@inkeep/agents-core 0.53.2 → 0.53.4

package/dist/auth/auth.d.ts

@@ -153,6 +153,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       clientSecret?: string | undefined;
       scope?: string[] | undefined;
       disableDefaultScope?: boolean | undefined;
+      authorizationEndpoint?: string | undefined;
       clientKey?: string | undefined;
       disableIdTokenSignIn?: boolean | undefined;
       verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
@@ -203,6 +204,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     ipAddress?: {
       ipAddressHeaders?: string[];
       disableIpTracking?: boolean;
+      ipv6Subnet?: 128 | 64 | 48 | 32 | undefined;
     } | undefined;
     useSecureCookies?: boolean | undefined;
     disableCSRFCheck?: boolean | undefined;
@@ -227,8 +229,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     } | undefined;
     trustedProxyHeaders?: boolean | undefined;
     backgroundTasks?: {
-      handler: (promise: Promise<void>) => void;
+      handler: (promise: Promise<unknown>) => void;
     };
+    skipTrailingSlashes?: boolean | undefined;
   };
   trustedOrigins: string[];
   plugins: [{
@@ -667,11 +670,14 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         };
       }, never>>;
       callbackSSOSAML: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
-        method: "POST";
-        body: zod0.ZodObject<{
+        method: ("POST" | "GET")[];
+        body: zod0.ZodOptional<zod0.ZodObject<{
           SAMLResponse: zod0.ZodString;
           RelayState: zod0.ZodOptional<zod0.ZodString>;
-        }, better_auth0.$strip>;
+        }, better_auth0.$strip>>;
+        query: zod0.ZodOptional<zod0.ZodObject<{
+          RelayState: zod0.ZodOptional<zod0.ZodString>;
+        }, better_auth0.$strip>>;
         metadata: {
           allowedMediaTypes: string[];
           openapi: {
@@ -695,9 +701,6 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       }, never>>;
       acsEndpoint: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
         method: "POST";
-        params: zod0.ZodObject<{
-          providerId: zod0.ZodOptional<zod0.ZodString>;
-        }, better_auth0.$strip>;
         body: zod0.ZodObject<{
           SAMLResponse: zod0.ZodString;
           RelayState: zod0.ZodOptional<zod0.ZodString>;
@@ -717,6 +720,371 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           scope: "server";
         };
       }, never>>;
+      listSSOProviders: ReturnType<() => better_auth0.StrictEndpoint<"/sso/providers", {
+        method: "GET";
+        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        providers: {
+          providerId: string;
+          type: string;
+          issuer: string;
+          domain: string;
+          organizationId: string | null;
+          domainVerified: boolean;
+          oidcConfig: {
+            discoveryEndpoint: string;
+            clientIdLastFour: string;
+            pkce: boolean;
+            authorizationEndpoint: string | undefined;
+            tokenEndpoint: string | undefined;
+            userInfoEndpoint: string | undefined;
+            jwksEndpoint: string | undefined;
+            scopes: string[] | undefined;
+            tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
+          } | undefined;
+          samlConfig: {
+            entryPoint: string;
+            callbackUrl: string;
+            audience: string | undefined;
+            wantAssertionsSigned: boolean | undefined;
+            identifierFormat: string | undefined;
+            signatureAlgorithm: string | undefined;
+            digestAlgorithm: string | undefined;
+            certificate: {
+              fingerprintSha256: string;
+              notBefore: string;
+              notAfter: string;
+              publicKeyAlgorithm: string;
+            } | {
+              error: string;
+            };
+          } | undefined;
+          spMetadataUrl: string;
+        }[];
+      }>>;
+      getSSOProvider: ReturnType<() => better_auth0.StrictEndpoint<"/sso/providers/:providerId", {
+        method: "GET";
+        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        params: zod0.ZodObject<{
+          providerId: zod0.ZodString;
+        }, better_auth0.$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+              "404": {
+                description: string;
+              };
+              "403": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        providerId: string;
+        type: string;
+        issuer: string;
+        domain: string;
+        organizationId: string | null;
+        domainVerified: boolean;
+        oidcConfig: {
+          discoveryEndpoint: string;
+          clientIdLastFour: string;
+          pkce: boolean;
+          authorizationEndpoint: string | undefined;
+          tokenEndpoint: string | undefined;
+          userInfoEndpoint: string | undefined;
+          jwksEndpoint: string | undefined;
+          scopes: string[] | undefined;
+          tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
+        } | undefined;
+        samlConfig: {
+          entryPoint: string;
+          callbackUrl: string;
+          audience: string | undefined;
+          wantAssertionsSigned: boolean | undefined;
+          identifierFormat: string | undefined;
+          signatureAlgorithm: string | undefined;
+          digestAlgorithm: string | undefined;
+          certificate: {
+            fingerprintSha256: string;
+            notBefore: string;
+            notAfter: string;
+            publicKeyAlgorithm: string;
+          } | {
+            error: string;
+          };
+        } | undefined;
+        spMetadataUrl: string;
+      }>>;
+      updateSSOProvider: ReturnType<(options: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/providers/:providerId", {
+        method: "PATCH";
+        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        params: zod0.ZodObject<{
+          providerId: zod0.ZodString;
+        }, better_auth0.$strip>;
+        body: zod0.ZodObject<{
+          issuer: zod0.ZodOptional<zod0.ZodString>;
+          domain: zod0.ZodOptional<zod0.ZodString>;
+          oidcConfig: zod0.ZodOptional<zod0.ZodObject<{
+            clientId: zod0.ZodOptional<zod0.ZodString>;
+            clientSecret: zod0.ZodOptional<zod0.ZodString>;
+            authorizationEndpoint: zod0.ZodOptional<zod0.ZodString>;
+            tokenEndpoint: zod0.ZodOptional<zod0.ZodString>;
+            userInfoEndpoint: zod0.ZodOptional<zod0.ZodString>;
+            tokenEndpointAuthentication: zod0.ZodOptional<zod0.ZodEnum<{
+              client_secret_post: "client_secret_post";
+              client_secret_basic: "client_secret_basic";
+            }>>;
+            jwksEndpoint: zod0.ZodOptional<zod0.ZodString>;
+            discoveryEndpoint: zod0.ZodOptional<zod0.ZodString>;
+            scopes: zod0.ZodOptional<zod0.ZodArray<zod0.ZodString>>;
+            pkce: zod0.ZodOptional<zod0.ZodBoolean>;
+            overrideUserInfo: zod0.ZodOptional<zod0.ZodBoolean>;
+            mapping: zod0.ZodOptional<zod0.ZodObject<{
+              id: zod0.ZodOptional<zod0.ZodString>;
+              email: zod0.ZodOptional<zod0.ZodString>;
+              emailVerified: zod0.ZodOptional<zod0.ZodString>;
+              name: zod0.ZodOptional<zod0.ZodString>;
+              image: zod0.ZodOptional<zod0.ZodString>;
+              extraFields: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
+            }, better_auth0.$strip>>;
+          }, better_auth0.$strip>>;
+          samlConfig: zod0.ZodOptional<zod0.ZodObject<{
+            entryPoint: zod0.ZodOptional<zod0.ZodString>;
+            cert: zod0.ZodOptional<zod0.ZodString>;
+            callbackUrl: zod0.ZodOptional<zod0.ZodString>;
+            audience: zod0.ZodOptional<zod0.ZodString>;
+            idpMetadata: zod0.ZodOptional<zod0.ZodObject<{
+              metadata: zod0.ZodOptional<zod0.ZodString>;
+              entityID: zod0.ZodOptional<zod0.ZodString>;
+              cert: zod0.ZodOptional<zod0.ZodString>;
+              privateKey: zod0.ZodOptional<zod0.ZodString>;
+              privateKeyPass: zod0.ZodOptional<zod0.ZodString>;
+              isAssertionEncrypted: zod0.ZodOptional<zod0.ZodBoolean>;
+              encPrivateKey: zod0.ZodOptional<zod0.ZodString>;
+              encPrivateKeyPass: zod0.ZodOptional<zod0.ZodString>;
+              singleSignOnService: zod0.ZodOptional<zod0.ZodArray<zod0.ZodObject<{
+                Binding: zod0.ZodString;
+                Location: zod0.ZodString;
+              }, better_auth0.$strip>>>;
+            }, better_auth0.$strip>>;
+            spMetadata: zod0.ZodOptional<zod0.ZodObject<{
+              metadata: zod0.ZodOptional<zod0.ZodString>;
+              entityID: zod0.ZodOptional<zod0.ZodString>;
+              binding: zod0.ZodOptional<zod0.ZodString>;
+              privateKey: zod0.ZodOptional<zod0.ZodString>;
+              privateKeyPass: zod0.ZodOptional<zod0.ZodString>;
+              isAssertionEncrypted: zod0.ZodOptional<zod0.ZodBoolean>;
+              encPrivateKey: zod0.ZodOptional<zod0.ZodString>;
+              encPrivateKeyPass: zod0.ZodOptional<zod0.ZodString>;
+            }, better_auth0.$strip>>;
+            wantAssertionsSigned: zod0.ZodOptional<zod0.ZodBoolean>;
+            signatureAlgorithm: zod0.ZodOptional<zod0.ZodString>;
+            digestAlgorithm: zod0.ZodOptional<zod0.ZodString>;
+            identifierFormat: zod0.ZodOptional<zod0.ZodString>;
+            privateKey: zod0.ZodOptional<zod0.ZodString>;
+            decryptionPvk: zod0.ZodOptional<zod0.ZodString>;
+            additionalParams: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
+            mapping: zod0.ZodOptional<zod0.ZodObject<{
+              id: zod0.ZodOptional<zod0.ZodString>;
+              email: zod0.ZodOptional<zod0.ZodString>;
+              emailVerified: zod0.ZodOptional<zod0.ZodString>;
+              name: zod0.ZodOptional<zod0.ZodString>;
+              firstName: zod0.ZodOptional<zod0.ZodString>;
+              lastName: zod0.ZodOptional<zod0.ZodString>;
+              extraFields: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
+            }, better_auth0.$strip>>;
+          }, better_auth0.$strip>>;
+        }, better_auth0.$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+              "404": {
+                description: string;
+              };
+              "403": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        providerId: string;
+        type: string;
+        issuer: string;
+        domain: string;
+        organizationId: string | null;
+        domainVerified: boolean;
+        oidcConfig: {
+          discoveryEndpoint: string;
+          clientIdLastFour: string;
+          pkce: boolean;
+          authorizationEndpoint: string | undefined;
+          tokenEndpoint: string | undefined;
+          userInfoEndpoint: string | undefined;
+          jwksEndpoint: string | undefined;
+          scopes: string[] | undefined;
+          tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
+        } | undefined;
+        samlConfig: {
+          entryPoint: string;
+          callbackUrl: string;
+          audience: string | undefined;
+          wantAssertionsSigned: boolean | undefined;
+          identifierFormat: string | undefined;
+          signatureAlgorithm: string | undefined;
+          digestAlgorithm: string | undefined;
+          certificate: {
+            fingerprintSha256: string;
+            notBefore: string;
+            notAfter: string;
+            publicKeyAlgorithm: string;
+          } | {
+            error: string;
+          };
+        } | undefined;
+        spMetadataUrl: string;
+      }>>;
+      deleteSSOProvider: ReturnType<() => better_auth0.StrictEndpoint<"/sso/providers/:providerId", {
+        method: "DELETE";
+        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>)[];
+        params: zod0.ZodObject<{
+          providerId: zod0.ZodString;
+        }, better_auth0.$strip>;
+        metadata: {
+          openapi: {
+            operationId: string;
+            summary: string;
+            description: string;
+            responses: {
+              "200": {
+                description: string;
+              };
+              "404": {
+                description: string;
+              };
+              "403": {
+                description: string;
+              };
+            };
+          };
+        };
+      }, {
+        success: boolean;
+      }>>;
     } & {
       requestDomainVerification: ReturnType<(options: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/request-domain-verification", {
         method: "POST";
@@ -816,7 +1184,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         }>)[];
       }, void>>;
     };
-    schema: any;
+    schema: NonNullable<better_auth0.BetterAuthPlugin["schema"]>;
     options: _better_auth_sso0.SSOOptions & {
       domainVerification?: {
         enabled: true;
@@ -873,446 +1241,102 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
-  }, {
-    id: "organization";
-    endpoints: better_auth_plugins0.OrganizationEndpoints<{
-      allowUserToCreateOrganization: true;
-      ac: better_auth_plugins0.AccessControl;
-      roles: {
-        member: {
-          authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
-            connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
-        };
-        admin: {
-          authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
-            connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
-        };
-        owner: {
-          authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
-            connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
-        };
+  }, better_auth_plugins0.DefaultOrganizationPlugin<{
+    allowUserToCreateOrganization: true;
+    ac: better_auth_plugins0.AccessControl;
+    roles: {
+      member: {
+        authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+          actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
+          connector: "OR" | "AND";
+        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+        statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
       };
-      creatorRole: "admin";
-      membershipLimit: number;
-      invitationLimit: number;
-      invitationExpiresIn: number;
-      sendInvitationEmail(data: {
-        id: string;
-        role: string;
-        email: string;
-        organization: better_auth_plugins0.Organization;
-        invitation: better_auth_plugins0.Invitation;
-        inviter: better_auth_plugins0.Member & {
-          user: better_auth0.User;
-        };
-      }): Promise<void>;
-      schema: {
-        invitation: {
-          additionalFields: {
-            authMethod: {
-              type: "string";
-              input: true;
-              required: false;
-            };
-          };
-        };
-        organization: {
-          additionalFields: {
-            preferredAuthMethod: {
-              type: "string";
-              input: true;
-              required: false;
-            };
-            serviceAccountUserId: {
-              type: "string";
-              input: true;
-              required: false;
-            };
-          };
-        };
+      admin: {
+        authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+          actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
+          connector: "OR" | "AND";
+        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+        statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
       };
-      organizationHooks: {
-        afterAcceptInvitation: ({
-          member,
-          user,
-          organization: org
-        }: {
-          invitation: better_auth_plugins0.Invitation & Record<string, any>;
-          member: better_auth_plugins0.Member & Record<string, any>;
-          user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
-        }) => Promise<void>;
-        beforeUpdateMemberRole: ({
-          member,
-          organization: org,
-          newRole
-        }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
-          newRole: string;
-          user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
-        }) => Promise<void>;
-        beforeRemoveMember: ({
-          member,
-          organization: org
-        }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
-          user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
-        }) => Promise<void>;
+      owner: {
+        authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+          actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
+          connector: "OR" | "AND";
+        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+        statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
       };
-    }>;
+    };
+    creatorRole: "admin";
+    membershipLimit: number;
+    invitationLimit: number;
+    invitationExpiresIn: number;
+    sendInvitationEmail(data: {
+      id: string;
+      role: string;
+      email: string;
+      organization: better_auth_plugins0.Organization;
+      invitation: better_auth_plugins0.Invitation;
+      inviter: better_auth_plugins0.Member & {
+        user: better_auth0.User;
+      };
+    }): Promise<void>;
     schema: {
-      organization: {
-        modelName: string;
-        fields: {
-          name: {
-            type: "string";
-            required: true;
-            sortable: true;
-          };
-          slug: {
-            type: "string";
-            required: true;
-            unique: true;
-            sortable: true;
-          };
-          logo: {
+      invitation: {
+        additionalFields: {
+          authMethod: {
             type: "string";
-            required: false;
-          };
-          createdAt: {
-            type: "date";
-            required: true;
-          };
-          updatedAt: {
-            type: "date";
+            input: true;
             required: false;
           };
         };
       };
-      member: {
-        modelName: string;
-        fields: {
-          organizationId: {
-            type: "string";
-            required: true;
-            references: {
-              model: "organization";
-              field: "id";
-            };
-          };
-          userId: {
-            type: "string";
-            required: true;
-            references: {
-              model: "user";
-              field: "id";
-            };
-          };
-          role: {
-            type: "string";
-            required: true;
-            defaultValue: "member";
-          };
-          createdAt: {
-            type: "date";
-            required: true;
-          };
-        };
-      };
-      invitation: {
-        modelName: string;
-        fields: {
-          organizationId: {
-            type: "string";
-            required: true;
-            references: {
-              model: "organization";
-              field: "id";
-            };
-          };
-          email: {
-            type: "string";
-            required: true;
-            sortable: true;
-          };
-          role: {
-            type: "string";
-            required: true;
-            sortable: true;
-          };
-          status: {
+      organization: {
+        additionalFields: {
+          preferredAuthMethod: {
             type: "string";
-            required: true;
-            sortable: true;
-            defaultValue: "pending";
-          };
-          expiresAt: {
-            type: "date";
+            input: true;
             required: false;
           };
-          createdAt: {
-            type: "date";
-            required: true;
-            defaultValue: Date;
-          };
-          inviterId: {
-            type: "string";
-            required: true;
-            references: {
-              model: "user";
-              field: "id";
-            };
-          };
-        };
-      };
-      session: {
-        fields: {
-          activeOrganizationId: {
+          serviceAccountUserId: {
             type: "string";
+            input: true;
             required: false;
           };
         };
       };
     };
-    $Infer: {
-      Organization: {
-        id: string;
-        name: string;
-        slug: string;
-        createdAt: Date;
-        logo?: string | null | undefined;
-        metadata?: any;
-        preferredAuthMethod?: string | undefined;
-        serviceAccountUserId?: string | undefined;
-      };
-      Invitation: {
-        id: string;
-        organizationId: string;
-        email: string;
-        role: "member" | "admin" | "owner";
-        status: better_auth_plugins0.InvitationStatus;
-        inviterId: string;
-        expiresAt: Date;
-        createdAt: Date;
-        authMethod?: string | undefined;
-      };
-      Member: {
-        id: string;
-        organizationId: string;
-        role: "member" | "admin" | "owner";
-        createdAt: Date;
-        userId: string;
-        user: {
-          id: string;
-          email: string;
-          name: string;
-          image?: string | undefined;
-        };
-      };
-      Team: any;
-      TeamMember: any;
-      ActiveOrganization: {
-        members: {
-          id: string;
-          organizationId: string;
-          role: "member" | "admin" | "owner";
-          createdAt: Date;
-          userId: string;
-          user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | undefined;
-          };
-        }[];
-        invitations: {
-          id: string;
-          organizationId: string;
-          email: string;
-          role: "member" | "admin" | "owner";
-          status: better_auth_plugins0.InvitationStatus;
-          inviterId: string;
-          expiresAt: Date;
-          createdAt: Date;
-          authMethod?: string | undefined;
-        }[];
-      } & {
-        id: string;
-        name: string;
-        slug: string;
-        createdAt: Date;
-        logo?: string | null | undefined;
-        metadata?: any;
-        preferredAuthMethod?: string | undefined;
-        serviceAccountUserId?: string | undefined;
-      };
+    organizationHooks: {
+      afterAcceptInvitation: ({
+        member,
+        user,
+        organization: org
+      }: {
+        invitation: better_auth_plugins0.Invitation & Record<string, any>;
+        member: better_auth_plugins0.Member & Record<string, any>;
+        user: better_auth0.User & Record<string, any>;
+        organization: better_auth_plugins0.Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeUpdateMemberRole: ({
+        member,
+        organization: org,
+        newRole
+      }: {
+        member: better_auth_plugins0.Member & Record<string, any>;
+        newRole: string;
+        user: better_auth0.User & Record<string, any>;
+        organization: better_auth_plugins0.Organization & Record<string, any>;
+      }) => Promise<void>;
+      beforeRemoveMember: ({
+        member,
+        organization: org
+      }: {
+        member: better_auth_plugins0.Member & Record<string, any>;
+        user: better_auth0.User & Record<string, any>;
+        organization: better_auth_plugins0.Organization & Record<string, any>;
+      }) => Promise<void>;
     };
-    $ERROR_CODES: {
-      readonly YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION: "You are not allowed to create a new organization";
-      readonly YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS: "You have reached the maximum number of organizations";
-      readonly ORGANIZATION_ALREADY_EXISTS: "Organization already exists";
-      readonly ORGANIZATION_SLUG_ALREADY_TAKEN: "Organization slug already taken";
-      readonly ORGANIZATION_NOT_FOUND: "Organization not found";
-      readonly USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION: "User is not a member of the organization";
-      readonly YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_ORGANIZATION: "You are not allowed to update this organization";
-      readonly YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_ORGANIZATION: "You are not allowed to delete this organization";
-      readonly NO_ACTIVE_ORGANIZATION: "No active organization";
-      readonly USER_IS_ALREADY_A_MEMBER_OF_THIS_ORGANIZATION: "User is already a member of this organization";
-      readonly MEMBER_NOT_FOUND: "Member not found";
-      readonly ROLE_NOT_FOUND: "Role not found";
-      readonly YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_TEAM: "You are not allowed to create a new team";
-      readonly TEAM_ALREADY_EXISTS: "Team already exists";
-      readonly TEAM_NOT_FOUND: "Team not found";
-      readonly YOU_CANNOT_LEAVE_THE_ORGANIZATION_AS_THE_ONLY_OWNER: "You cannot leave the organization as the only owner";
-      readonly YOU_CANNOT_LEAVE_THE_ORGANIZATION_WITHOUT_AN_OWNER: "You cannot leave the organization without an owner";
-      readonly YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_MEMBER: "You are not allowed to delete this member";
-      readonly YOU_ARE_NOT_ALLOWED_TO_INVITE_USERS_TO_THIS_ORGANIZATION: "You are not allowed to invite users to this organization";
-      readonly USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION: "User is already invited to this organization";
-      readonly INVITATION_NOT_FOUND: "Invitation not found";
-      readonly YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION: "You are not the recipient of the invitation";
-      readonly EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION: "Email verification required before accepting or rejecting invitation";
-      readonly YOU_ARE_NOT_ALLOWED_TO_CANCEL_THIS_INVITATION: "You are not allowed to cancel this invitation";
-      readonly INVITER_IS_NO_LONGER_A_MEMBER_OF_THE_ORGANIZATION: "Inviter is no longer a member of the organization";
-      readonly YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE: "You are not allowed to invite a user with this role";
-      readonly FAILED_TO_RETRIEVE_INVITATION: "Failed to retrieve invitation";
-      readonly YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_TEAMS: "You have reached the maximum number of teams";
-      readonly UNABLE_TO_REMOVE_LAST_TEAM: "Unable to remove last team";
-      readonly YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_MEMBER: "You are not allowed to update this member";
-      readonly ORGANIZATION_MEMBERSHIP_LIMIT_REACHED: "Organization membership limit reached";
-      readonly YOU_ARE_NOT_ALLOWED_TO_CREATE_TEAMS_IN_THIS_ORGANIZATION: "You are not allowed to create teams in this organization";
-      readonly YOU_ARE_NOT_ALLOWED_TO_DELETE_TEAMS_IN_THIS_ORGANIZATION: "You are not allowed to delete teams in this organization";
-      readonly YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_TEAM: "You are not allowed to update this team";
-      readonly YOU_ARE_NOT_ALLOWED_TO_DELETE_THIS_TEAM: "You are not allowed to delete this team";
-      readonly INVITATION_LIMIT_REACHED: "Invitation limit reached";
-      readonly TEAM_MEMBER_LIMIT_REACHED: "Team member limit reached";
-      readonly USER_IS_NOT_A_MEMBER_OF_THE_TEAM: "User is not a member of the team";
-      readonly YOU_CAN_NOT_ACCESS_THE_MEMBERS_OF_THIS_TEAM: "You are not allowed to list the members of this team";
-      readonly YOU_DO_NOT_HAVE_AN_ACTIVE_TEAM: "You do not have an active team";
-      readonly YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_TEAM_MEMBER: "You are not allowed to create a new member";
-      readonly YOU_ARE_NOT_ALLOWED_TO_REMOVE_A_TEAM_MEMBER: "You are not allowed to remove a team member";
-      readonly YOU_ARE_NOT_ALLOWED_TO_ACCESS_THIS_ORGANIZATION: "You are not allowed to access this organization as an owner";
-      readonly YOU_ARE_NOT_A_MEMBER_OF_THIS_ORGANIZATION: "You are not a member of this organization";
-      readonly MISSING_AC_INSTANCE: "Dynamic Access Control requires a pre-defined ac instance on the server auth plugin. Read server logs for more information";
-      readonly YOU_MUST_BE_IN_AN_ORGANIZATION_TO_CREATE_A_ROLE: "You must be in an organization to create a role";
-      readonly YOU_ARE_NOT_ALLOWED_TO_CREATE_A_ROLE: "You are not allowed to create a role";
-      readonly YOU_ARE_NOT_ALLOWED_TO_UPDATE_A_ROLE: "You are not allowed to update a role";
-      readonly YOU_ARE_NOT_ALLOWED_TO_DELETE_A_ROLE: "You are not allowed to delete a role";
-      readonly YOU_ARE_NOT_ALLOWED_TO_READ_A_ROLE: "You are not allowed to read a role";
-      readonly YOU_ARE_NOT_ALLOWED_TO_LIST_A_ROLE: "You are not allowed to list a role";
-      readonly YOU_ARE_NOT_ALLOWED_TO_GET_A_ROLE: "You are not allowed to get a role";
-      readonly TOO_MANY_ROLES: "This organization has too many roles";
-      readonly INVALID_RESOURCE: "The provided permission includes an invalid resource";
-      readonly ROLE_NAME_IS_ALREADY_TAKEN: "That role name is already taken";
-      readonly CANNOT_DELETE_A_PRE_DEFINED_ROLE: "Cannot delete a pre-defined role";
-    };
-    options: NoInfer<{
-      allowUserToCreateOrganization: true;
-      ac: better_auth_plugins0.AccessControl;
-      roles: {
-        member: {
-          authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
-            connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
-        };
-        admin: {
-          authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
-            connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
-        };
-        owner: {
-          authorize<K_1 extends "organization" | "member" | "project" | "invitation" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>[key];
-            connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "project" | "invitation" | "ac" | "team", better_auth_plugins0.Statements>;
-        };
-      };
-      creatorRole: "admin";
-      membershipLimit: number;
-      invitationLimit: number;
-      invitationExpiresIn: number;
-      sendInvitationEmail(data: {
-        id: string;
-        role: string;
-        email: string;
-        organization: better_auth_plugins0.Organization;
-        invitation: better_auth_plugins0.Invitation;
-        inviter: better_auth_plugins0.Member & {
-          user: better_auth0.User;
-        };
-      }): Promise<void>;
-      schema: {
-        invitation: {
-          additionalFields: {
-            authMethod: {
-              type: "string";
-              input: true;
-              required: false;
-            };
-          };
-        };
-        organization: {
-          additionalFields: {
-            preferredAuthMethod: {
-              type: "string";
-              input: true;
-              required: false;
-            };
-            serviceAccountUserId: {
-              type: "string";
-              input: true;
-              required: false;
-            };
-          };
-        };
-      };
-      organizationHooks: {
-        afterAcceptInvitation: ({
-          member,
-          user,
-          organization: org
-        }: {
-          invitation: better_auth_plugins0.Invitation & Record<string, any>;
-          member: better_auth_plugins0.Member & Record<string, any>;
-          user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
-        }) => Promise<void>;
-        beforeUpdateMemberRole: ({
-          member,
-          organization: org,
-          newRole
-        }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
-          newRole: string;
-          user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
-        }) => Promise<void>;
-        beforeRemoveMember: ({
-          member,
-          organization: org
-        }: {
-          member: better_auth_plugins0.Member & Record<string, any>;
-          user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins0.Organization & Record<string, any>;
-        }) => Promise<void>;
-      };
-    }>;
-  }, {
+  }>, {
     id: "device-authorization";
     schema: {
       deviceCode: {
@@ -1560,8 +1584,10 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         }, better_auth0.$strip>;
         error: zod0.ZodObject<{
           error: zod0.ZodEnum<{
+            unauthorized: "unauthorized";
             invalid_request: "invalid_request";
             expired_token: "expired_token";
+            access_denied: "access_denied";
             device_code_already_processed: "device_code_already_processed";
           }>;
           error_description: zod0.ZodString;
@@ -1599,11 +1625,14 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         }, better_auth0.$strip>;
         error: zod0.ZodObject<{
           error: zod0.ZodEnum<{
+            unauthorized: "unauthorized";
             invalid_request: "invalid_request";
             expired_token: "expired_token";
+            access_denied: "access_denied";
           }>;
           error_description: zod0.ZodString;
         }, better_auth0.$strip>;
+        requireHeaders: true;
         metadata: {
           openapi: {
             description: string;