@inkeep/agents-core 0.58.21 → 0.59.1

package/dist/auth/auth.d.ts

@@ -1,266 +1,27 @@
-import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
-import * as pg0 from "pg";
+import { BetterAuthConfig, EmailServiceConfig, OIDCProviderConfig, SAMLProviderConfig, SSOProviderConfig, UserAuthConfig } from "./auth-types.js";
+import { extractCookieDomain, hasCredentialAccount } from "./auth-config-utils.js";
 import * as zod0 from "zod";
 import * as better_auth0 from "better-auth";
-import { BetterAuthAdvancedOptions } from "better-auth";
-import * as _better_auth_sso0 from "@better-auth/sso";
 import * as better_auth_plugins0 from "better-auth/plugins";
-import { GoogleOptions } from "better-auth/social-providers";
 
 //#region src/auth/auth.d.ts
-interface OIDCProviderConfig {
-  clientId: string;
-  clientSecret: string;
-  authorizationEndpoint?: string;
-  tokenEndpoint?: string;
-  userinfoEndpoint?: string;
-  jwksEndpoint?: string;
-  discoveryEndpoint?: string;
-  scopes?: string[];
-  pkce?: boolean;
-  mapping?: {
-    id?: string;
-    email?: string;
-    emailVerified?: string;
-    name?: string;
-    image?: string;
-    extraFields?: Record<string, string>;
-  };
-}
-interface SAMLProviderConfig {
-  entryPoint: string;
-  cert: string;
-  callbackUrl: string;
-  audience?: string;
-  wantAssertionsSigned?: boolean;
-  signatureAlgorithm?: string;
-  digestAlgorithm?: string;
-  identifierFormat?: string;
-  mapping?: {
-    id?: string;
-    email?: string;
-    name?: string;
-    firstName?: string;
-    lastName?: string;
-    emailVerified?: string;
-    extraFields?: Record<string, string>;
-  };
-}
-interface SSOProviderConfig {
-  providerId: string;
-  issuer: string;
-  domain: string;
-  organizationId?: string;
-  oidcConfig?: OIDCProviderConfig;
-  samlConfig?: SAMLProviderConfig;
-}
-interface EmailServiceConfig {
-  sendInvitationEmail(data: {
-    to: string;
-    inviterName: string;
-    organizationName: string;
-    role: string;
-    invitationUrl: string;
-    authMethod?: string;
-    expiresInDays?: number;
-  }): Promise<{
-    emailSent: boolean;
-    error?: string;
-  }>;
-  sendPasswordResetEmail(data: {
-    to: string;
-    resetUrl: string;
-    expiresInMinutes?: number;
-  }): Promise<{
-    emailSent: boolean;
-    error?: string;
-  }>;
-  isConfigured: boolean;
-}
-interface BetterAuthConfig {
-  baseURL: string;
-  secret: string;
-  dbClient: AgentsRunDatabaseClient;
-  manageDbPool?: pg0.Pool;
-  cookieDomain?: string;
-  ssoProviders?: SSOProviderConfig[];
-  socialProviders?: {
-    google?: GoogleOptions;
-  };
-  advanced?: BetterAuthAdvancedOptions;
-  emailService?: EmailServiceConfig;
-}
-interface UserAuthConfig {
-  ssoProviders?: SSOProviderConfig[];
-  socialProviders?: {
-    google?: GoogleOptions;
-  };
-  advanced?: BetterAuthAdvancedOptions;
-}
+
 /**
- * Extracts the root domain from a URL for cross-subdomain cookie sharing.
- *
- * When the API and UI share a common 3-part parent (e.g., api.pilot.inkeep.com
- * and pilot.inkeep.com both share .pilot.inkeep.com), the function auto-computes
- * the shared parent. When domains don't share a 3-part parent (e.g.,
- * api.agents.inkeep.com and app.inkeep.com), set AUTH_COOKIE_DOMAIN explicitly.
- *
- * Examples (auto-computed from baseURL):
- * - https://api.pilot.inkeep.com -> .pilot.inkeep.com
- * - https://pilot.inkeep.com -> .pilot.inkeep.com
- * - http://localhost:3002 -> undefined (no domain for localhost)
+ * Type-only helper: a simplified betterAuth call that TypeScript can evaluate
+ * cheaply to produce precise API types. The real createAuth() has complex
+ * callbacks/closures that cause TypeScript to fall back to index signatures.
+ * This function is never called at runtime.
  *
- * With AUTH_COOKIE_DOMAIN=.inkeep.com:
- * - Any *.inkeep.com URL -> .inkeep.com
+ * Note: sso() and dash() are intentionally excluded here. They come from
+ * @better-auth/sso and @better-auth/infra which resolve @better-auth/core
+ * through different pnpm virtual store paths (due to @better-auth/infra
+ * bundling better-call@beta). This creates duplicate @better-auth/core
+ * instances that TypeScript treats as incompatible, causing the plugins
+ * array to widen to BetterAuthPlugin[] and producing an index signature
+ * on .api. Since no auth.api.* calls use SSO or dash methods, omitting
+ * them is safe and preserves precise types.
  */
-declare function extractCookieDomain(baseURL: string, explicitDomain?: string): string | undefined;
-declare function hasCredentialAccount(dbClient: AgentsRunDatabaseClient, userId: string): Promise<boolean>;
-declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
-  baseURL: string;
-  secret: string;
-  database: (options: better_auth0.BetterAuthOptions) => better_auth0.DBAdapter<better_auth0.BetterAuthOptions>;
-  emailAndPassword: {
-    enabled: true;
-    minPasswordLength: number;
-    maxPasswordLength: number;
-    requireEmailVerification: false;
-    autoSignIn: true;
-    resetPasswordTokenExpiresIn: number;
-    sendResetPassword: ({
-      user,
-      url,
-      token
-    }: {
-      user: better_auth0.User;
-      url: string;
-      token: string;
-    }) => Promise<void>;
-  };
-  account: {
-    accountLinking: {
-      enabled: true;
-      trustedProviders: ("google" | "email-password" | "auth0")[];
-    };
-  };
-  databaseHooks: {
-    session: {
-      create: {
-        before: (session: {
-          id: string;
-          createdAt: Date;
-          updatedAt: Date;
-          userId: string;
-          expiresAt: Date;
-          token: string;
-          ipAddress?: string | null | undefined;
-          userAgent?: string | null | undefined;
-        } & Record<string, unknown>) => Promise<{
-          data: {
-            activeOrganizationId: string | null;
-            id: string;
-            createdAt: Date;
-            updatedAt: Date;
-            userId: string;
-            expiresAt: Date;
-            token: string;
-            ipAddress?: string | null | undefined;
-            userAgent?: string | null | undefined;
-          };
-        }>;
-      };
-    };
-  };
-  socialProviders: {
-    google: {
-      redirectURI?: string | undefined;
-      clientId: string;
-      accessType?: ("offline" | "online") | undefined;
-      display?: ("page" | "popup" | "touch" | "wap") | undefined;
-      hd?: string | undefined;
-      clientSecret?: string | undefined;
-      scope?: string[] | undefined;
-      disableDefaultScope?: boolean | undefined;
-      authorizationEndpoint?: string | undefined;
-      clientKey?: string | undefined;
-      disableIdTokenSignIn?: boolean | undefined;
-      verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
-      getUserInfo?: ((token: better_auth0.OAuth2Tokens) => Promise<{
-        user: {
-          id: string;
-          name?: string;
-          email?: string | null;
-          image?: string;
-          emailVerified: boolean;
-          [key: string]: any;
-        };
-        data: any;
-      } | null>) | undefined;
-      refreshAccessToken?: ((refreshToken: string) => Promise<better_auth0.OAuth2Tokens>) | undefined;
-      mapProfileToUser?: ((profile: better_auth0.GoogleProfile) => {
-        id?: string;
-        name?: string;
-        email?: string | null;
-        image?: string;
-        emailVerified?: boolean;
-        [key: string]: any;
-      } | Promise<{
-        id?: string;
-        name?: string;
-        email?: string | null;
-        image?: string;
-        emailVerified?: boolean;
-        [key: string]: any;
-      }>) | undefined;
-      disableImplicitSignUp?: boolean | undefined;
-      disableSignUp?: boolean | undefined;
-      prompt?: ("select_account" | "consent" | "login" | "none" | "select_account consent") | undefined;
-      responseMode?: ("query" | "form_post") | undefined;
-      overrideUserInfoOnSignIn?: boolean | undefined;
-    };
-  } | undefined;
-  session: {
-    expiresIn: number;
-    updateAge: number;
-    cookieCache: {
-      enabled: true;
-      maxAge: number;
-      strategy: "compact";
-    };
-  };
-  advanced: {
-    ipAddress?: {
-      ipAddressHeaders?: string[];
-      disableIpTracking?: boolean;
-      ipv6Subnet?: 128 | 64 | 48 | 32 | undefined;
-    } | undefined;
-    useSecureCookies?: boolean | undefined;
-    disableCSRFCheck?: boolean | undefined;
-    disableOriginCheck?: boolean | undefined;
-    crossSubDomainCookies?: {
-      enabled: boolean;
-      additionalCookies?: string[];
-      domain?: string;
-    } | undefined;
-    cookies?: {
-      [key: string]: {
-        name?: string;
-        attributes?: better_auth0.CookieOptions;
-      };
-    } | undefined;
-    defaultCookieAttributes: better_auth0.CookieOptions;
-    cookiePrefix?: string | undefined;
-    database?: {
-      defaultFindManyLimit?: number;
-      useNumberId?: boolean;
-      generateId?: better_auth0.GenerateIdFn | false | "serial" | "uuid";
-    } | undefined;
-    trustedProxyHeaders?: boolean | undefined;
-    backgroundTasks?: {
-      handler: (promise: Promise<unknown>) => void;
-    };
-    skipTrailingSlashes?: boolean | undefined;
-  };
-  trustedOrigins: string[];
+declare function _inferAuthType(): better_auth0.Auth<{
   plugins: [{
     id: "bearer";
     hooks: {
@@ -278,969 +39,33 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       }[];
     };
     options: better_auth_plugins0.BearerOptions | undefined;
-  }, {
-    id: "sso";
-    endpoints: {
-      spMetadata: ReturnType<() => better_auth0.StrictEndpoint<"/sso/saml2/sp/metadata", {
-        method: "GET";
-        query: zod0.ZodObject<{
-          providerId: zod0.ZodString;
-          format: zod0.ZodDefault<zod0.ZodEnum<{
-            xml: "xml";
-            json: "json";
-          }>>;
-        }, better_auth0.$strip>;
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-              };
-            };
-          };
-        };
-      }, Response>>;
-      registerSSOProvider: better_auth0.StrictEndpoint<"/sso/register", {
-        method: "POST";
-        body: zod0.ZodObject<{
-          providerId: zod0.ZodString;
-          issuer: zod0.ZodString;
-          domain: zod0.ZodString;
-          oidcConfig: zod0.ZodOptional<zod0.ZodObject<{
-            clientId: zod0.ZodString;
-            clientSecret: zod0.ZodString;
-            authorizationEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            tokenEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            userInfoEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            tokenEndpointAuthentication: zod0.ZodOptional<zod0.ZodEnum<{
-              client_secret_post: "client_secret_post";
-              client_secret_basic: "client_secret_basic";
-            }>>;
-            jwksEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            discoveryEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            skipDiscovery: zod0.ZodOptional<zod0.ZodBoolean>;
-            scopes: zod0.ZodOptional<zod0.ZodArray<zod0.ZodString>>;
-            pkce: zod0.ZodOptional<zod0.ZodDefault<zod0.ZodBoolean>>;
-            mapping: zod0.ZodOptional<zod0.ZodObject<{
-              id: zod0.ZodString;
-              email: zod0.ZodString;
-              emailVerified: zod0.ZodOptional<zod0.ZodString>;
-              name: zod0.ZodString;
-              image: zod0.ZodOptional<zod0.ZodString>;
-              extraFields: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
-            }, better_auth0.$strip>>;
-          }, better_auth0.$strip>>;
-          samlConfig: zod0.ZodOptional<zod0.ZodObject<{
-            entryPoint: zod0.ZodString;
-            cert: zod0.ZodString;
-            callbackUrl: zod0.ZodString;
-            audience: zod0.ZodOptional<zod0.ZodString>;
-            idpMetadata: zod0.ZodOptional<zod0.ZodObject<{
-              metadata: zod0.ZodOptional<zod0.ZodString>;
-              entityID: zod0.ZodOptional<zod0.ZodString>;
-              cert: zod0.ZodOptional<zod0.ZodString>;
-              privateKey: zod0.ZodOptional<zod0.ZodString>;
-              privateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-              isAssertionEncrypted: zod0.ZodOptional<zod0.ZodBoolean>;
-              encPrivateKey: zod0.ZodOptional<zod0.ZodString>;
-              encPrivateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-              singleSignOnService: zod0.ZodOptional<zod0.ZodArray<zod0.ZodObject<{
-                Binding: zod0.ZodString;
-                Location: zod0.ZodString;
-              }, better_auth0.$strip>>>;
-            }, better_auth0.$strip>>;
-            spMetadata: zod0.ZodObject<{
-              metadata: zod0.ZodOptional<zod0.ZodString>;
-              entityID: zod0.ZodOptional<zod0.ZodString>;
-              binding: zod0.ZodOptional<zod0.ZodString>;
-              privateKey: zod0.ZodOptional<zod0.ZodString>;
-              privateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-              isAssertionEncrypted: zod0.ZodOptional<zod0.ZodBoolean>;
-              encPrivateKey: zod0.ZodOptional<zod0.ZodString>;
-              encPrivateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-            }, better_auth0.$strip>;
-            wantAssertionsSigned: zod0.ZodOptional<zod0.ZodBoolean>;
-            signatureAlgorithm: zod0.ZodOptional<zod0.ZodString>;
-            digestAlgorithm: zod0.ZodOptional<zod0.ZodString>;
-            identifierFormat: zod0.ZodOptional<zod0.ZodString>;
-            privateKey: zod0.ZodOptional<zod0.ZodString>;
-            decryptionPvk: zod0.ZodOptional<zod0.ZodString>;
-            additionalParams: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
-            mapping: zod0.ZodOptional<zod0.ZodObject<{
-              id: zod0.ZodString;
-              email: zod0.ZodString;
-              emailVerified: zod0.ZodOptional<zod0.ZodString>;
-              name: zod0.ZodString;
-              firstName: zod0.ZodOptional<zod0.ZodString>;
-              lastName: zod0.ZodOptional<zod0.ZodString>;
-              extraFields: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
-            }, better_auth0.$strip>>;
-          }, better_auth0.$strip>>;
-          organizationId: zod0.ZodOptional<zod0.ZodString>;
-          overrideUserInfo: zod0.ZodOptional<zod0.ZodDefault<zod0.ZodBoolean>>;
-        }, better_auth0.$strip>;
-        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          };
-        }>)[];
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "object";
-                      properties: {
-                        issuer: {
-                          type: string;
-                          format: string;
-                          description: string;
-                        };
-                        domain: {
-                          type: string;
-                          description: string;
-                        };
-                        domainVerified: {
-                          type: string;
-                          description: string;
-                        };
-                        domainVerificationToken: {
-                          type: string;
-                          description: string;
-                        };
-                        oidcConfig: {
-                          type: string;
-                          properties: {
-                            issuer: {
-                              type: string;
-                              format: string;
-                              description: string;
-                            };
-                            pkce: {
-                              type: string;
-                              description: string;
-                            };
-                            clientId: {
-                              type: string;
-                              description: string;
-                            };
-                            clientSecret: {
-                              type: string;
-                              description: string;
-                            };
-                            authorizationEndpoint: {
-                              type: string;
-                              format: string;
-                              nullable: boolean;
-                              description: string;
-                            };
-                            discoveryEndpoint: {
-                              type: string;
-                              format: string;
-                              description: string;
-                            };
-                            userInfoEndpoint: {
-                              type: string;
-                              format: string;
-                              nullable: boolean;
-                              description: string;
-                            };
-                            scopes: {
-                              type: string;
-                              items: {
-                                type: string;
-                              };
-                              nullable: boolean;
-                              description: string;
-                            };
-                            tokenEndpoint: {
-                              type: string;
-                              format: string;
-                              nullable: boolean;
-                              description: string;
-                            };
-                            tokenEndpointAuthentication: {
-                              type: string;
-                              enum: string[];
-                              nullable: boolean;
-                              description: string;
-                            };
-                            jwksEndpoint: {
-                              type: string;
-                              format: string;
-                              nullable: boolean;
-                              description: string;
-                            };
-                            mapping: {
-                              type: string;
-                              nullable: boolean;
-                              properties: {
-                                id: {
-                                  type: string;
-                                  description: string;
-                                };
-                                email: {
-                                  type: string;
-                                  description: string;
-                                };
-                                emailVerified: {
-                                  type: string;
-                                  nullable: boolean;
-                                  description: string;
-                                };
-                                name: {
-                                  type: string;
-                                  description: string;
-                                };
-                                image: {
-                                  type: string;
-                                  nullable: boolean;
-                                  description: string;
-                                };
-                                extraFields: {
-                                  type: string;
-                                  additionalProperties: {
-                                    type: string;
-                                  };
-                                  nullable: boolean;
-                                  description: string;
-                                };
-                              };
-                              required: string[];
-                            };
-                          };
-                          required: string[];
-                          description: string;
-                        };
-                        organizationId: {
-                          type: string;
-                          nullable: boolean;
-                          description: string;
-                        };
-                        userId: {
-                          type: string;
-                          description: string;
-                        };
-                        providerId: {
-                          type: string;
-                          description: string;
-                        };
-                        redirectURI: {
-                          type: string;
-                          format: string;
-                          description: string;
-                        };
-                      };
-                      required: string[];
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      }, {
-        redirectURI: string;
-        oidcConfig: _better_auth_sso0.OIDCConfig | null;
-        samlConfig: _better_auth_sso0.SAMLConfig | null;
-      } & Omit<{
-        issuer: string;
-        oidcConfig?: _better_auth_sso0.OIDCConfig | undefined;
-        samlConfig?: _better_auth_sso0.SAMLConfig | undefined;
-        userId: string;
-        providerId: string;
-        organizationId?: string | undefined;
-        domain: string;
-      }, "oidcConfig" | "samlConfig">>;
-      signInSSO: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sign-in/sso", {
-        method: "POST";
-        body: zod0.ZodObject<{
-          email: zod0.ZodOptional<zod0.ZodString>;
-          organizationSlug: zod0.ZodOptional<zod0.ZodString>;
-          providerId: zod0.ZodOptional<zod0.ZodString>;
-          domain: zod0.ZodOptional<zod0.ZodString>;
-          callbackURL: zod0.ZodString;
-          errorCallbackURL: zod0.ZodOptional<zod0.ZodString>;
-          newUserCallbackURL: zod0.ZodOptional<zod0.ZodString>;
-          scopes: zod0.ZodOptional<zod0.ZodArray<zod0.ZodString>>;
-          loginHint: zod0.ZodOptional<zod0.ZodString>;
-          requestSignUp: zod0.ZodOptional<zod0.ZodBoolean>;
-          providerType: zod0.ZodOptional<zod0.ZodEnum<{
-            saml: "saml";
-            oidc: "oidc";
-          }>>;
-        }, better_auth0.$strip>;
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            requestBody: {
-              content: {
-                "application/json": {
-                  schema: {
-                    type: "object";
-                    properties: {
-                      email: {
-                        type: string;
-                        description: string;
-                      };
-                      issuer: {
-                        type: string;
-                        description: string;
-                      };
-                      providerId: {
-                        type: string;
-                        description: string;
-                      };
-                      callbackURL: {
-                        type: string;
-                        description: string;
-                      };
-                      errorCallbackURL: {
-                        type: string;
-                        description: string;
-                      };
-                      newUserCallbackURL: {
-                        type: string;
-                        description: string;
-                      };
-                      loginHint: {
-                        type: string;
-                        description: string;
-                      };
-                    };
-                    required: string[];
-                  };
-                };
-              };
-            };
-            responses: {
-              "200": {
-                description: string;
-                content: {
-                  "application/json": {
-                    schema: {
-                      type: "object";
-                      properties: {
-                        url: {
-                          type: string;
-                          format: string;
-                          description: string;
-                        };
-                        redirect: {
-                          type: string;
-                          description: string;
-                          enum: boolean[];
-                        };
-                      };
-                      required: string[];
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      }, {
-        url: string;
-        redirect: boolean;
-      }>>;
-      callbackSSO: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/callback/:providerId", {
-        method: "GET";
-        query: zod0.ZodObject<{
-          code: zod0.ZodOptional<zod0.ZodString>;
-          state: zod0.ZodString;
-          error: zod0.ZodOptional<zod0.ZodString>;
-          error_description: zod0.ZodOptional<zod0.ZodString>;
-        }, better_auth0.$strip>;
-        allowedMediaTypes: string[];
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "302": {
-                description: string;
-              };
-            };
-          };
-          scope: "server";
-        };
-      }, never>>;
-      callbackSSOSAML: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
-        method: ("POST" | "GET")[];
-        body: zod0.ZodOptional<zod0.ZodObject<{
-          SAMLResponse: zod0.ZodString;
-          RelayState: zod0.ZodOptional<zod0.ZodString>;
-        }, better_auth0.$strip>>;
-        query: zod0.ZodOptional<zod0.ZodObject<{
-          RelayState: zod0.ZodOptional<zod0.ZodString>;
-        }, better_auth0.$strip>>;
-        metadata: {
-          allowedMediaTypes: string[];
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "302": {
-                description: string;
-              };
-              "400": {
-                description: string;
-              };
-              "401": {
-                description: string;
-              };
-            };
-          };
-          scope: "server";
-        };
-      }, never>>;
-      acsEndpoint: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
-        method: "POST";
-        body: zod0.ZodObject<{
-          SAMLResponse: zod0.ZodString;
-          RelayState: zod0.ZodOptional<zod0.ZodString>;
-        }, better_auth0.$strip>;
-        metadata: {
-          allowedMediaTypes: string[];
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "302": {
-                description: string;
-              };
-            };
-          };
-          scope: "server";
-        };
-      }, never>>;
-      listSSOProviders: ReturnType<() => better_auth0.StrictEndpoint<"/sso/providers", {
-        method: "GET";
-        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          };
-        }>)[];
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-              };
-            };
-          };
-        };
-      }, {
-        providers: {
-          providerId: string;
-          type: string;
-          issuer: string;
-          domain: string;
-          organizationId: string | null;
-          domainVerified: boolean;
-          oidcConfig: {
-            discoveryEndpoint: string;
-            clientIdLastFour: string;
-            pkce: boolean;
-            authorizationEndpoint: string | undefined;
-            tokenEndpoint: string | undefined;
-            userInfoEndpoint: string | undefined;
-            jwksEndpoint: string | undefined;
-            scopes: string[] | undefined;
-            tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
-          } | undefined;
-          samlConfig: {
-            entryPoint: string;
-            callbackUrl: string;
-            audience: string | undefined;
-            wantAssertionsSigned: boolean | undefined;
-            identifierFormat: string | undefined;
-            signatureAlgorithm: string | undefined;
-            digestAlgorithm: string | undefined;
-            certificate: {
-              fingerprintSha256: string;
-              notBefore: string;
-              notAfter: string;
-              publicKeyAlgorithm: string;
-            } | {
-              error: string;
-            };
-          } | undefined;
-          spMetadataUrl: string;
-        }[];
-      }>>;
-      getSSOProvider: ReturnType<() => better_auth0.StrictEndpoint<"/sso/providers/:providerId", {
-        method: "GET";
-        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          };
-        }>)[];
-        params: zod0.ZodObject<{
-          providerId: zod0.ZodString;
-        }, better_auth0.$strip>;
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-              };
-              "404": {
-                description: string;
-              };
-              "403": {
-                description: string;
-              };
-            };
-          };
-        };
-      }, {
-        providerId: string;
-        type: string;
-        issuer: string;
-        domain: string;
-        organizationId: string | null;
-        domainVerified: boolean;
-        oidcConfig: {
-          discoveryEndpoint: string;
-          clientIdLastFour: string;
-          pkce: boolean;
-          authorizationEndpoint: string | undefined;
-          tokenEndpoint: string | undefined;
-          userInfoEndpoint: string | undefined;
-          jwksEndpoint: string | undefined;
-          scopes: string[] | undefined;
-          tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
-        } | undefined;
-        samlConfig: {
-          entryPoint: string;
-          callbackUrl: string;
-          audience: string | undefined;
-          wantAssertionsSigned: boolean | undefined;
-          identifierFormat: string | undefined;
-          signatureAlgorithm: string | undefined;
-          digestAlgorithm: string | undefined;
-          certificate: {
-            fingerprintSha256: string;
-            notBefore: string;
-            notAfter: string;
-            publicKeyAlgorithm: string;
-          } | {
-            error: string;
-          };
-        } | undefined;
-        spMetadataUrl: string;
-      }>>;
-      updateSSOProvider: ReturnType<(options: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/providers/:providerId", {
-        method: "PATCH";
-        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          };
-        }>)[];
-        params: zod0.ZodObject<{
-          providerId: zod0.ZodString;
-        }, better_auth0.$strip>;
-        body: zod0.ZodObject<{
-          issuer: zod0.ZodOptional<zod0.ZodString>;
-          domain: zod0.ZodOptional<zod0.ZodString>;
-          oidcConfig: zod0.ZodOptional<zod0.ZodObject<{
-            clientId: zod0.ZodOptional<zod0.ZodString>;
-            clientSecret: zod0.ZodOptional<zod0.ZodString>;
-            authorizationEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            tokenEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            userInfoEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            tokenEndpointAuthentication: zod0.ZodOptional<zod0.ZodEnum<{
-              client_secret_post: "client_secret_post";
-              client_secret_basic: "client_secret_basic";
-            }>>;
-            jwksEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            discoveryEndpoint: zod0.ZodOptional<zod0.ZodString>;
-            scopes: zod0.ZodOptional<zod0.ZodArray<zod0.ZodString>>;
-            pkce: zod0.ZodOptional<zod0.ZodBoolean>;
-            overrideUserInfo: zod0.ZodOptional<zod0.ZodBoolean>;
-            mapping: zod0.ZodOptional<zod0.ZodObject<{
-              id: zod0.ZodOptional<zod0.ZodString>;
-              email: zod0.ZodOptional<zod0.ZodString>;
-              emailVerified: zod0.ZodOptional<zod0.ZodString>;
-              name: zod0.ZodOptional<zod0.ZodString>;
-              image: zod0.ZodOptional<zod0.ZodString>;
-              extraFields: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
-            }, better_auth0.$strip>>;
-          }, better_auth0.$strip>>;
-          samlConfig: zod0.ZodOptional<zod0.ZodObject<{
-            entryPoint: zod0.ZodOptional<zod0.ZodString>;
-            cert: zod0.ZodOptional<zod0.ZodString>;
-            callbackUrl: zod0.ZodOptional<zod0.ZodString>;
-            audience: zod0.ZodOptional<zod0.ZodString>;
-            idpMetadata: zod0.ZodOptional<zod0.ZodObject<{
-              metadata: zod0.ZodOptional<zod0.ZodString>;
-              entityID: zod0.ZodOptional<zod0.ZodString>;
-              cert: zod0.ZodOptional<zod0.ZodString>;
-              privateKey: zod0.ZodOptional<zod0.ZodString>;
-              privateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-              isAssertionEncrypted: zod0.ZodOptional<zod0.ZodBoolean>;
-              encPrivateKey: zod0.ZodOptional<zod0.ZodString>;
-              encPrivateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-              singleSignOnService: zod0.ZodOptional<zod0.ZodArray<zod0.ZodObject<{
-                Binding: zod0.ZodString;
-                Location: zod0.ZodString;
-              }, better_auth0.$strip>>>;
-            }, better_auth0.$strip>>;
-            spMetadata: zod0.ZodOptional<zod0.ZodObject<{
-              metadata: zod0.ZodOptional<zod0.ZodString>;
-              entityID: zod0.ZodOptional<zod0.ZodString>;
-              binding: zod0.ZodOptional<zod0.ZodString>;
-              privateKey: zod0.ZodOptional<zod0.ZodString>;
-              privateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-              isAssertionEncrypted: zod0.ZodOptional<zod0.ZodBoolean>;
-              encPrivateKey: zod0.ZodOptional<zod0.ZodString>;
-              encPrivateKeyPass: zod0.ZodOptional<zod0.ZodString>;
-            }, better_auth0.$strip>>;
-            wantAssertionsSigned: zod0.ZodOptional<zod0.ZodBoolean>;
-            signatureAlgorithm: zod0.ZodOptional<zod0.ZodString>;
-            digestAlgorithm: zod0.ZodOptional<zod0.ZodString>;
-            identifierFormat: zod0.ZodOptional<zod0.ZodString>;
-            privateKey: zod0.ZodOptional<zod0.ZodString>;
-            decryptionPvk: zod0.ZodOptional<zod0.ZodString>;
-            additionalParams: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
-            mapping: zod0.ZodOptional<zod0.ZodObject<{
-              id: zod0.ZodOptional<zod0.ZodString>;
-              email: zod0.ZodOptional<zod0.ZodString>;
-              emailVerified: zod0.ZodOptional<zod0.ZodString>;
-              name: zod0.ZodOptional<zod0.ZodString>;
-              firstName: zod0.ZodOptional<zod0.ZodString>;
-              lastName: zod0.ZodOptional<zod0.ZodString>;
-              extraFields: zod0.ZodOptional<zod0.ZodRecord<zod0.ZodString, zod0.ZodAny>>;
-            }, better_auth0.$strip>>;
-          }, better_auth0.$strip>>;
-        }, better_auth0.$strip>;
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-              };
-              "404": {
-                description: string;
-              };
-              "403": {
-                description: string;
-              };
-            };
-          };
-        };
-      }, {
-        providerId: string;
-        type: string;
-        issuer: string;
-        domain: string;
-        organizationId: string | null;
-        domainVerified: boolean;
-        oidcConfig: {
-          discoveryEndpoint: string;
-          clientIdLastFour: string;
-          pkce: boolean;
-          authorizationEndpoint: string | undefined;
-          tokenEndpoint: string | undefined;
-          userInfoEndpoint: string | undefined;
-          jwksEndpoint: string | undefined;
-          scopes: string[] | undefined;
-          tokenEndpointAuthentication: "client_secret_post" | "client_secret_basic" | undefined;
-        } | undefined;
-        samlConfig: {
-          entryPoint: string;
-          callbackUrl: string;
-          audience: string | undefined;
-          wantAssertionsSigned: boolean | undefined;
-          identifierFormat: string | undefined;
-          signatureAlgorithm: string | undefined;
-          digestAlgorithm: string | undefined;
-          certificate: {
-            fingerprintSha256: string;
-            notBefore: string;
-            notAfter: string;
-            publicKeyAlgorithm: string;
-          } | {
-            error: string;
-          };
-        } | undefined;
-        spMetadataUrl: string;
-      }>>;
-      deleteSSOProvider: ReturnType<() => better_auth0.StrictEndpoint<"/sso/providers/:providerId", {
-        method: "DELETE";
-        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          };
-        }>)[];
-        params: zod0.ZodObject<{
-          providerId: zod0.ZodString;
-        }, better_auth0.$strip>;
-        metadata: {
-          openapi: {
-            operationId: string;
-            summary: string;
-            description: string;
-            responses: {
-              "200": {
-                description: string;
-              };
-              "404": {
-                description: string;
-              };
-              "403": {
-                description: string;
-              };
-            };
-          };
-        };
-      }, {
-        success: boolean;
-      }>>;
-    } & {
-      requestDomainVerification: ReturnType<(options: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/request-domain-verification", {
-        method: "POST";
-        body: zod0.ZodObject<{
-          providerId: zod0.ZodString;
-        }, better_auth0.$strip>;
-        metadata: {
-          openapi: {
-            summary: string;
-            description: string;
-            responses: {
-              "404": {
-                description: string;
-              };
-              "409": {
-                description: string;
-              };
-              "201": {
-                description: string;
-              };
-            };
-          };
-        };
-        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          };
-        }>)[];
-      }, {
-        domainVerificationToken: string;
-      }>>;
-      verifyDomain: ReturnType<(options: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/verify-domain", {
-        method: "POST";
-        body: zod0.ZodObject<{
-          providerId: zod0.ZodString;
-        }, better_auth0.$strip>;
-        metadata: {
-          openapi: {
-            summary: string;
-            description: string;
-            responses: {
-              "404": {
-                description: string;
-              };
-              "409": {
-                description: string;
-              };
-              "502": {
-                description: string;
-              };
-              "204": {
-                description: string;
-              };
-            };
-          };
-        };
-        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<{
-          session: {
-            session: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            };
-            user: Record<string, any> & {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            };
-          };
-        }>)[];
-      }, void>>;
-    };
-    schema: NonNullable<better_auth0.BetterAuthPlugin["schema"]>;
-    options: _better_auth_sso0.SSOOptions & {
-      domainVerification?: {
-        enabled: true;
-      };
-    };
   }, {
     id: "oauth-proxy";
-    options: NoInfer<{
-      productionURL: string;
-    }>;
+    options: NoInfer<better_auth_plugins0.OAuthProxyOptions>;
     endpoints: {
       oAuthProxy: better_auth0.StrictEndpoint<"/oauth-proxy-callback", {
         method: "GET";
         operationId: string;
         query: zod0.ZodObject<{
           callbackURL: zod0.ZodString;
-          cookies: zod0.ZodString;
+          profile: zod0.ZodOptional<zod0.ZodString>;
         }, better_auth0.$strip>;
         use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>)[];
         metadata: {
           openapi: {
             operationId: string;
             description: string;
-            parameters: {
+            parameters: ({
               in: "query";
               name: string;
               required: true;
               description: string;
-            }[];
+            } | {
+              in: "query";
+              name: string;
+              required: false;
+              description: string;
+            })[];
             responses: {
               302: {
                 description: string;
@@ -1269,51 +94,11 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       }[];
     };
   }, better_auth_plugins0.DefaultOrganizationPlugin<{
-    allowUserToCreateOrganization: true;
-    ac: better_auth_plugins0.AccessControl;
-    roles: {
-      member: {
-        authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-          actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
-          connector: "OR" | "AND";
-        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-        statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
-      };
-      admin: {
-        authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-          actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
-          connector: "OR" | "AND";
-        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-        statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
-      };
-      owner: {
-        authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-          actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
-          connector: "OR" | "AND";
-        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-        statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
-      };
-    };
-    creatorRole: "admin";
-    membershipLimit: number;
-    invitationLimit: number;
-    invitationExpiresIn: number;
-    sendInvitationEmail(data: {
-      id: string;
-      role: string;
-      email: string;
-      organization: better_auth_plugins0.Organization;
-      invitation: better_auth_plugins0.Invitation;
-      inviter: better_auth_plugins0.Member & {
-        user: better_auth0.User;
-      };
-    }): Promise<void>;
     schema: {
       invitation: {
         additionalFields: {
           authMethod: {
             type: "string";
-            input: true;
             required: false;
           };
         };
@@ -1333,36 +118,6 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         };
       };
     };
-    organizationHooks: {
-      afterAcceptInvitation: ({
-        member,
-        user,
-        organization: org
-      }: {
-        invitation: better_auth_plugins0.Invitation & Record<string, any>;
-        member: better_auth_plugins0.Member & Record<string, any>;
-        user: better_auth0.User & Record<string, any>;
-        organization: better_auth_plugins0.Organization & Record<string, any>;
-      }) => Promise<void>;
-      beforeUpdateMemberRole: ({
-        member,
-        organization: org,
-        newRole
-      }: {
-        member: better_auth_plugins0.Member & Record<string, any>;
-        newRole: string;
-        user: better_auth0.User & Record<string, any>;
-        organization: better_auth_plugins0.Organization & Record<string, any>;
-      }) => Promise<void>;
-      beforeRemoveMember: ({
-        member,
-        organization: org
-      }: {
-        member: better_auth_plugins0.Member & Record<string, any>;
-        user: better_auth0.User & Record<string, any>;
-        organization: better_auth_plugins0.Organization & Record<string, any>;
-      }) => Promise<void>;
-    };
   }>, {
     id: "device-authorization";
     schema: {
@@ -1611,11 +366,11 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         }, better_auth0.$strip>;
         error: zod0.ZodObject<{
           error: zod0.ZodEnum<{
-            unauthorized: "unauthorized";
             invalid_request: "invalid_request";
             expired_token: "expired_token";
             access_denied: "access_denied";
             device_code_already_processed: "device_code_already_processed";
+            unauthorized: "unauthorized";
           }>;
           error_description: zod0.ZodString;
         }, better_auth0.$strip>;
@@ -1652,10 +407,10 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         }, better_auth0.$strip>;
         error: zod0.ZodObject<{
           error: zod0.ZodEnum<{
-            unauthorized: "unauthorized";
             invalid_request: "invalid_request";
             expired_token: "expired_token";
             access_denied: "access_denied";
+            unauthorized: "unauthorized";
           }>;
           error_description: zod0.ZodString;
         }, better_auth0.$strip>;
@@ -1687,18 +442,18 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       }>;
     };
     $ERROR_CODES: {
-      readonly INVALID_DEVICE_CODE: "Invalid device code";
-      readonly EXPIRED_DEVICE_CODE: "Device code has expired";
-      readonly EXPIRED_USER_CODE: "User code has expired";
-      readonly AUTHORIZATION_PENDING: "Authorization pending";
-      readonly ACCESS_DENIED: "Access denied";
-      readonly INVALID_USER_CODE: "Invalid user code";
-      readonly DEVICE_CODE_ALREADY_PROCESSED: "Device code already processed";
-      readonly POLLING_TOO_FREQUENTLY: "Polling too frequently";
-      readonly USER_NOT_FOUND: "User not found";
-      readonly FAILED_TO_CREATE_SESSION: "Failed to create session";
-      readonly INVALID_DEVICE_CODE_STATUS: "Invalid device code status";
-      readonly AUTHENTICATION_REQUIRED: "Authentication required";
+      USER_NOT_FOUND: better_auth0.RawError<"USER_NOT_FOUND">;
+      FAILED_TO_CREATE_SESSION: better_auth0.RawError<"FAILED_TO_CREATE_SESSION">;
+      INVALID_DEVICE_CODE: better_auth0.RawError<"INVALID_DEVICE_CODE">;
+      EXPIRED_DEVICE_CODE: better_auth0.RawError<"EXPIRED_DEVICE_CODE">;
+      EXPIRED_USER_CODE: better_auth0.RawError<"EXPIRED_USER_CODE">;
+      AUTHORIZATION_PENDING: better_auth0.RawError<"AUTHORIZATION_PENDING">;
+      ACCESS_DENIED: better_auth0.RawError<"ACCESS_DENIED">;
+      INVALID_USER_CODE: better_auth0.RawError<"INVALID_USER_CODE">;
+      DEVICE_CODE_ALREADY_PROCESSED: better_auth0.RawError<"DEVICE_CODE_ALREADY_PROCESSED">;
+      POLLING_TOO_FREQUENTLY: better_auth0.RawError<"POLLING_TOO_FREQUENTLY">;
+      INVALID_DEVICE_CODE_STATUS: better_auth0.RawError<"INVALID_DEVICE_CODE_STATUS">;
+      AUTHENTICATION_REQUIRED: better_auth0.RawError<"AUTHENTICATION_REQUIRED">;
     };
     options: Partial<{
       expiresIn: better_auth_plugins0.TimeString;
@@ -1729,6 +484,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     }>;
   }];
 }>;
-declare const auth: ReturnType<typeof createAuth>;
+type AuthInstance = ReturnType<typeof _inferAuthType>;
+declare function createAuth(config: BetterAuthConfig): AuthInstance;
+declare const auth: AuthInstance;
 //#endregion
-export { BetterAuthConfig, EmailServiceConfig, OIDCProviderConfig, SAMLProviderConfig, SSOProviderConfig, UserAuthConfig, auth, createAuth, extractCookieDomain, hasCredentialAccount };
+export { type BetterAuthConfig, type EmailServiceConfig, type OIDCProviderConfig, type SAMLProviderConfig, type SSOProviderConfig, type UserAuthConfig, auth, createAuth, extractCookieDomain, hasCredentialAccount };