code,
+  codeVerifier,
+  redirectURI,
+  options,
+  tokenEndpoint,
+  authentication,
+  deviceId,
+  headers,
+  additionalParams,
+  resource
+}: {
+  code: string;
+  redirectURI: string;
+  options: Partial<ProviderOptions>;
+  codeVerifier?: string | undefined;
+  deviceId?: string | undefined;
+  tokenEndpoint: string;
+  authentication?: ("basic" | "post") | undefined;
+  headers?: Record<string, string> | undefined;
+  additionalParams?: Record<string, string> | undefined;
+  resource?: (string | string[]) | undefined;
+}): Promise<OAuth2Tokens>;
+declare function validateToken(token: string, jwksEndpoint: string): Promise<jose0.JWTVerifyResult<jose0.JWTPayload>>;
+//#endregion
+//#region src/types/cookie.d.ts
+type PayvoAuthCookies = {
+  sessionToken: {
+    name: string;
+    options: CookieOptions;
+  };
+  sessionData: {
+    name: string;
+    options: CookieOptions;
+  };
+  dontRememberToken: {
+    name: string;
+    options: CookieOptions;
+  };
+};
+//#endregion
+//#region src/types/helper.d.ts
+type Primitive = string | number | symbol | bigint | boolean | null | undefined;
+type Awaitable$1<T> = T | Promise<T>;
+type AwaitableFunction<T> = T | (() => Awaitable$1<T>);
+type LiteralString = "" | (string & Record<never, never>);
+type LiteralUnion<LiteralType, BaseType extends Primitive> = LiteralType | (BaseType & Record<never, never>);
+type Prettify<T> = { [K in keyof T]: T[K] } & {};
+type UnionToIntersection<U> = (U extends any ? (k: U) => void : never) extends ((k: infer I) => void) ? I : never;
+//#endregion
+//#region src/social-providers/github.d.ts
+interface GithubProfile {
+  login: string;
+  id: string;
+  node_id: string;
+  avatar_url: string;
+  gravatar_id: string;
+  url: string;
+  html_url: string;
+  followers_url: string;
+  following_url: string;
+  gists_url: string;
+  starred_url: string;
+  subscriptions_url: string;
+  organizations_url: string;
+  repos_url: string;
+  events_url: string;
+  received_events_url: string;
+  type: string;
+  site_admin: boolean;
+  name: string;
+  company: string;
+  blog: string;
+  location: string;
+  email: string;
+  hireable: boolean;
+  bio: string;
+  twitter_username: string;
+  public_repos: string;
+  public_gists: string;
+  followers: string;
+  following: string;
+  created_at: string;
+  updated_at: string;
+  private_gists: string;
+  total_private_repos: string;
+  owned_private_repos: string;
+  disk_usage: string;
+  collaborators: string;
+  two_factor_authentication: boolean;
+  plan: {
+    name: string;
+    space: string;
+    private_repos: string;
+    collaborators: string;
+  };
+}
+interface GithubOptions extends ProviderOptions<GithubProfile> {
+  clientId: string;
+}
+declare const github: (options: GithubOptions) => {
+  id: "github";
+  name: string;
+  createAuthorizationURL({
+    state,
+    scopes,
+    loginHint,
+    redirectURI
+  }: {
+    state: string;
+    codeVerifier: string;
+    scopes?: string[] | undefined;
+    redirectURI: string;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+  }): Promise<URL>;
+  validateAuthorizationCode: ({
+    code,
+    redirectURI
+  }: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens>;
+  refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+  getUserInfo(token: OAuth2Tokens & {
+    user?: {
+      name?: {
+        firstName?: string;
+        lastName?: string;
+      };
+      email?: string;
+    } | undefined;
+  }): Promise<{
+    user: {
+      id: string;
+      name?: string;
+      email?: string | null;
+      image?: string;
+      emailVerified: boolean;
+      [key: string]: any;
+    };
+    data: any;
+  } | null>;
+  options: GithubOptions;
+};
+//#endregion
+//#region src/social-providers/google.d.ts
+interface GoogleProfile {
+  aud: string;
+  azp: string;
+  email: string;
+  email_verified: boolean;
+  exp: number;
+  /**
+   * The family name of the user, or last name in most
+   * Western languages.
+   */
+  family_name: string;
+  /**
+   * The given name of the user, or first name in most
+   * Western languages.
+   */
+  given_name: string;
+  hd?: string | undefined;
+  iat: number;
+  iss: string;
+  jti?: string | undefined;
+  locale?: string | undefined;
+  name: string;
+  nbf?: number | undefined;
+  picture: string;
+  sub: string;
+}
+interface GoogleOptions extends ProviderOptions<GoogleProfile> {
+  clientId: string;
+  /**
+   * The access type to use for the authorization code request
+   */
+  accessType?: ("offline" | "online") | undefined;
+  /**
+   * The display mode to use for the authorization code request
+   */
+  display?: ("page" | "popup" | "touch" | "wap") | undefined;
+  /**
+   * The hosted domain of the user
+   */
+  hd?: string | undefined;
+}
+declare const google: (options: GoogleOptions) => {
+  id: "google";
+  name: string;
+  createAuthorizationURL({
+    state,
+    scopes,
+    codeVerifier,
+    redirectURI,
+    loginHint,
+    display
+  }: {
+    state: string;
+    codeVerifier: string;
+    scopes?: string[] | undefined;
+    redirectURI: string;
+    display?: string | undefined;
+    loginHint?: string | undefined;
+  }): Promise<URL>;
+  validateAuthorizationCode: ({
+    code,
+    codeVerifier,
+    redirectURI
+  }: {
+    code: string;
+    redirectURI: string;
+    codeVerifier?: string | undefined;
+    deviceId?: string | undefined;
+  }) => Promise<OAuth2Tokens>;
+  refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  getUserInfo(token: OAuth2Tokens & {
+    user?: {
+      name?: {
+        firstName?: string;
+        lastName?: string;
+      };
+      email?: string;
+    } | undefined;
+  }): Promise<{
+    user: {
+      id: string;
+      name?: string;
+      email?: string | null;
+      image?: string;
+      emailVerified: boolean;
+      [key: string]: any;
+    };
+    data: any;
+  } | null>;
+  options: GoogleOptions;
+};
+//#endregion
+//#region src/social-providers/index.d.ts
+declare const socialProviders: {
+  github: (options: GithubOptions) => {
+    id: "github";
+    name: string;
+    createAuthorizationURL({
+      state,
+      scopes,
+      loginHint,
+      redirectURI
+    }: {
+      state: string;
+      codeVerifier: string;
+      scopes?: string[] | undefined;
+      redirectURI: string;
+      display?: string | undefined;
+      loginHint?: string | undefined;
+    }): Promise<URL>;
+    validateAuthorizationCode: ({
+      code,
+      redirectURI
+    }: {
+      code: string;
+      redirectURI: string;
+      codeVerifier?: string | undefined;
+      deviceId?: string | undefined;
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+    getUserInfo(token: OAuth2Tokens & {
+      user?: {
+        name?: {
+          firstName?: string;
+          lastName?: string;
+        };
+        email?: string;
+      } | undefined;
+    }): Promise<{
+      user: {
+        id: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified: boolean;
+        [key: string]: any;
+      };
+      data: any;
+    } | null>;
+    options: GithubOptions;
+  };
+  google: (options: GoogleOptions) => {
+    id: "google";
+    name: string;
+    createAuthorizationURL({
+      state,
+      scopes,
+      codeVerifier,
+      redirectURI,
+      loginHint,
+      display
+    }: {
+      state: string;
+      codeVerifier: string;
+      scopes?: string[] | undefined;
+      redirectURI: string;
+      display?: string | undefined;
+      loginHint?: string | undefined;
+    }): Promise<URL>;
+    validateAuthorizationCode: ({
+      code,
+      codeVerifier,
+      redirectURI
+    }: {
+      code: string;
+      redirectURI: string;
+      codeVerifier?: string | undefined;
+      deviceId?: string | undefined;
+    }) => Promise<OAuth2Tokens>;
+    refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
+    verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+    getUserInfo(token: OAuth2Tokens & {
+      user?: {
+        name?: {
+          firstName?: string;
+          lastName?: string;
+        };
+        email?: string;
+      } | undefined;
+    }): Promise<{
+      user: {
+        id: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified: boolean;
+        [key: string]: any;
+      };
+      data: any;
+    } | null>;
+    options: GoogleOptions;
+  };
+};
+declare const socialProviderList: ["github", ...(keyof typeof socialProviders)[]];
+declare const SocialProviderListEnum: z$1.ZodType<SocialProviderList[number] | (string & {})>;
+type SocialProvider = z$1.infer<typeof SocialProviderListEnum>;
+type SocialProviders = { [K in SocialProviderList[number]]?: Parameters<(typeof socialProviders)[K]>[0] & {
+  enabled?: boolean | undefined;
+} };
+type SocialProviderList = typeof socialProviderList;
+//#endregion
+//#region src/types/plugin.d.ts
+type Awaitable<T> = T | Promise<T>;
+type DeepPartial<T> = T extends Function ? T : T extends object ? { [K in keyof T]?: DeepPartial<T[K]> } : T;
+type HookEndpointContext = Partial<EndpointContext<string, any> & Omit<InputContext<string, any>, "method">> & {
+  path: string;
+  context: AuthContext & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  };
+  headers?: Headers | undefined;
+};
+type PayvoAuthPlugin = {
+  id: LiteralString;
+  /**
+   * The init function is called when the plugin is initialized.
+   * You can return a new context or modify the existing context.
+   */
+  init?: ((ctx: AuthContext) => Awaitable<{
+    context?: DeepPartial<Omit<AuthContext, "options">>;
+    options?: Partial<PayvoAuthOptions>;
+  }> | void | Promise<void>) | undefined;
+  endpoints?: {
+    [key: string]: Endpoint;
+  } | undefined;
+  middlewares?: {
+    path: string;
+    middleware: Middleware;
+  }[] | undefined;
+  onRequest?: ((request: Request, ctx: AuthContext) => Promise<{
+    response: Response;
+  } | {
+    request: Request;
+  } | void>) | undefined;
+  onResponse?: ((response: Response, ctx: AuthContext) => Promise<{
+    response: Response;
+  } | void>) | undefined;
+  hooks?: {
+    before?: {
+      matcher: (context: HookEndpointContext) => boolean;
+      handler: AuthMiddleware;
+    }[];
+    after?: {
+      matcher: (context: HookEndpointContext) => boolean;
+      handler: AuthMiddleware;
+    }[];
+  } | undefined;
+  /**
+   * Schema the plugin needs
+   *
+   * This will also be used to migrate the database. If the fields are dynamic from the plugins
+   * configuration each time the configuration is changed a new migration will be created.
+   *
+   * NOTE: If you want to create migrations manually using
+   * migrations option or any other way you
+   * can disable migration per table basis.
+   *
+   * @example
+   * ```ts
+   * schema: {
+   * 	user: {
+   * 		fields: {
+   * 			email: {
+   * 				 type: "string",
+   * 			},
+   * 			emailVerified: {
+   * 				type: "boolean",
+   * 				defaultValue: false,
+   * 			},
+   * 		},
+   * 	}
+   * } as AuthPluginSchema
+   * ```
+   */
+  schema?: PayvoAuthPluginDBSchema | undefined;
+  /**
+   * The migrations of the plugin. If you define schema that will automatically create
+   * migrations for you.
+   *
+   * ⚠️ Only uses this if you dont't want to use the schema option and you disabled migrations for
+   * the tables.
+   */
+  migrations?: Record<string, Migration> | undefined;
+  /**
+   * The options of the plugin
+   */
+  options?: Record<string, any> | undefined;
+  /**
+   * types to be inferred
+   */
+  $Infer?: Record<string, any> | undefined;
+  /**
+   * The rate limit rules to apply to specific paths.
+   */
+  rateLimit?: {
+    window: number;
+    max: number;
+    pathMatcher: (path: string) => boolean;
+  }[] | undefined;
+  /**
+   * The error codes returned by the plugin
+   */
+  $ERROR_CODES?: Record<string, string> | undefined;
+  /**
+   * All database operations that are performed by the plugin
+   *
+   * This will override the default database operations
+   */
+  adapter?: {
+    [key: string]: (...args: any[]) => Promise<any> | any;
+  };
+};
+//#endregion
+//#region src/types/init-options.d.ts
+type KyselyDatabaseType = "postgres" | "mysql" | "sqlite" | "mssql";
+type OmitId<T extends {
+  id: unknown;
+}> = Omit<T, "id">;
+type Optional<T> = { [P in keyof T]?: T[P] | undefined };
+type GenerateIdFn = (options: {
+  model: LiteralUnion<DBPreservedModels, string>;
+  size?: number | undefined;
+}) => string | false;
+type PayvoAuthRateLimitOptions = {
+  /**
+   * By default, rate limiting is only
+   * enabled on production.
+   */
+  enabled?: boolean | undefined;
+  /**
+   * Default window to use for rate limiting. The value
+   * should be in seconds.
+   *
+   * @default 10 seconds
+   */
+  window?: number | undefined;
+  /**
+   * The default maximum number of requests allowed within the window.
+   *
+   * @default 100 requests
+   */
+  max?: number | undefined;
+  /**
+   * Custom rate limit rules to apply to
+   * specific paths.
+   */
+  customRules?: {
+    [key: string]: {
+      /**
+       * The window to use for the custom rule.
+       */
+      window: number;
+      /**
+       * The maximum number of requests allowed within the window.
+       */
+      max: number;
+    } | false | ((request: Request) => {
+      window: number;
+      max: number;
+    } | false | Promise<{
+      window: number;
+      max: number;
+    } | false>);
+  } | undefined;
+  /**
+   * Storage configuration
+   *
+   * By default, rate limiting is stored in memory. If you passed a
+   * secondary storage, rate limiting will be stored in the secondary
+   * storage.
+   *
+   * @default "memory"
+   */
+  storage?: ("memory" | "database" | "secondary-storage") | undefined;
+  /**
+   * If database is used as storage, the name of the table to
+   * use for rate limiting.
+   *
+   * @default "rateLimit"
+   */
+  modelName?: string | undefined;
+  /**
+   * Custom field names for the rate limit table
+   */
+  fields?: Record<keyof RateLimit, string> | undefined;
+  /**
+   * custom storage configuration.
+   *
+   * NOTE: If custom storage is used storage
+   * is ignored
+   */
+  customStorage?: {
+    get: (key: string) => Promise<RateLimit | undefined>;
+    set: (key: string, value: RateLimit) => Promise<void>;
+  };
+};
+type PayvoAuthAdvancedOptions = {
+  /**
+   * Ip address configuration
+   */
+  ipAddress?: {
+    /**
+     * List of headers to use for ip address
+     *
+     * Ip address is used for rate limiting and session tracking
+     *
+     * @example ["x-client-ip", "x-forwarded-for", "cf-connecting-ip"]
+     *
+     * @default
+     * @link https://github.com/payvo-auth/payvo-auth/blob/main/packages/payvo-auth/src/utils/get-request-ip.ts#L8
+     */
+    ipAddressHeaders?: string[];
+    /**
+     * Disable ip tracking
+     *
+     * ⚠︎ This is a security risk and it may expose your application to abuse
+     */
+    disableIpTracking?: boolean;
+  } | undefined;
+  /**
+   * Use secure cookies
+   *
+   * @default false
+   */
+  useSecureCookies?: boolean | undefined;
+  /**
+   * Disable trusted origins check
+   *
+   * ⚠︎ This is a security risk and it may expose your application to
+   * CSRF attacks
+   */
+  disableCSRFCheck?: boolean | undefined;
+  /**
+   * Disable origin check
+   *
+   * ⚠︎ This may allow requests from any origin to be processed by
+   * Payvo Auth. And could lead to security vulnerabilities.
+   */
+  disableOriginCheck?: boolean | undefined;
+  /**
+   * Configure cookies to be cross subdomains
+   */
+  crossSubDomainCookies?: {
+    /**
+     * Enable cross subdomain cookies
+     */
+    enabled: boolean;
+    /**
+     * Additional cookies to be shared across subdomains
+     */
+    additionalCookies?: string[];
+    /**
+     * The domain to use for the cookies
+     *
+     * By default, the domain will be the root
+     * domain from the base URL.
+     */
+    domain?: string;
+  } | undefined;
+  cookies?: {
+    [key: string]: {
+      name?: string;
+      attributes?: CookieOptions;
+    };
+  } | undefined;
+  defaultCookieAttributes?: CookieOptions | undefined;
+  /**
+   * Prefix for cookies. If a cookie name is provided
+   * in cookies config, this will be overridden.
+   *
+   * @default
+   * ```txt
+   * "appName" -> which defaults to "payvo-auth"
+   * ```
+   */
+  cookiePrefix?: string | undefined;
+  /**
+   * Database configuration.
+   */
+  database?: {
+    /**
+     * The default number of records to return from the database
+     * when using the `findMany` adapter method.
+     *
+     * @default 100
+     */
+    defaultFindManyLimit?: number;
+    /**
+     * If your database auto increments number ids, set this to `true`.
+     *
+     * Note: If enabled, we will not handle ID generation (including if you use `generateId`), and it would be expected that your database will provide the ID automatically.
+     *
+     * @default false
+     *
+     * @deprecated Please use `generateId` instead. This will be removed in future
+     * releases.
+     */
+    useNumberId?: boolean;
+    /**
+     * Custom generateId function.
+     *
+     * If not provided, random ids will be generated.
+     * If set to false, the database's auto generated id
+     * will be used.
+     *
+     * If set to "serial", the database's auto generated
+     * id will be used.
+     *
+     * If set to "uuid", we generate a random UUID for
+     * the id. If postgres, we use the `gen_random_uuid()
+     * ` function. If mysql or mssql, we use the `uuid()`
+     * function.
+     */
+    generateId?: GenerateIdFn | false | "serial" | "uuid";
+  } | undefined;
+  /**
+   * OAuth configuration
+   */
+  oauthConfig?: {
+    /**
+     * Skip state cookie check
+     *
+     * ⚠︎ this has security implications and should only be enabled if you know what you are doing.
+     * @default false
+     */
+    skipStateCookieCheck?: boolean;
+    /**
+     * Strategy for storing OAuth state
+     *
+     * - "cookie": Store state in an encrypted cookie (stateless)
+     * - "database": Store state in the database
+     *
+     * @default "cookie"
+     */
+    storeStateStrategy?: "database" | "cookie";
+  } | undefined;
+};
+type PayvoAuthOptions = {
+  /**
+   * The name of the application
+   *
+   * process.env.APP_NAME
+   *
+   * @default "Payvo Auth"
+   */
+  appName?: string | undefined;
+  /**
+   * Base URL for the Payvo Auth. This is typically the
+   * root URL where your application server is hosted.
+   * If not explicitly set,
+   * the system will check the following environment variable:
+   *
+   * process.env.PAYVO_AUTH_URL
+   */
+  baseURL?: string | undefined;
+  /**
+   * Base path for the Payvo Auth. This is typically
+   * the path where the
+   * Payvo Auth routes are mounted.
+   *
+   * @default "/api/auth"
+   */
+  basePath?: string | undefined;
+  /**
+   * The secret to use for encryption,
+   * signing and hashing.
+   *
+   * By default Payvo Auth will look for
+   * the following environment variables:
+   * process.env.PAYVO_AUTH_SECRET,
+   * process.env.AUTH_SECRET
+   * If none of these environment
+   * variables are set,
+   * it will default to
+   * "payvo-auth-secret-123456789".
+   *
+   * on production if it's not set
+   * it will throw an error.
+   *
+   * you can generate a good secret
+   * using the following command:
+   * @example
+   * ```bash
+   * openssl rand -base64 32
+   * ```
+   */
+  secret?: string | undefined;
+  /**
+   * Database configuration
+   */
+  database?: (PostgresPool | MysqlPool | SqliteDatabase | Dialect | DBAdapterInstance | Database | DatabaseSync | {
+    dialect: Dialect;
+    type: KyselyDatabaseType;
+    /**
+     * casing for table names
+     *
+     * @default "camel"
+     */
+    casing?: "snake" | "camel";
+    /**
+     * Enable debug logs for the adapter
+     *
+     * @default false
+     */
+    debugLogs?: DBAdapterDebugLogOption;
+    /**
+     * Whether to execute multiple operations in a transaction.
+     * If the database doesn't support transactions,
+     * set this to `false` and operations will be executed sequentially.
+     * @default true
+     */
+    transaction?: boolean;
+  } | {
+    /**
+     * Kysely instance
+     */
+    db: Kysely<any>;
+    /**
+     * Database type between postgres, mysql and sqlite
+     */
+    type: KyselyDatabaseType;
+    /**
+     * casing for table names
+     *
+     * @default "camel"
+     */
+    casing?: "snake" | "camel";
+    /**
+     * Enable debug logs for the adapter
+     *
+     * @default false
+     */
+    debugLogs?: DBAdapterDebugLogOption;
+    /**
+     * Whether to execute multiple operations in a transaction.
+     * If the database doesn't support transactions,
+     * set this to `false` and operations will be executed sequentially.
+     * @default true
+     */
+    transaction?: boolean;
+  }) | undefined;
+  /**
+   * Secondary storage configuration
+   *
+   * This is used to store session and rate limit data.
+   */
+  secondaryStorage?: SecondaryStorage | undefined;
+  /**
+   * Email verification configuration
+   */
+  emailVerification?: {
+    /**
+     * Send a verification email
+     * @param data the data object
+     * @param request the request object
+     */
+    sendVerificationEmail?: (
+    /**
+     * @param user the user to send the
+     * verification email to
+     * @param url the URL to send the verification email to
+     * it contains the token as well
+     * @param token the token to send the verification email to
+     */
+    data: {
+      user: User;
+      url: string;
+      token: string;
+    },
+    /**
+     * The request object
+     */
+    request?: Request) => Promise<void>;
+    /**
+     * Send a verification email automatically
+     * after sign up
+     *
+     * @default false
+     */
+    sendOnSignUp?: boolean;
+    /**
+     * Send a verification email automatically
+     * on sign in when the user's email is not verified
+     *
+     * @default false
+     */
+    sendOnSignIn?: boolean;
+    /**
+     * Auto signin the user after they verify their email
+     */
+    autoSignInAfterVerification?: boolean;
+    /**
+     * Number of seconds the verification token is
+     * valid for.
+     * @default 3600 seconds (1 hour)
+     */
+    expiresIn?: number;
+    /**
+     * A function that is called when a user verifies their email
+     * @param user the user that verified their email
+     * @param request the request object
+     */
+    onEmailVerification?: (user: User, request?: Request) => Promise<void>;
+    /**
+     * A function that is called when a user's email is updated to verified
+     * @param user the user that verified their email
+     * @param request the request object
+     */
+    afterEmailVerification?: (user: User, request?: Request) => Promise<void>;
+  } | undefined;
+  /**
+   * Email and password authentication
+   */
+  emailAndPassword?: {
+    /**
+     * Enable email and password authentication
+     *
+     * @default false
+     */
+    enabled: boolean;
+    /**
+     * Disable email and password sign up
+     *
+     * @default false
+     */
+    disableSignUp?: boolean;
+    /**
+     * Require email verification before a session
+     * can be created for the user.
+     *
+     * if the user is not verified, the user will not be able to sign in
+     * and on sign in attempts, the user will be prompted to verify their email.
+     */
+    requireEmailVerification?: boolean;
+    /**
+     * The maximum length of the password.
+     *
+     * @default 128
+     */
+    maxPasswordLength?: number;
+    /**
+     * The minimum length of the password.
+     *
+     * @default 8
+     */
+    minPasswordLength?: number;
+    /**
+     * send reset password
+     */
+    sendResetPassword?: (
+    /**
+     * @param user the user to send the
+     * reset password email to
+     * @param url the URL to send the reset password email to
+     * @param token the token to send to the user (could be used instead of sending the url
+     * if you need to redirect the user to custom route)
+     */
+    data: {
+      user: User;
+      url: string;
+      token: string;
+    },
+    /**
+     * The request object
+     */
+    request?: Request) => Promise<void>;
+    /**
+     * Number of seconds the reset password token is
+     * valid for.
+     * @default 1 hour (60 * 60)
+     */
+    resetPasswordTokenExpiresIn?: number;
+    /**
+     * A callback function that is triggered
+     * when a user's password is changed successfully.
+     */
+    onPasswordReset?: (data: {
+      user: User;
+    }, request?: Request) => Promise<void>;
+    /**
+     * Password hashing and verification
+     *
+     * By default Scrypt is used for password hashing and
+     * verification. You can provide your own hashing and
+     * verification function. if you want to use a
+     * different algorithm.
+     */
+    password?: {
+      hash?: (password: string) => Promise<string>;
+      verify?: (data: {
+        hash: string;
+        password: string;
+      }) => Promise<boolean>;
+    };
+    /**
+     * Automatically sign in the user after sign up
+     *
+     * @default true
+     */
+    autoSignIn?: boolean;
+    /**
+     * Whether to revoke all other sessions when resetting password
+     * @default false
+     */
+    revokeSessionsOnPasswordReset?: boolean;
+  } | undefined;
+  /**
+   * list of social providers
+   */
+  socialProviders?: SocialProviders | undefined;
+  /**
+   * List of Payvo Auth plugins
+   */
+  plugins?: ([] | PayvoAuthPlugin[]) | undefined;
+  /**
+   * User configuration
+   */
+  user?: {
+    /**
+     * The model name for the user. Defaults to "user".
+     */
+    modelName?: string;
+    /**
+     * Map fields
+     *
+     * @example
+     * ```ts
+     * {
+     *  userId: "user_id"
+     * }
+     * ```
+     */
+    fields?: Partial<Record<keyof OmitId<User>, string>>;
+    /**
+     * Additional fields for the user
+     */
+    additionalFields?: {
+      [key: string]: DBFieldAttribute;
+    };
+    /**
+     * Changing email configuration
+     */
+    changeEmail?: {
+      /**
+       * Enable changing email
+       * @default false
+       */
+      enabled: boolean;
+      /**
+       * Send a verification email when the user changes their email.
+       * @param data the data object
+       * @param request the request object
+       */
+      sendChangeEmailVerification?: (data: {
+        user: User;
+        newEmail: string;
+        url: string;
+        token: string;
+      }, request?: Request) => Promise<void>;
+    };
+    /**
+     * User deletion configuration
+     */
+    deleteUser?: {
+      /**
+       * Enable user deletion
+       */
+      enabled?: boolean;
+      /**
+       * Send a verification email when the user deletes their account.
+       *
+       * if this is not set, the user will be deleted immediately.
+       * @param data the data object
+       * @param request the request object
+       */
+      sendDeleteAccountVerification?: (data: {
+        user: User;
+        url: string;
+        token: string;
+      }, request?: Request) => Promise<void>;
+      /**
+       * A function that is called before a user is deleted.
+       *
+       * to interrupt with error you can throw `APIError`
+       */
+      beforeDelete?: (user: User, request?: Request) => Promise<void>;
+      /**
+       * A function that is called after a user is deleted.
+       *
+       * This is useful for cleaning up user data
+       */
+      afterDelete?: (user: User, request?: Request) => Promise<void>;
+      /**
+       * The expiration time for the delete token.
+       *
+       * @default 1 day (60 * 60 * 24) in seconds
+       */
+      deleteTokenExpiresIn?: number;
+    };
+  } | undefined;
+  session?: {
+    /**
+     * The model name for the session.
+     *
+     * @default "session"
+     */
+    modelName?: string;
+    /**
+     * Map fields
+     *
+     * @example
+     * ```ts
+     * {
+     *  userId: "user_id"
+     * }
+     */
+    fields?: Partial<Record<keyof OmitId<Session>, string>>;
+    /**
+     * Expiration time for the session token. The value
+     * should be in seconds.
+     * @default 7 days (60 * 60 * 24 * 7)
+     */
+    expiresIn?: number;
+    /**
+     * How often the session should be refreshed. The value
+     * should be in seconds.
+     * If set 0 the session will be refreshed every time it is used.
+     * @default 1 day (60 * 60 * 24)
+     */
+    updateAge?: number;
+    /**
+     * Disable session refresh so that the session is not updated
+     * regardless of the `updateAge` option.
+     *
+     * @default false
+     */
+    disableSessionRefresh?: boolean;
+    /**
+     * Additional fields for the session
+     */
+    additionalFields?: {
+      [key: string]: DBFieldAttribute;
+    };
+    /**
+     * By default if secondary storage is provided
+     * the session is stored in the secondary storage.
+     *
+     * Set this to true to store the session in the database
+     * as well.
+     *
+     * Reads are always done from the secondary storage.
+     *
+     * @default false
+     */
+    storeSessionInDatabase?: boolean;
+    /**
+     * By default, sessions are deleted from the database when secondary storage
+     * is provided when session is revoked.
+     *
+     * Set this to true to preserve session records in the database,
+     * even if they are deleted from the secondary storage.
+     *
+     * @default false
+     */
+    preserveSessionInDatabase?: boolean;
+    /**
+     * Enable caching session in cookie
+     */
+    cookieCache?: {
+      /**
+       * max age of the cookie
+       * @default 5 minutes (5 * 60)
+       */
+      maxAge?: number;
+      /**
+       * Enable caching session in cookie
+       * @default false
+       */
+      enabled?: boolean;
+      /**
+       * Strategy for encoding/decoding cookie cache
+       *
+       * - "compact": Uses base64url encoding with HMAC-SHA256 signature (compact format, no JWT spec overhead)
+       * - "jwt": Uses JWT with HMAC signature (no encryption, follows JWT spec)
+       * - "jwe": Uses JWE (JSON Web Encryption) with A256CBC-HS512 and HKDF key derivation for secure encrypted tokens
+       *
+       * @default "compact"
+       */
+      strategy?: "compact" | "jwt" | "jwe";
+      /**
+       * Controls stateless cookie cache refresh behavior.
+       *
+       * When enabled, the cookie cache will be automatically refreshed before expiry
+       * WITHOUT querying the database. This is essential for fully stateless or DB-less scenarios.
+       *
+       * - `false`: Disable automatic refresh. Cache is only invalidated when it reaches maxAge expiry.
+       * - `true`: Enable automatic refresh with default settings (refreshes when 80% of maxAge is reached).
+       * - `object`: Custom refresh configuration with either `updateAge` or `shouldRefresh` function
+       *
+       * Note: When the cache expires (reaches maxAge), it will attempt to fetch from database if available.
+       * The refreshCache option is specifically for refreshing BEFORE expiry in a stateless manner.
+       *
+       * @default false
+       */
+      refreshCache?: boolean | {
+        /**
+         * Time in seconds before expiry when the cache should be refreshed.
+         * For example, if maxAge is 300 (5 minutes) and updateAge is 60,
+         * the cache will be refreshed when it has 60 seconds left before expiry.
+         *
+         * @default 20% of maxAge
+         */
+        updateAge?: number;
+      };
+      /**
+       * Version of the cookie cache
+       *
+       * If a cookie cache version is changed, all existing cookie caches with the old version
+       * will be invalidated.
+       *
+       * It can be a string or a function that returns a string or a promise that returns a string.
+       * If it's a function, it will be called with the session and user data
+       *
+       * @default "1"
+       */
+      version?: string | ((session: Session & Record<string, any>, user: User & Record<string, any>) => string) | ((session: Session & Record<string, any>, user: User & Record<string, any>) => Promise<string>);
+    };
+    /**
+     * The age of the session to consider it fresh.
+     *
+     * This is used to check if the session is fresh
+     * for sensitive operations. (e.g. deleting an account)
+     *
+     * If the session is not fresh, the user should be prompted
+     * to sign in again.
+     *
+     * If set to 0, the session will be considered fresh every time. (⚠︎ not recommended)
+     *
+     * @default 1 day (60 * 60 * 24)
+     */
+    freshAge?: number;
+  } | undefined;
+  account?: {
+    /**
+     * The model name for the account. Defaults to "account".
+     */
+    modelName?: string;
+    /**
+     * Map fields
+     */
+    fields?: Partial<Record<keyof OmitId<Account>, string>>;
+    /**
+     * Additional fields for the account
+     */
+    additionalFields?: {
+      [key: string]: DBFieldAttribute;
+    };
+    /**
+     * When enabled (true), the user account data (accessToken, idToken, refreshToken, etc.)
+     * will be updated on sign in with the latest data from the provider.
+     *
+     * @default true
+     */
+    updateAccountOnSignIn?: boolean;
+    /**
+     * Configuration for account linking.
+     */
+    accountLinking?: {
+      /**
+       * Enable account linking
+       *
+       * @default true
+       */
+      enabled?: boolean;
+      /**
+       * List of trusted providers
+       */
+      trustedProviders?: Array<LiteralUnion<SocialProviderList[number] | "email-password", string>>;
+      /**
+       * If enabled (true), this will allow users to manually linking accounts with different email addresses than the main user.
+       *
+       * @default false
+       *
+       * ⚠️ Warning: enabling this might lead to account takeovers, so proceed with caution.
+       */
+      allowDifferentEmails?: boolean;
+      /**
+       * If enabled (true), this will allow users to unlink all accounts.
+       *
+       * @default false
+       */
+      allowUnlinkingAll?: boolean;
+      /**
+       * If enabled (true), this will update the user information based on the newly linked account
+       *
+       * @default false
+       */
+      updateUserInfoOnLink?: boolean;
+    };
+    /**
+     * Encrypt OAuth tokens
+     *
+     * By default, OAuth tokens (access tokens, refresh tokens, ID tokens) are stored in plain text in the database.
+     * This poses a security risk if your database is compromised, as attackers could gain access to user accounts
+     * on external services.
+     *
+     * When enabled, tokens are encrypted using AES-256-GCM before storage, providing protection against:
+     * - Database breaches and unauthorized access to raw token data
+     * - Internal threats from database administrators or compromised credentials
+     * - Token exposure in database backups and logs
+     * @default false
+     */
+    encryptOAuthTokens?: boolean;
+  } | undefined;
+  /**
+   * Verification configuration
+   */
+  verification?: {
+    /**
+     * Change the modelName of the verification table
+     */
+    modelName?: string;
+    /**
+     * Map verification fields
+     */
+    fields?: Partial<Record<keyof OmitId<Verification>, string>>;
+    /**
+     * disable cleaning up expired values when a verification value is
+     * fetched
+     */
+    disableCleanup?: boolean;
+  } | undefined;
+  /**
+   * List of trusted origins.
+   */
+  trustedOrigins?: (string[] | ((request: Request) => string[] | Promise<string[]>)) | undefined;
+  /**
+   * Rate limiting configuration
+   */
+  rateLimit?: PayvoAuthRateLimitOptions | undefined;
+  /**
+   * Advanced options
+   */
+  advanced?: (PayvoAuthAdvancedOptions & {
+    /**
+     * @deprecated Please use `database.generateId` instead.
+     */
+    generateId?: never;
+  }) | undefined;
+  logger?: Logger | undefined;
+  /**
+   * allows you to define custom hooks that can be
+   * executed during lifecycle of core database
+   * operations.
+   */
+  databaseHooks?: {
+    /**
+     * User hooks
+     */
+    user?: {
+      create?: {
+        /**
+         * Hook that is called before a user is created.
+         * if the hook returns false, the user will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<User> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a user is created.
+         */
+        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      update?: {
+        /**
+         * Hook that is called before a user is updated.
+         * if the hook returns false, the user will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (user: Partial<User> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<User & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a user is updated.
+         */
+        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before a user is deleted.
+         * if the hook returns false, the user will not be deleted.
+         */
+        before?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after a user is deleted.
+         */
+        after?: (user: User & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+    /**
+     * Session Hook
+     */
+    session?: {
+      create?: {
+        /**
+         * Hook that is called before a session is created.
+         * if the hook returns false, the session will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Session> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a session is created.
+         */
+        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      /**
+       * Update hook
+       */
+      update?: {
+        /**
+         * Hook that is called before a user is updated.
+         * if the hook returns false, the session will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (session: Partial<Session> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Session & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a session is updated.
+         */
+        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before a session is deleted.
+         * if the hook returns false, the session will not be deleted.
+         */
+        before?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after a session is deleted.
+         */
+        after?: (session: Session & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+    /**
+     * Account Hook
+     */
+    account?: {
+      create?: {
+        /**
+         * Hook that is called before a account is created.
+         * If the hook returns false, the account will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (account: Account, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Account> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a account is created.
+         */
+        after?: (account: Account, context?: GenericEndpointContext) => Promise<void>;
+      };
+      /**
+       * Update hook
+       */
+      update?: {
+        /**
+         * Hook that is called before a account is update.
+         * If the hook returns false, the user will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (account: Partial<Account> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Account & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a account is updated.
+         */
+        after?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before an account is deleted.
+         * if the hook returns false, the account will not be deleted.
+         */
+        before?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after an account is deleted.
+         */
+        after?: (account: Account & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+    /**
+     * Verification Hook
+     */
+    verification?: {
+      create?: {
+        /**
+         * Hook that is called before a verification is created.
+         * if the hook returns false, the verification will not be created.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Verification> & Record<string, any>;
+        }>;
+        /**
+         * Hook that is called after a verification is created.
+         */
+        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      update?: {
+        /**
+         * Hook that is called before a verification is updated.
+         * if the hook returns false, the verification will not be updated.
+         * If the hook returns an object, it'll be used instead of the original data
+         */
+        before?: (verification: Partial<Verification> & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void | {
+          data: Optional<Verification & Record<string, any>>;
+        }>;
+        /**
+         * Hook that is called after a verification is updated.
+         */
+        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+      delete?: {
+        /**
+         * Hook that is called before a verification is deleted.
+         * if the hook returns false, the verification will not be deleted.
+         */
+        before?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<boolean | void>;
+        /**
+         * Hook that is called after a verification is deleted.
+         */
+        after?: (verification: Verification & Record<string, unknown>, context?: GenericEndpointContext) => Promise<void>;
+      };
+    };
+  } | undefined;
+  /**
+   * API error handling
+   */
+  onAPIError?: {
+    /**
+     * Throw an error on API error
+     *
+     * @default false
+     */
+    throw?: boolean;
+    /**
+     * Custom error handler
+     *
+     * @param error
+     * @param ctx - Auth context
+     */
+    onError?: (error: unknown, ctx: AuthContext) => void | Promise<void>;
+    /**
+     * The URL to redirect to on error
+     *
+     * When errorURL is provided, the error will be added to the URL as a query parameter
+     * and the user will be redirected to the errorURL.
+     *
+     * @default - "/api/auth/error"
+     */
+    errorURL?: string;
+    /**
+     * Configure the default error page provided by Payvo-Auth
+     * Start your dev server and go to /api/auth/error to see the error page.
+     */
+    customizeDefaultErrorPage?: {
+      colors?: {
+        background?: string;
+        foreground?: string;
+        primary?: string;
+        primaryForeground?: string;
+        mutedForeground?: string;
+        border?: string;
+        destructive?: string;
+        titleBorder?: string;
+        titleColor?: string;
+        gridColor?: string;
+        cardBackground?: string;
+        cornerBorder?: string;
+      };
+      size?: {
+        radiusSm?: string;
+        radiusMd?: string;
+        radiusLg?: string;
+        textSm?: string;
+        text2xl?: string;
+        text4xl?: string;
+        text6xl?: string;
+      };
+      font?: {
+        defaultFamily?: string;
+        monoFamily?: string;
+      };
+      disableTitleBorder?: boolean;
+      disableCornerDecorations?: boolean;
+      disableBackgroundGrid?: boolean;
+    };
+  } | undefined;
+  /**
+   * Hooks
+   */
+  hooks?: {
+    /**
+     * Before a request is processed
+     */
+    before?: AuthMiddleware;
+    /**
+     * After a request is processed
+     */
+    after?: AuthMiddleware;
+  } | undefined;
+  /**
+   * Disabled paths
+   *
+   * Paths you want to disable.
+   */
+  disabledPaths?: string[] | undefined;
+  /**
+   * Telemetry configuration
+   */
+  telemetry?: {
+    /**
+     * Enable telemetry collection
+     *
+     * @default false
+     */
+    enabled?: boolean;
+    /**
+     * Enable debug mode
+     *
+     * @default false
+     */
+    debug?: boolean;
+  } | undefined;
+};
+//#endregion
+//#region src/types/context.d.ts
+type GenericEndpointContext<Options extends PayvoAuthOptions = PayvoAuthOptions> = EndpointContext<string, any> & {
+  context: AuthContext<Options>;
+};
+interface InternalAdapter<Options extends PayvoAuthOptions = PayvoAuthOptions> {
+  createOAuthUser(user: Omit<User, "id" | "createdAt" | "updatedAt">, account: Omit<Account, "userId" | "id" | "createdAt" | "updatedAt"> & Partial<Account>): Promise<{
+    user: User;
+    account: Account;
+  }>;
+  createUser<T extends Record<string, any>>(user: Omit<User, "id" | "createdAt" | "updatedAt" | "emailVerified"> & Partial<User> & Record<string, any>): Promise<T & User>;
+  createAccount<T extends Record<string, any>>(account: Omit<Account, "id" | "createdAt" | "updatedAt"> & Partial<Account> & T): Promise<T & Account>;
+  listSessions(userId: string): Promise<Session[]>;
+  listUsers(limit?: number | undefined, offset?: number | undefined, sortBy?: {
+    field: string;
+    direction: "asc" | "desc";
+  } | undefined, where?: Where[] | undefined): Promise<User[]>;
+  countTotalUsers(where?: Where[] | undefined): Promise<number>;
+  deleteUser(userId: string): Promise<void>;
+  createSession(userId: string, dontRememberMe?: boolean | undefined, override?: (Partial<Session> & Record<string, any>) | undefined, overrideAll?: boolean | undefined): Promise<Session>;
+  findSession(token: string): Promise<{
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null>;
+  findSessions(sessionTokens: string[]): Promise<{
+    session: Session;
+    user: User;
+  }[]>;
+  updateSession(sessionToken: string, session: Partial<Session> & Record<string, any>): Promise<Session | null>;
+  deleteSession(token: string): Promise<void>;
+  deleteAccounts(userId: string): Promise<void>;
+  deleteAccount(accountId: string): Promise<void>;
+  deleteSessions(userIdOrSessionTokens: string | string[]): Promise<void>;
+  findOAuthUser(email: string, accountId: string, providerId: string): Promise<{
+    user: User;
+    accounts: Account[];
+  } | null>;
+  findUserByEmail(email: string, options?: {
+    includeAccounts: boolean;
+  } | undefined): Promise<{
+    user: User;
+    accounts: Account[];
+  } | null>;
+  findUserById(userId: string): Promise<User | null>;
+  linkAccount(account: Omit<Account, "id" | "createdAt" | "updatedAt"> & Partial<Account>): Promise<Account>;
+  updateUser(userId: string, data: Partial<User> & Record<string, any>): Promise<any>;
+  updateUserByEmail(email: string, data: Partial<User & Record<string, any>>): Promise<User>;
+  updatePassword(userId: string, password: string): Promise<void>;
+  findAccounts(userId: string): Promise<Account[]>;
+  findAccount(accountId: string): Promise<Account | null>;
+  findAccountByProviderId(accountId: string, providerId: string): Promise<Account | null>;
+  findAccountByUserId(userId: string): Promise<Account[]>;
+  updateAccount(id: string, data: Partial<Account>): Promise<Account>;
+  createVerificationValue(data: Omit<Verification, "createdAt" | "id" | "updatedAt"> & Partial<Verification>): Promise<Verification>;
+  findVerificationValue(identifier: string): Promise<Verification | null>;
+  deleteVerificationValue(id: string): Promise<void>;
+  deleteVerificationByIdentifier(identifier: string): Promise<void>;
+  updateVerificationValue(id: string, data: Partial<Verification>): Promise<Verification>;
+}
+type CreateCookieGetterFn = (cookieName: string, overrideAttributes?: Partial<CookieOptions> | undefined) => {
+  name: string;
+  attributes: CookieOptions;
+};
+type CheckPasswordFn<Options extends PayvoAuthOptions = PayvoAuthOptions> = (userId: string, ctx: GenericEndpointContext<Options>) => Promise<boolean>;
+type AuthContext<Options extends PayvoAuthOptions = PayvoAuthOptions> = {
+  options: Options;
+  appName: string;
+  baseURL: string;
+  trustedOrigins: string[];
+  oauthConfig: {
+    /**
+     * This is dangerous and should only be used in dev or staging environments.
+     */
+    skipStateCookieCheck?: boolean | undefined;
+    /**
+     * Strategy for storing OAuth state
+     *
+     * - "cookie": Store state in an encrypted cookie (stateless)
+     * - "database": Store state in the database
+     *
+     * @default "cookie"
+     */
+    storeStateStrategy: "database" | "cookie";
+  };
+  /**
+   * New session that will be set after the request
+   * meaning: there is a `set-cookie` header that will set
+   * the session cookie. This is the fetched session. And it's set
+   * by `setNewSession` method.
+   */
+  newSession: {
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null;
+  session: {
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null;
+  setNewSession: (session: {
+    session: Session & Record<string, any>;
+    user: User & Record<string, any>;
+  } | null) => void;
+  socialProviders: OAuthProvider[];
+  authCookies: PayvoAuthCookies;
+  logger: ReturnType<typeof createLogger>;
+  rateLimit: {
+    enabled: boolean;
+    window: number;
+    max: number;
+    storage: "memory" | "database" | "secondary-storage";
+  } & PayvoAuthRateLimitOptions;
+  adapter: DBAdapter<Options>;
+  internalAdapter: InternalAdapter<Options>;
+  createAuthCookie: CreateCookieGetterFn;
+  secret: string;
+  sessionConfig: {
+    updateAge: number;
+    expiresIn: number;
+    freshAge: number;
+    cookieRefreshCache: false | {
+      enabled: true;
+      updateAge: number;
+    };
+  };
+  generateId: (options: {
+    model: LiteralUnion<DBPreservedModels, string>;
+    size?: number | undefined;
+  }) => string | false;
+  secondaryStorage: SecondaryStorage | undefined;
+  password: {
+    hash: (password: string) => Promise<string>;
+    verify: (data: {
+      password: string;
+      hash: string;
+    }) => Promise<boolean>;
+    config: {
+      minPasswordLength: number;
+      maxPasswordLength: number;
+    };
+    checkPassword: CheckPasswordFn<Options>;
+  };
+  tables: PayvoAuthDBSchema;
+  runMigrations: () => Promise<void>;
+  publishTelemetry: (event: {
+    type: string;
+    anonymousId?: string | undefined;
+    payload: Record<string, any>;
+  }) => Promise<void>;
+  /**
+   * This skips the origin check for all requests.
+   *
+   * set to true by default for `test` environments and `false`
+   * for other environments.
+   *
+   * It's inferred from the `options.advanced?.disableCSRFCheck`
+   * option or `options.advanced?.disableOriginCheck` option.
+   *
+   * @default false
+   */
+  skipOriginCheck: boolean;
+  /**
+   * This skips the CSRF check for all requests.
+   *
+   * This is inferred from the `options.advanced?.
+   * disableCSRFCheck` option.
+   *
+   * @default false
+   */
+  skipCSRFCheck: boolean;
+};
+//#endregion
+//#region src/types/plugin-client.d.ts
+interface ClientStore {
+  notify: (signal: string) => void;
+  listen: (signal: string, listener: () => void) => void;
+  atoms: Record<string, WritableAtom<any>>;
+}
+type ClientAtomListener = {
+  matcher: (path: string) => boolean;
+  signal: "$sessionSignal" | Omit<string, "$sessionSignal">;
+};
+interface RevalidateOptions {
+  /**
+   * A time interval (in seconds) after which the session will be re-fetched.
+   * If set to `0` (default), the session is not polled.
+   *
+   * This helps prevent session expiry during idle periods by periodically
+   * refreshing the session.
+   *
+   * @default 0
+   */
+  refetchInterval?: number | undefined;
+  /**
+   * Automatically refetch the session when the user switches back to the window/tab.
+   * This option activates this behavior if set to `true` (default).
+   *
+   * Prevents expired sessions when users switch tabs and come back later.
+   *
+   * @default true
+   */
+  refetchOnWindowFocus?: boolean | undefined;
+  /**
+   * Set to `false` to stop polling when the device has no internet access
+   * (determined by `navigator.onLine`).
+   *
+   * @default false
+   * @see https://developer.mozilla.org/en-US/docs/Web/API/NavigatorOnLine/onLine
+   */
+  refetchWhenOffline?: boolean | undefined;
+}
+interface PayvoAuthClientOptions {
+  fetchOptions?: BetterFetchOption | undefined;
+  plugins?: PayvoAuthClientPlugin[] | undefined;
+  baseURL?: string | undefined;
+  basePath?: string | undefined;
+  disableDefaultFetchPlugins?: boolean | undefined;
+  $InferAuth?: PayvoAuthOptions | undefined;
+  sessionOptions?: RevalidateOptions | undefined;
+}
+interface PayvoAuthClientPlugin {
+  id: LiteralString;
+  /**
+   * only used for type inference. don't pass the
+   * actual plugin
+   */
+  $InferServerPlugin?: PayvoAuthPlugin | undefined;
+  /**
+   * Custom actions
+   */
+  getActions?: ($fetch: BetterFetch, $store: ClientStore,
+  /**
+   * payvo-auth client options
+   */
+  options: PayvoAuthClientOptions | undefined) => Record<string, any>;
+  /**
+   * State atoms that'll be resolved by each framework
+   * auth store.
+   */
+  getAtoms?: (($fetch: BetterFetch) => Record<string, Atom<any>>) | undefined;
+  /**
+   * specify path methods for server plugin inferred
+   * endpoints to force a specific method.
+   */
+  pathMethods?: Record<string, "POST" | "GET"> | undefined;
+  /**
+   * Better fetch plugins
+   */
+  fetchPlugins?: BetterFetchPlugin[] | undefined;
+  /**
+   * a list of recaller based on a matcher function.
+   * The signal name needs to match a signal in this
+   * plugin or any plugin the user might have added.
+   */
+  atomListeners?: ClientAtomListener[] | undefined;
+}
+//#endregion
+//#region src/api/index.d.ts
+declare const optionsMiddleware: <InputCtx extends better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>>(inputContext: InputCtx) => Promise<AuthContext>;
+declare const createAuthMiddleware: {
+  <Options extends better_call0.MiddlewareOptions, R>(options: Options, handler: (ctx: better_call0.MiddlewareContext<Options, AuthContext & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  }>) => Promise<R>): (inputContext: better_call0.MiddlewareInputContext<Options>) => Promise<R>;
+  <Options extends better_call0.MiddlewareOptions, R_1>(handler: (ctx: better_call0.MiddlewareContext<Options, AuthContext & {
+    returned?: unknown | undefined;
+    responseHeaders?: Headers | undefined;
+  }>) => Promise<R_1>): (inputContext: better_call0.MiddlewareInputContext<Options>) => Promise<R_1>;
+};
+declare const createAuthEndpoint: <Path extends string, Opts extends EndpointOptions, R>(path: Path, options: Opts, handler: (ctx: EndpointContext<Path, Opts, AuthContext>) => Promise<R>) => {
+  <AsResponse extends boolean = false, ReturnHeaders extends boolean = false>(...inputCtx: better_call0.HasRequiredKeys<better_call0.InputContext<Path, Opts & {
+    use: any[];
+  }>> extends true ? [better_call0.InferBodyInput<Opts & {
+    use: any[];
+  }, (Opts & {
+    use: any[];
+  })["metadata"] extends {
+    $Infer: {
+      body: infer B;
+    };
+  } ? B : (Opts & {
+    use: any[];
+  })["body"] extends better_call0.StandardSchemaV1<unknown, unknown> ? better_call0.StandardSchemaV1.InferInput<(Opts & {
+    use: any[];
+  })["body"]> : undefined> & better_call0.InferInputMethod<Opts & {
+    use: any[];
+  }, (Opts & {
+    use: any[];
+  })["method"] extends any[] ? (Opts & {
+    use: any[];
+  })["method"][number] : (Opts & {
+    use: any[];
+  })["method"] extends "*" ? better_call0.HTTPMethod : (Opts & {
+    use: any[];
+  })["method"] | undefined> & better_call0.InferQueryInput<Opts & {
+    use: any[];
+  }, (Opts & {
+    use: any[];
+  })["metadata"] extends {
+    $Infer: {
+      query: infer Query;
+    };
+  } ? Query : (Opts & {
+    use: any[];
+  })["query"] extends better_call0.StandardSchemaV1<unknown, unknown> ? better_call0.StandardSchemaV1.InferInput<(Opts & {
+    use: any[];
+  })["query"]> : Record<string, any> | undefined> & better_call0.InferParamInput<Path> & better_call0.InferRequestInput<Opts & {
+    use: any[];
+  }> & better_call0.InferHeadersInput<Opts & {
+    use: any[];
+  }> & {
+    asResponse?: boolean;
+    returnHeaders?: boolean;
+    use?: better_call0.Middleware[];
+    path?: string;
+  } & {
+    asResponse?: AsResponse | undefined;
+    returnHeaders?: ReturnHeaders | undefined;
+  }] : [((better_call0.InferBodyInput<Opts & {
+    use: any[];
+  }, (Opts & {
+    use: any[];
+  })["metadata"] extends {
+    $Infer: {
+      body: infer B;
+    };
+  } ? B : (Opts & {
+    use: any[];
+  })["body"] extends better_call0.StandardSchemaV1<unknown, unknown> ? better_call0.StandardSchemaV1.InferInput<(Opts & {
+    use: any[];
+  })["body"]> : undefined> & better_call0.InferInputMethod<Opts & {
+    use: any[];
+  }, (Opts & {
+    use: any[];
+  })["method"] extends any[] ? (Opts & {
+    use: any[];
+  })["method"][number] : (Opts & {
+    use: any[];
+  })["method"] extends "*" ? better_call0.HTTPMethod : (Opts & {
+    use: any[];
+  })["method"] | undefined> & better_call0.InferQueryInput<Opts & {
+    use: any[];
+  }, (Opts & {
+    use: any[];
+  })["metadata"] extends {
+    $Infer: {
+      query: infer Query;
+    };
+  } ? Query : (Opts & {
+    use: any[];
+  })["query"] extends better_call0.StandardSchemaV1<unknown, unknown> ? better_call0.StandardSchemaV1.InferInput<(Opts & {
+    use: any[];
+  })["query"]> : Record<string, any> | undefined> & better_call0.InferParamInput<Path> & better_call0.InferRequestInput<Opts & {
+    use: any[];
+  }> & better_call0.InferHeadersInput<Opts & {
+    use: any[];
+  }> & {
+    asResponse?: boolean;
+    returnHeaders?: boolean;
+    use?: better_call0.Middleware[];
+    path?: string;
+  } & {
+    asResponse?: AsResponse | undefined;
+    returnHeaders?: ReturnHeaders | undefined;
+  }) | undefined)?]): Promise<[AsResponse] extends [true] ? Response : [ReturnHeaders] extends [true] ? {
+    headers: Headers;
+    response: R;
+  } : R>;
+  options: Opts & {
+    use: any[];
+  };
+  path: Path;
+};
+type AuthEndpoint = ReturnType<typeof createAuthEndpoint>;
+type AuthMiddleware = ReturnType<typeof createAuthMiddleware>;
+//#endregion
+export { ProviderOptions as $, GithubProfile as A, DBPreservedModels as At, createAuthorizationCodeRequest as B, SocialProviders as C, rateLimitSchema as Ct, GoogleProfile as D, DBFieldAttribute as Dt, GoogleOptions as E, PayvoAuthPluginDBSchema as Et, LiteralUnion as F, createRefreshAccessTokenRequest as G, validateToken as H, Prettify as I, clientCredentialsToken as J, refreshAccessToken as K, Primitive as L, Awaitable$1 as M, PayvoAuthDBSchema as Mt, AwaitableFunction as N, SecondaryStorage as Nt, google as O, DBFieldAttributeConfig as Ot, LiteralString as P, OAuthProvider as Q, UnionToIntersection as R, SocialProviderListEnum as S, RateLimit as St, socialProviders as T, accountSchema as Tt, generateCodeChallenge as U, validateAuthorizationCode as V, getOAuth2Tokens as W, OAuth2Tokens as X, createClientCredentialsTokenRequest as Y, OAuth2UserInfo as Z, PayvoAuthRateLimitOptions as _, User as _t, optionsMiddleware as a, DBAdapterInstance as at, SocialProvider as b, Session as bt, ClientStore as c, Where as ct, AuthContext as d, FieldAttributeConfig as dt, CleanedWhere as et, GenericEndpointContext as f, FieldType as ft, PayvoAuthOptions as g, verificationSchema as gt, PayvoAuthAdvancedOptions as h, Verification as ht, createAuthMiddleware as i, DBAdapterFactoryConfig as it, github as j, DBPrimitive as jt, GithubOptions as k, DBFieldType as kt, PayvoAuthClientOptions as l, AuthPluginSchema as lt, GenerateIdFn as m, Primitive$1 as mt, AuthMiddleware as n, DBAdapter as nt, StandardSchemaV1$1 as o, DBAdapterSchemaCreation as ot, InternalAdapter as p, PayvoAuthDbSchema as pt, createAuthorizationURL as q, createAuthEndpoint as r, DBAdapterDebugLogOption as rt, ClientAtomListener as s, DBTransactionAdapter as st, AuthEndpoint as t, CustomAdapter as tt, PayvoAuthClientPlugin as u, FieldAttribute as ut, HookEndpointContext as v, userSchema as vt, socialProviderList as w, Account as wt, SocialProviderList as x, sessionSchema as xt, PayvoAuthPlugin as y, coreSchema as yt, PayvoAuthCookies as z };