@glw907/cairn-cms 0.3.1 → 0.5.0

package/dist/auth/config.d.ts

@@ -0,0 +1,2097 @@
+import { drizzleAdapter } from 'better-auth/adapters/drizzle';
+import type { D1Database } from '@cloudflare/workers-types';
+import { type EmailSender } from '../email';
+/** Worker bindings + vars the auth layer reads (a structural subset of `Platform.env`). */
+export interface AuthEnv {
+    AUTH_DB?: D1Database;
+    AUTH_SECRET?: string;
+    /** Canonical origin; `BETTER_AUTH_URL` is accepted as a legacy alias. */
+    PUBLIC_ORIGIN?: string;
+    /** Legacy alias for `PUBLIC_ORIGIN`; `PUBLIC_ORIGIN` takes precedence when both are set. */
+    BETTER_AUTH_URL?: string;
+    EMAIL?: EmailSender;
+}
+/** Branding the magic-link email needs; threaded from the site adapter via hooks. */
+export interface AuthBranding {
+    siteName: string;
+    /** The `From:` address used when sending magic-link emails. */
+    sender: string;
+}
+/** The drizzle adapter result `betterAuth` consumes (same provider/schema everywhere). */
+type DrizzleDb = Parameters<typeof drizzleAdapter>[0];
+/**
+ * The shared better-auth config. Kept separate from `createAuth` so the test harness can run
+ * the EXACT plugin set (allowlist semantics, expiry, POST-confirm send) over an in-memory
+ * SQLite instead of D1. `disableSignUp:true` makes the `user` table the editor allowlist:
+ * magic-link never auto-creates, so the only way in is the owner-gated admin `createUser`
+ * (see auth/admins.ts). `adminRoles:['owner']` lets owners (not the default `admin` role)
+ * drive the admin API. Tokens are stored hashed and consumed atomically on first verify
+ * (better-auth GHSA-hc7v-rggr-4hvx), single-use by construction (C1).
+ */
+export declare function buildAuth(opts: {
+    database: DrizzleDb;
+    baseURL: string;
+    secret: string | undefined;
+    branding: AuthBranding;
+    sendLink: (email: string, token: string) => Promise<void>;
+}): import("better-auth").Auth<{
+    appName: string;
+    secret: string | undefined;
+    baseURL: string;
+    trustedOrigins: string[];
+    database: import("better-auth/adapters/drizzle").DB;
+    plugins: [{
+        id: "magic-link";
+        version: string;
+        endpoints: {
+            signInMagicLink: import("better-auth").StrictEndpoint<"/sign-in/magic-link", {
+                method: "POST";
+                requireHeaders: true;
+                body: import("better-auth").ZodObject<{
+                    email: import("better-auth").ZodEmail;
+                    name: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    metadata: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                status: boolean;
+            }>;
+            magicLinkVerify: import("better-auth").StrictEndpoint<"/magic-link/verify", {
+                method: "GET";
+                query: import("better-auth").ZodObject<{
+                    token: import("better-auth").ZodString;
+                    callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+                requireHeaders: true;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                token: string;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+            }>;
+        };
+        rateLimit: {
+            pathMatcher(path: string): boolean;
+            window: number;
+            max: number;
+        }[];
+        options: import("better-auth/plugins").MagicLinkOptions;
+    }, {
+        id: "admin";
+        version: string;
+        init(): {
+            options: {
+                databaseHooks: {
+                    user: {
+                        create: {
+                            before(user: {
+                                id: string;
+                                createdAt: Date;
+                                updatedAt: Date;
+                                email: string;
+                                emailVerified: boolean;
+                                name: string;
+                                image?: string | null | undefined;
+                            } & Record<string, unknown>): Promise<{
+                                data: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    email: string;
+                                    emailVerified: boolean;
+                                    name: string;
+                                    image?: string | null | undefined;
+                                    role: string;
+                                };
+                            }>;
+                        };
+                    };
+                    session: {
+                        create: {
+                            before(session: {
+                                id: string;
+                                createdAt: Date;
+                                updatedAt: Date;
+                                userId: string;
+                                expiresAt: Date;
+                                token: string;
+                                ipAddress?: string | null | undefined;
+                                userAgent?: string | null | undefined;
+                            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+                        };
+                    };
+                };
+            };
+        };
+        hooks: {
+            after: {
+                matcher(context: import("better-auth").HookEndpointContext): boolean;
+                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<import("better-auth/plugins").SessionWithImpersonatedBy[] | undefined>;
+            }[];
+        };
+        endpoints: {
+            setRole: import("better-auth").StrictEndpoint<"/admin/set-role", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                    role: import("better-auth").ZodUnion<readonly [import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>]>;
+                }, import("zod/v4/core").$strip>;
+                requireHeaders: true;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                    $Infer: {
+                        body: {
+                            userId: string;
+                            role: "owner" | "editor" | ("owner" | "editor")[];
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            getUser: import("better-auth").StrictEndpoint<"/admin/get-user", {
+                method: "GET";
+                query: import("better-auth").ZodObject<{
+                    id: import("better-auth").ZodString;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, import("better-auth/plugins").UserWithRole>;
+            createUser: import("better-auth").StrictEndpoint<"/admin/create-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    email: import("better-auth").ZodString;
+                    password: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    name: import("better-auth").ZodString;
+                    role: import("better-auth").ZodOptional<import("better-auth").ZodUnion<readonly [import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>]>>;
+                    data: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                    $Infer: {
+                        body: {
+                            email: string;
+                            password?: string | undefined;
+                            name: string;
+                            role?: "owner" | "editor" | ("owner" | "editor")[] | undefined;
+                            data?: Record<string, any> | undefined;
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            adminUpdateUser: import("better-auth").StrictEndpoint<"/admin/update-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                    data: import("better-auth").ZodRecord<import("better-auth").ZodAny, import("better-auth").ZodAny>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, import("better-auth/plugins").UserWithRole>;
+            listUsers: import("better-auth").StrictEndpoint<"/admin/list-users", {
+                method: "GET";
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                query: import("better-auth").ZodObject<{
+                    searchValue: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    searchField: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        email: "email";
+                        name: "name";
+                    }>>;
+                    searchOperator: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        contains: "contains";
+                        starts_with: "starts_with";
+                        ends_with: "ends_with";
+                    }>>;
+                    limit: import("better-auth").ZodOptional<import("better-auth").ZodUnion<[import("better-auth").ZodString, import("better-auth").ZodNumber]>>;
+                    offset: import("better-auth").ZodOptional<import("better-auth").ZodUnion<[import("better-auth").ZodString, import("better-auth").ZodNumber]>>;
+                    sortBy: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    sortDirection: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        asc: "asc";
+                        desc: "desc";
+                    }>>;
+                    filterField: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    filterValue: import("better-auth").ZodOptional<import("better-auth").ZodUnion<[import("better-auth").ZodUnion<[import("better-auth").ZodUnion<[import("better-auth").ZodUnion<[import("better-auth").ZodString, import("better-auth").ZodNumber]>, import("better-auth").ZodBoolean]>, import("better-auth").ZodArray<import("better-auth").ZodString>]>, import("better-auth").ZodArray<import("better-auth").ZodNumber>]>>;
+                    filterOperator: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        eq: "eq";
+                        ne: "ne";
+                        gt: "gt";
+                        gte: "gte";
+                        lt: "lt";
+                        lte: "lte";
+                        in: "in";
+                        not_in: "not_in";
+                        contains: "contains";
+                        starts_with: "starts_with";
+                        ends_with: "ends_with";
+                    }>>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                users: {
+                                                    type: string;
+                                                    items: {
+                                                        $ref: string;
+                                                    };
+                                                };
+                                                total: {
+                                                    type: string;
+                                                };
+                                                limit: {
+                                                    type: string;
+                                                };
+                                                offset: {
+                                                    type: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                users: import("better-auth/plugins").UserWithRole[];
+                total: number;
+            }>;
+            listUserSessions: import("better-auth").StrictEndpoint<"/admin/list-user-sessions", {
+                method: "POST";
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                sessions: {
+                                                    type: string;
+                                                    items: {
+                                                        $ref: string;
+                                                    };
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                sessions: import("better-auth/plugins").SessionWithImpersonatedBy[];
+            }>;
+            unbanUser: import("better-auth").StrictEndpoint<"/admin/unban-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            banUser: import("better-auth").StrictEndpoint<"/admin/ban-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                    banReason: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    banExpiresIn: import("better-auth").ZodOptional<import("better-auth").ZodNumber>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            impersonateUser: import("better-auth").StrictEndpoint<"/admin/impersonate-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            stopImpersonating: import("better-auth").StrictEndpoint<"/admin/stop-impersonating", {
+                method: "POST";
+                requireHeaders: true;
+            }, {
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                } & Record<string, any>;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                } & Record<string, any>;
+            }>;
+            revokeUserSession: import("better-auth").StrictEndpoint<"/admin/revoke-user-session", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    sessionToken: import("better-auth").ZodString;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            revokeUserSessions: import("better-auth").StrictEndpoint<"/admin/revoke-user-sessions", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            removeUser: import("better-auth").StrictEndpoint<"/admin/remove-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            setUserPassword: import("better-auth").StrictEndpoint<"/admin/set-user-password", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    newPassword: import("better-auth").ZodString;
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                status: boolean;
+            }>;
+            userHasPermission: import("better-auth").StrictEndpoint<"/admin/has-permission", {
+                method: "POST";
+                body: import("better-auth").ZodIntersection<import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodOptional<import("better-auth").ZodCoercedString<unknown>>;
+                    role: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                }, import("zod/v4/core").$strip>, import("better-auth").ZodXor<readonly [import("better-auth").ZodObject<{
+                    permission: import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>>;
+                }, import("zod/v4/core").$strip>, import("better-auth").ZodObject<{
+                    permissions: import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>>;
+                }, import("zod/v4/core").$strip>]>>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        requestBody: {
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            permissions: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                error: {
+                                                    type: string;
+                                                };
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                    $Infer: {
+                        body: {
+                            permissions: {
+                                readonly user?: ("delete" | "list" | "create" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "get" | "update")[] | undefined;
+                                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                            };
+                        } & {
+                            userId?: string | undefined;
+                            role?: "owner" | "editor" | undefined;
+                        };
+                    };
+                };
+            }, {
+                error: null;
+                success: boolean;
+            }>;
+        };
+        $ERROR_CODES: {
+            USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: import("better-auth").RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
+            FAILED_TO_CREATE_USER: import("better-auth").RawError<"FAILED_TO_CREATE_USER">;
+            USER_ALREADY_EXISTS: import("better-auth").RawError<"USER_ALREADY_EXISTS">;
+            YOU_CANNOT_BAN_YOURSELF: import("better-auth").RawError<"YOU_CANNOT_BAN_YOURSELF">;
+            YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">;
+            YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">;
+            YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">;
+            YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">;
+            BANNED_USER: import("better-auth").RawError<"BANNED_USER">;
+            YOU_ARE_NOT_ALLOWED_TO_GET_USER: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">;
+            NO_DATA_TO_UPDATE: import("better-auth").RawError<"NO_DATA_TO_UPDATE">;
+            YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">;
+            YOU_CANNOT_REMOVE_YOURSELF: import("better-auth").RawError<"YOU_CANNOT_REMOVE_YOURSELF">;
+            YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
+            YOU_CANNOT_IMPERSONATE_ADMINS: import("better-auth").RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
+            INVALID_ROLE_TYPE: import("better-auth").RawError<"INVALID_ROLE_TYPE">;
+        };
+        schema: {
+            user: {
+                fields: {
+                    role: {
+                        type: "string";
+                        required: false;
+                        input: false;
+                    };
+                    banned: {
+                        type: "boolean";
+                        defaultValue: false;
+                        required: false;
+                        input: false;
+                    };
+                    banReason: {
+                        type: "string";
+                        required: false;
+                        input: false;
+                    };
+                    banExpires: {
+                        type: "date";
+                        required: false;
+                        input: false;
+                    };
+                };
+            };
+            session: {
+                fields: {
+                    impersonatedBy: {
+                        type: "string";
+                        required: false;
+                    };
+                };
+            };
+        };
+        options: NoInfer<{
+            ac: {
+                newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>;
+                statements: {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                };
+            };
+            roles: {
+                owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>, {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>;
+                editor: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{}>, {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>;
+            };
+            defaultRole: string;
+            adminRoles: string[];
+        }>;
+    }];
+}>;
+/**
+ * Build the per-request better-auth instance over the site's D1 binding. The magic-link email
+ * points at OUR confirm page carrying only the token; consumption happens when the user clicks
+ * "Confirm sign-in" there (a POST), never on a scanner GET (C2 / POST-confirm). The origin is
+ * config-derived (`PUBLIC_ORIGIN`/`BETTER_AUTH_URL`), never request-derived (H3).
+ */
+export declare function createAuth(env: AuthEnv, branding: AuthBranding): import("better-auth").Auth<{
+    appName: string;
+    secret: string | undefined;
+    baseURL: string;
+    trustedOrigins: string[];
+    database: import("better-auth/adapters/drizzle").DB;
+    plugins: [{
+        id: "magic-link";
+        version: string;
+        endpoints: {
+            signInMagicLink: import("better-auth").StrictEndpoint<"/sign-in/magic-link", {
+                method: "POST";
+                requireHeaders: true;
+                body: import("better-auth").ZodObject<{
+                    email: import("better-auth").ZodEmail;
+                    name: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    metadata: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                status: boolean;
+            }>;
+            magicLinkVerify: import("better-auth").StrictEndpoint<"/magic-link/verify", {
+                method: "GET";
+                query: import("better-auth").ZodObject<{
+                    token: import("better-auth").ZodString;
+                    callbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    errorCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    newUserCallbackURL: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>)[];
+                requireHeaders: true;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                token: string;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                };
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+            }>;
+        };
+        rateLimit: {
+            pathMatcher(path: string): boolean;
+            window: number;
+            max: number;
+        }[];
+        options: import("better-auth/plugins").MagicLinkOptions;
+    }, {
+        id: "admin";
+        version: string;
+        init(): {
+            options: {
+                databaseHooks: {
+                    user: {
+                        create: {
+                            before(user: {
+                                id: string;
+                                createdAt: Date;
+                                updatedAt: Date;
+                                email: string;
+                                emailVerified: boolean;
+                                name: string;
+                                image?: string | null | undefined;
+                            } & Record<string, unknown>): Promise<{
+                                data: {
+                                    id: string;
+                                    createdAt: Date;
+                                    updatedAt: Date;
+                                    email: string;
+                                    emailVerified: boolean;
+                                    name: string;
+                                    image?: string | null | undefined;
+                                    role: string;
+                                };
+                            }>;
+                        };
+                    };
+                    session: {
+                        create: {
+                            before(session: {
+                                id: string;
+                                createdAt: Date;
+                                updatedAt: Date;
+                                userId: string;
+                                expiresAt: Date;
+                                token: string;
+                                ipAddress?: string | null | undefined;
+                                userAgent?: string | null | undefined;
+                            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+                        };
+                    };
+                };
+            };
+        };
+        hooks: {
+            after: {
+                matcher(context: import("better-auth").HookEndpointContext): boolean;
+                handler: (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<import("better-auth/plugins").SessionWithImpersonatedBy[] | undefined>;
+            }[];
+        };
+        endpoints: {
+            setRole: import("better-auth").StrictEndpoint<"/admin/set-role", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                    role: import("better-auth").ZodUnion<readonly [import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>]>;
+                }, import("zod/v4/core").$strip>;
+                requireHeaders: true;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                    $Infer: {
+                        body: {
+                            userId: string;
+                            role: "owner" | "editor" | ("owner" | "editor")[];
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            getUser: import("better-auth").StrictEndpoint<"/admin/get-user", {
+                method: "GET";
+                query: import("better-auth").ZodObject<{
+                    id: import("better-auth").ZodString;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, import("better-auth/plugins").UserWithRole>;
+            createUser: import("better-auth").StrictEndpoint<"/admin/create-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    email: import("better-auth").ZodString;
+                    password: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    name: import("better-auth").ZodString;
+                    role: import("better-auth").ZodOptional<import("better-auth").ZodUnion<readonly [import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>]>>;
+                    data: import("better-auth").ZodOptional<import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodAny>>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                    $Infer: {
+                        body: {
+                            email: string;
+                            password?: string | undefined;
+                            name: string;
+                            role?: "owner" | "editor" | ("owner" | "editor")[] | undefined;
+                            data?: Record<string, any> | undefined;
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            adminUpdateUser: import("better-auth").StrictEndpoint<"/admin/update-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                    data: import("better-auth").ZodRecord<import("better-auth").ZodAny, import("better-auth").ZodAny>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, import("better-auth/plugins").UserWithRole>;
+            listUsers: import("better-auth").StrictEndpoint<"/admin/list-users", {
+                method: "GET";
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                query: import("better-auth").ZodObject<{
+                    searchValue: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    searchField: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        email: "email";
+                        name: "name";
+                    }>>;
+                    searchOperator: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        contains: "contains";
+                        starts_with: "starts_with";
+                        ends_with: "ends_with";
+                    }>>;
+                    limit: import("better-auth").ZodOptional<import("better-auth").ZodUnion<[import("better-auth").ZodString, import("better-auth").ZodNumber]>>;
+                    offset: import("better-auth").ZodOptional<import("better-auth").ZodUnion<[import("better-auth").ZodString, import("better-auth").ZodNumber]>>;
+                    sortBy: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    sortDirection: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        asc: "asc";
+                        desc: "desc";
+                    }>>;
+                    filterField: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    filterValue: import("better-auth").ZodOptional<import("better-auth").ZodUnion<[import("better-auth").ZodUnion<[import("better-auth").ZodUnion<[import("better-auth").ZodUnion<[import("better-auth").ZodString, import("better-auth").ZodNumber]>, import("better-auth").ZodBoolean]>, import("better-auth").ZodArray<import("better-auth").ZodString>]>, import("better-auth").ZodArray<import("better-auth").ZodNumber>]>>;
+                    filterOperator: import("better-auth").ZodOptional<import("better-auth").ZodEnum<{
+                        eq: "eq";
+                        ne: "ne";
+                        gt: "gt";
+                        gte: "gte";
+                        lt: "lt";
+                        lte: "lte";
+                        in: "in";
+                        not_in: "not_in";
+                        contains: "contains";
+                        starts_with: "starts_with";
+                        ends_with: "ends_with";
+                    }>>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                users: {
+                                                    type: string;
+                                                    items: {
+                                                        $ref: string;
+                                                    };
+                                                };
+                                                total: {
+                                                    type: string;
+                                                };
+                                                limit: {
+                                                    type: string;
+                                                };
+                                                offset: {
+                                                    type: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                users: import("better-auth/plugins").UserWithRole[];
+                total: number;
+            }>;
+            listUserSessions: import("better-auth").StrictEndpoint<"/admin/list-user-sessions", {
+                method: "POST";
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                sessions: {
+                                                    type: string;
+                                                    items: {
+                                                        $ref: string;
+                                                    };
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                sessions: import("better-auth/plugins").SessionWithImpersonatedBy[];
+            }>;
+            unbanUser: import("better-auth").StrictEndpoint<"/admin/unban-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            banUser: import("better-auth").StrictEndpoint<"/admin/ban-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                    banReason: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                    banExpiresIn: import("better-auth").ZodOptional<import("better-auth").ZodNumber>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            impersonateUser: import("better-auth").StrictEndpoint<"/admin/impersonate-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                };
+                user: import("better-auth/plugins").UserWithRole;
+            }>;
+            stopImpersonating: import("better-auth").StrictEndpoint<"/admin/stop-impersonating", {
+                method: "POST";
+                requireHeaders: true;
+            }, {
+                session: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    userId: string;
+                    expiresAt: Date;
+                    token: string;
+                    ipAddress?: string | null | undefined;
+                    userAgent?: string | null | undefined;
+                } & Record<string, any>;
+                user: {
+                    id: string;
+                    createdAt: Date;
+                    updatedAt: Date;
+                    email: string;
+                    emailVerified: boolean;
+                    name: string;
+                    image?: string | null | undefined;
+                } & Record<string, any>;
+            }>;
+            revokeUserSession: import("better-auth").StrictEndpoint<"/admin/revoke-user-session", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    sessionToken: import("better-auth").ZodString;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            revokeUserSessions: import("better-auth").StrictEndpoint<"/admin/revoke-user-sessions", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            removeUser: import("better-auth").StrictEndpoint<"/admin/remove-user", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                success: boolean;
+            }>;
+            setUserPassword: import("better-auth").StrictEndpoint<"/admin/set-user-password", {
+                method: "POST";
+                body: import("better-auth").ZodObject<{
+                    newPassword: import("better-auth").ZodString;
+                    userId: import("better-auth").ZodCoercedString<unknown>;
+                }, import("zod/v4/core").$strip>;
+                use: ((inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                    session: {
+                        user: import("better-auth/plugins").UserWithRole;
+                        session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        };
+                    };
+                }>)[];
+                metadata: {
+                    openapi: {
+                        operationId: string;
+                        summary: string;
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                status: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            }, {
+                status: boolean;
+            }>;
+            userHasPermission: import("better-auth").StrictEndpoint<"/admin/has-permission", {
+                method: "POST";
+                body: import("better-auth").ZodIntersection<import("better-auth").ZodObject<{
+                    userId: import("better-auth").ZodOptional<import("better-auth").ZodCoercedString<unknown>>;
+                    role: import("better-auth").ZodOptional<import("better-auth").ZodString>;
+                }, import("zod/v4/core").$strip>, import("better-auth").ZodXor<readonly [import("better-auth").ZodObject<{
+                    permission: import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>>;
+                }, import("zod/v4/core").$strip>, import("better-auth").ZodObject<{
+                    permissions: import("better-auth").ZodRecord<import("better-auth").ZodString, import("better-auth").ZodArray<import("better-auth").ZodString>>;
+                }, import("zod/v4/core").$strip>]>>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        requestBody: {
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            permissions: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        responses: {
+                            "200": {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                error: {
+                                                    type: string;
+                                                };
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                            required: string[];
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                    $Infer: {
+                        body: {
+                            permissions: {
+                                readonly user?: ("delete" | "list" | "create" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "set-password" | "get" | "update")[] | undefined;
+                                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                            };
+                        } & {
+                            userId?: string | undefined;
+                            role?: "owner" | "editor" | undefined;
+                        };
+                    };
+                };
+            }, {
+                error: null;
+                success: boolean;
+            }>;
+        };
+        $ERROR_CODES: {
+            USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: import("better-auth").RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
+            FAILED_TO_CREATE_USER: import("better-auth").RawError<"FAILED_TO_CREATE_USER">;
+            USER_ALREADY_EXISTS: import("better-auth").RawError<"USER_ALREADY_EXISTS">;
+            YOU_CANNOT_BAN_YOURSELF: import("better-auth").RawError<"YOU_CANNOT_BAN_YOURSELF">;
+            YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">;
+            YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">;
+            YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">;
+            YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">;
+            YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">;
+            BANNED_USER: import("better-auth").RawError<"BANNED_USER">;
+            YOU_ARE_NOT_ALLOWED_TO_GET_USER: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">;
+            NO_DATA_TO_UPDATE: import("better-auth").RawError<"NO_DATA_TO_UPDATE">;
+            YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">;
+            YOU_CANNOT_REMOVE_YOURSELF: import("better-auth").RawError<"YOU_CANNOT_REMOVE_YOURSELF">;
+            YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: import("better-auth").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
+            YOU_CANNOT_IMPERSONATE_ADMINS: import("better-auth").RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
+            INVALID_ROLE_TYPE: import("better-auth").RawError<"INVALID_ROLE_TYPE">;
+        };
+        schema: {
+            user: {
+                fields: {
+                    role: {
+                        type: "string";
+                        required: false;
+                        input: false;
+                    };
+                    banned: {
+                        type: "boolean";
+                        defaultValue: false;
+                        required: false;
+                        input: false;
+                    };
+                    banReason: {
+                        type: "string";
+                        required: false;
+                        input: false;
+                    };
+                    banExpires: {
+                        type: "date";
+                        required: false;
+                        input: false;
+                    };
+                };
+            };
+            session: {
+                fields: {
+                    impersonatedBy: {
+                        type: "string";
+                        required: false;
+                    };
+                };
+            };
+        };
+        options: NoInfer<{
+            ac: {
+                newRole<const TRoleStatements extends import("better-auth/plugins").Statements>(statements: import("better-auth/plugins").RoleInput<{
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }, TRoleStatements>): import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<TRoleStatements>, {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>;
+                statements: {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                };
+            };
+            roles: {
+                owner: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>, {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>;
+                editor: import("better-auth/plugins").Role<import("better-auth/plugins").ExactRoleStatements<{}>, {
+                    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+                    readonly session: readonly ["list", "revoke", "delete"];
+                }>;
+            };
+            defaultRole: string;
+            adminRoles: string[];
+        }>;
+    }];
+}>;
+export type Auth = ReturnType<typeof createAuth>;
+export {};
+//# sourceMappingURL=config.d.ts.map