@megacorp-ai/auth 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +98 -0
  3. package/dist/cli.js +332 -0
  4. package/dist/cli.js.map +1 -0
  5. package/dist/index.d.ts +3420 -0
  6. package/dist/index.js +981 -0
  7. package/dist/index.js.map +1 -0
  8. package/package.json +52 -0
package/dist/index.d.ts ADDED
@@ -0,0 +1,3420 @@
1
+ import * as better_auth_plugins from 'better-auth/plugins';
2
+ import * as zod_v4_core from 'zod/v4/core';
3
+ import * as better_auth from 'better-auth';
4
+ import { Express, RequestHandler, Request as Request$1 } from 'express';
5
+ import { Pool } from 'pg';
6
+ import { z } from 'zod';
7
+ import { TokenCredential } from '@azure/identity';
8
+ export { fromNodeHeaders } from 'better-auth/node';
9
+
10
+ declare const envSchema: z.ZodObject<{
11
+ NODE_ENV: z.ZodDefault<z.ZodEnum<{
12
+ development: "development";
13
+ test: "test";
14
+ production: "production";
15
+ }>>;
16
+ DATABASE_URL: z.ZodString;
17
+ AUTH_SECRET: z.ZodString;
18
+ AUTH_BASE_URL: z.ZodURL;
19
+ AUTH_FROM_EMAIL: z.ZodOptional<z.ZodEmail>;
20
+ AUTH_BOOTSTRAP_ADMINS: z.ZodDefault<z.ZodPreprocess<z.ZodArray<z.ZodEmail>, unknown>>;
21
+ AUTH_EDGE: z.ZodDefault<z.ZodEnum<{
22
+ cloudflare: "cloudflare";
23
+ none: "none";
24
+ }>>;
25
+ AUTH_ALLOW_IMPERSONATION: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean, unknown>>;
26
+ AUTH_INVITE_MAX_PER_EMAIL: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
27
+ AUTH_LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
28
+ error: "error";
29
+ info: "info";
30
+ debug: "debug";
31
+ warn: "warn";
32
+ }>>;
33
+ ACS_ENDPOINT: z.ZodOptional<z.ZodURL>;
34
+ APPLICATIONINSIGHTS_CONNECTION_STRING: z.ZodOptional<z.ZodString>;
35
+ }, z.core.$strip>;
36
+ /**
37
+ * Better Auth reads BETTER_AUTH_TELEMETRY from the environment and treats it as an override of the
38
+ * `telemetry.enabled: false` we pass in options. Refuse to start rather than let a stray env var
39
+ * turn on vendor usage reporting.
40
+ */
41
+ declare function assertNoVendorTelemetry(env: Record<string, string | undefined>): void;
42
+ type AuthConfig = z.infer<typeof envSchema> & {
43
+ isProduction: boolean;
44
+ };
45
+ declare function loadConfig(env?: Record<string, string | undefined>): AuthConfig;
46
+
47
+ interface OtpMail {
48
+ to: string;
49
+ otp: string;
50
+ appName: string;
51
+ expiresInSeconds: number;
52
+ }
53
+ interface InviteMail {
54
+ to: string;
55
+ link: string;
56
+ appName: string;
57
+ role: string;
58
+ invitedBy: string;
59
+ }
60
+ interface Mailer {
61
+ sendOtp(mail: OtpMail): Promise<void>;
62
+ sendInvite(mail: InviteMail): Promise<void>;
63
+ }
64
+
65
+ /** Development mailer: prints the code / link to stdout. Refused in production without ACS_ENDPOINT (see config.ts). */
66
+ declare function consoleMailer(): Mailer;
67
+
68
+ interface AcsMailerOptions {
69
+ endpoint: string;
70
+ from: string;
71
+ appName: string;
72
+ /** Bring your own credential (tests, non-Azure hosts). */
73
+ credential?: TokenCredential;
74
+ /** In production the credential chain is limited to env vars + managed identity. */
75
+ production?: boolean;
76
+ }
77
+ /** Azure Communication Services Email. */
78
+ declare function acsMailer({ endpoint, from, appName, credential, production }: AcsMailerOptions): Mailer;
79
+
80
+ declare const ROLES: readonly ["megacorp_admin", "customer_admin", "member"];
81
+ type Role = (typeof ROLES)[number];
82
+ declare const DEFAULT_ROLE: Role;
83
+ declare function isRole(v: unknown): v is Role;
84
+ /** Better Auth stores user.role as a string, possibly comma-separated. */
85
+ declare function parseRoles(role: string | null | undefined): Role[];
86
+ declare function hasRole(userRole: string | null | undefined, allowed: readonly Role[]): boolean;
87
+ declare function canInvite(inviterRole: string | null | undefined, target: Role): boolean;
88
+
89
+ interface SessionUser {
90
+ id: string;
91
+ email: string;
92
+ name: string;
93
+ role: string | null;
94
+ banned: boolean | null;
95
+ }
96
+ interface SessionInfo {
97
+ user: SessionUser;
98
+ session: {
99
+ id: string;
100
+ expiresAt: Date;
101
+ impersonatedBy?: string | null;
102
+ };
103
+ }
104
+ declare global {
105
+ namespace Express {
106
+ interface Request {
107
+ auth?: SessionInfo;
108
+ }
109
+ }
110
+ }
111
+
112
+ declare const AUTH_EVENTS: readonly ["auth.boot", "auth.otp.sent", "auth.otp.verified", "auth.otp.failed", "auth.rate_limited", "auth.session.created", "auth.session.revoked", "auth.invite.sent", "auth.user.disabled", "auth.admin.impersonate"];
113
+ type AuthEventName = (typeof AUTH_EVENTS)[number];
114
+ declare const authEventSchema: z.ZodObject<{
115
+ ts: z.ZodISODateTime;
116
+ app: z.ZodString;
117
+ pkgVersion: z.ZodString;
118
+ event: z.ZodEnum<{
119
+ "auth.boot": "auth.boot";
120
+ "auth.otp.sent": "auth.otp.sent";
121
+ "auth.otp.verified": "auth.otp.verified";
122
+ "auth.otp.failed": "auth.otp.failed";
123
+ "auth.rate_limited": "auth.rate_limited";
124
+ "auth.session.created": "auth.session.created";
125
+ "auth.session.revoked": "auth.session.revoked";
126
+ "auth.invite.sent": "auth.invite.sent";
127
+ "auth.user.disabled": "auth.user.disabled";
128
+ "auth.admin.impersonate": "auth.admin.impersonate";
129
+ }>;
130
+ outcome: z.ZodEnum<{
131
+ success: "success";
132
+ failure: "failure";
133
+ denied: "denied";
134
+ info: "info";
135
+ }>;
136
+ userIdHash: z.ZodNullable<z.ZodString>;
137
+ emailDomain: z.ZodNullable<z.ZodString>;
138
+ ip: z.ZodNullable<z.ZodString>;
139
+ ua: z.ZodNullable<z.ZodString>;
140
+ durationMs: z.ZodNullable<z.ZodNumber>;
141
+ role: z.ZodOptional<z.ZodNullable<z.ZodString>>;
142
+ reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
143
+ meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
144
+ }, z.core.$strip>;
145
+ type AuthEvent = z.infer<typeof authEventSchema>;
146
+ declare const hashUserId: (id: string | null | undefined) => string | null;
147
+ declare const emailDomain: (email: string | null | undefined) => string | null;
148
+ interface EventBase {
149
+ app: string;
150
+ pkgVersion: string;
151
+ }
152
+ type EventInput = Partial<Omit<AuthEvent, "ts" | "app" | "pkgVersion" | "event">> & {
153
+ event: AuthEventName;
154
+ };
155
+ declare function buildEvent(base: EventBase, input: EventInput): AuthEvent;
156
+
157
+ type LogLevel = "debug" | "info" | "warn" | "error";
158
+ /** One JSON object per line on stdout (stderr for error). */
159
+ declare function createLogger(base: Record<string, unknown>, minLevel?: LogLevel): {
160
+ debug: (m: string, f?: Record<string, unknown>) => void;
161
+ info: (m: string, f?: Record<string, unknown>) => void;
162
+ warn: (m: string, f?: Record<string, unknown>) => void;
163
+ error: (m: string, f?: Record<string, unknown>) => void;
164
+ };
165
+ type Logger = ReturnType<typeof createLogger>;
166
+
167
+ interface EventSink {
168
+ emit(event: AuthEvent): void;
169
+ /** Deliver queued events now. Resolves once the attempt finishes; never rejects. */
170
+ flush(): Promise<void>;
171
+ /** Stop timers and drain with bounded retries. Call from your SIGTERM handler. */
172
+ shutdown(timeoutMs?: number): Promise<void>;
173
+ }
174
+
175
+ declare class AuthConfigError extends Error {
176
+ readonly code = "AUTH_CONFIG_ERROR";
177
+ constructor(message: string);
178
+ }
179
+ declare class SchemaError extends Error {
180
+ readonly missing: string[];
181
+ readonly code = "AUTH_SCHEMA_ERROR";
182
+ constructor(message: string, missing: string[]);
183
+ }
184
+ declare class HttpError extends Error {
185
+ readonly status: number;
186
+ readonly code: string;
187
+ constructor(status: number, code: string, message: string);
188
+ }
189
+
190
+ type EdgeMode = "cloudflare" | "none";
191
+ /** Header names Better Auth should read the client IP from (advanced.ipAddress.ipAddressHeaders). */
192
+ declare function ipAddressHeaders(edge: EdgeMode): string[];
193
+ /** Value for Express `trust proxy`. */
194
+ declare function trustProxySetting(edge: EdgeMode): number | string[];
195
+ declare function ipInCidr(ip: string, cidr: string): boolean;
196
+ declare function isCloudflareIp(ip: string): boolean;
197
+ interface IpRequestLike {
198
+ headers: Record<string, string | string[] | undefined>;
199
+ socket?: {
200
+ remoteAddress?: string | undefined;
201
+ };
202
+ }
203
+ /**
204
+ * Resolve the client IP.
205
+ * - none: one trusted hop; leftmost X-Forwarded-For entry, else socket address.
206
+ * - cloudflare: CF-Connecting-IP, but only when the peer is a Cloudflare address
207
+ * (prevents spoofing if the origin is reached directly).
208
+ */
209
+ declare function getClientIp(req: IpRequestLike, edge: EdgeMode): string | undefined;
210
+
211
+ /**
212
+ * Minimal Application Insights exporter: custom events only, one POST per batch to the
213
+ * ingestion ("Breeze") endpoint. Replaces the `applicationinsights` SDK, whose defaults add
214
+ * Live Metrics, auto-instrumentation, and SDK-usage telemetry to Microsoft, plus ~700 packages.
215
+ * Wire format matches @azure/monitor-opentelemetry-exporter: POST {IngestionEndpoint}/v2.1/track
216
+ * with a JSON array of envelopes; 200/206 bodies carry per-item errors.
217
+ */
218
+ interface AppInsightsTarget {
219
+ instrumentationKey: string;
220
+ ingestionEndpoint: string;
221
+ /** Optional AADAudience from the connection string; used as the token scope when set. */
222
+ aadAudience?: string;
223
+ }
224
+ /** Parse `InstrumentationKey=...;IngestionEndpoint=...`. Throws on anything malformed. */
225
+ declare function parseConnectionString(cs: string): AppInsightsTarget;
226
+ interface AppInsightsExporterOptions {
227
+ target: AppInsightsTarget;
228
+ /** ai.cloud.role */
229
+ app: string;
230
+ pkgVersion: string;
231
+ log: Pick<Logger, "warn" | "error" | "debug">;
232
+ /** When set, requests carry `Authorization: Bearer` (Entra ID). Otherwise the instrumentation key alone is used. */
233
+ credential?: TokenCredential;
234
+ /** Injected for tests. */
235
+ fetch?: typeof globalThis.fetch;
236
+ /** Envelopes per request. Default 100. */
237
+ batchSize?: number;
238
+ /** Timer-driven flush cadence. Default 5000 ms. */
239
+ flushIntervalMs?: number;
240
+ /** Per-envelope retry budget for 429/5xx/408/timeouts. Default 5. */
241
+ maxRetries?: number;
242
+ /** Drop oldest events beyond this queue depth. Default 10_000. */
243
+ maxQueue?: number;
244
+ /** Per-request timeout. Default 10_000 ms. */
245
+ requestTimeoutMs?: number;
246
+ }
247
+ declare class AppInsightsExporter {
248
+ private readonly o;
249
+ private readonly queue;
250
+ private timer;
251
+ private retryAt;
252
+ private flushing;
253
+ private token;
254
+ private stopped;
255
+ private readonly tags;
256
+ private readonly url;
257
+ private readonly scope;
258
+ private readonly opts;
259
+ constructor(o: AppInsightsExporterOptions);
260
+ get pending(): number;
261
+ track(e: AuthEvent): void;
262
+ /** Send everything queued once. Retriable failures are re-queued for the timer; never throws. */
263
+ flush(): Promise<void>;
264
+ /** Stop the timer and try to deliver what is queued, honoring backoff, within `timeoutMs`. */
265
+ shutdown(timeoutMs?: number): Promise<void>;
266
+ private schedule;
267
+ private drain;
268
+ /** One request. Returns envelopes that should be retried, and an optional server-dictated delay. */
269
+ private send;
270
+ private getToken;
271
+ }
272
+
273
+ interface AzureCredentialOptions {
274
+ /** User-assigned managed identity client id (from `Authorization=AAD;ClientId=...`). */
275
+ clientId?: string;
276
+ env?: NodeJS.ProcessEnv;
277
+ }
278
+ /**
279
+ * Token credential used for every Azure call this package makes (ACS email, App Insights ingestion).
280
+ * - Production: EnvironmentCredential -> ManagedIdentityCredential only. DefaultAzureCredential would
281
+ * also probe VS Code, spawn `az`, `pwsh`, and `azd`, and try the broker; none belong on a server.
282
+ * - Otherwise: DefaultAzureCredential so `az login` works locally. Set AZURE_TOKEN_CREDENTIALS
283
+ * (e.g. `prod`, `ManagedIdentityCredential`) to narrow it yourself in any environment.
284
+ */
285
+ declare function azureCredential(production: boolean, { clientId, env }?: AzureCredentialOptions): TokenCredential;
286
+
287
+ declare const TABLES: {
288
+ readonly user: "auth_user";
289
+ readonly session: "auth_session";
290
+ readonly account: "auth_account";
291
+ readonly verification: "auth_verification";
292
+ readonly rateLimit: "auth_rate_limit";
293
+ };
294
+ /** Columns that must exist (Better Auth core + emailOTP + admin plugin). Read-only check, never migrates. */
295
+ declare const REQUIRED_COLUMNS: Record<string, string[]>;
296
+ declare function findMissingSchema(pool: Pool): Promise<string[]>;
297
+ declare function assertSchema(pool: Pool): Promise<void>;
298
+
299
+ interface BuildOptionsInput {
300
+ appName: string;
301
+ config: AuthConfig;
302
+ pool: Pool;
303
+ mailer: Mailer;
304
+ }
305
+ /** Shared between the runtime (createMegacorpAuth) and the CLI (migrate/check) so both see one schema. */
306
+ declare function buildBetterAuthOptions({ appName, config, pool, mailer }: BuildOptionsInput): {
307
+ appName: string;
308
+ baseURL: string;
309
+ basePath: string;
310
+ secret: string;
311
+ trustedOrigins: string[];
312
+ database: Pool;
313
+ telemetry: {
314
+ enabled: false;
315
+ };
316
+ emailAndPassword: {
317
+ enabled: false;
318
+ };
319
+ user: {
320
+ modelName: "auth_user";
321
+ changeEmail: {
322
+ enabled: false;
323
+ };
324
+ deleteUser: {
325
+ enabled: false;
326
+ };
327
+ };
328
+ session: {
329
+ modelName: "auth_session";
330
+ expiresIn: number;
331
+ updateAge: number;
332
+ };
333
+ account: {
334
+ modelName: "auth_account";
335
+ };
336
+ verification: {
337
+ modelName: "auth_verification";
338
+ };
339
+ rateLimit: {
340
+ enabled: true;
341
+ storage: "database";
342
+ modelName: "auth_rate_limit";
343
+ window: number;
344
+ max: number;
345
+ customRules: {
346
+ "/email-otp/send-verification-otp": {
347
+ window: number;
348
+ max: number;
349
+ };
350
+ "/sign-in/email-otp": {
351
+ window: number;
352
+ max: number;
353
+ };
354
+ "/get-session": {
355
+ window: number;
356
+ max: number;
357
+ };
358
+ };
359
+ };
360
+ advanced: {
361
+ useSecureCookies: boolean;
362
+ cookiePrefix: string;
363
+ ipAddress: {
364
+ ipAddressHeaders: string[];
365
+ };
366
+ database: {
367
+ generateId: "uuid";
368
+ };
369
+ };
370
+ plugins: [{
371
+ id: "email-otp";
372
+ version: string;
373
+ init(ctx: better_auth.AuthContext): {
374
+ options: {
375
+ emailVerification: {
376
+ sendVerificationEmail(data: {
377
+ user: better_auth.User;
378
+ url: string;
379
+ token: string;
380
+ }, request: Request | undefined): Promise<void>;
381
+ };
382
+ };
383
+ } | undefined;
384
+ endpoints: {
385
+ sendVerificationOTP: better_auth.StrictEndpoint<"/email-otp/send-verification-otp", {
386
+ method: "POST";
387
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<void>>[];
388
+ body: better_auth.ZodObject<{
389
+ email: better_auth.ZodString;
390
+ type: better_auth.ZodEnum<{
391
+ "sign-in": "sign-in";
392
+ "change-email": "change-email";
393
+ "email-verification": "email-verification";
394
+ "forget-password": "forget-password";
395
+ }>;
396
+ }, zod_v4_core.$strip>;
397
+ metadata: {
398
+ openapi: {
399
+ operationId: string;
400
+ description: string;
401
+ responses: {
402
+ 200: {
403
+ description: string;
404
+ content: {
405
+ "application/json": {
406
+ schema: {
407
+ type: "object";
408
+ properties: {
409
+ success: {
410
+ type: string;
411
+ };
412
+ };
413
+ };
414
+ };
415
+ };
416
+ };
417
+ };
418
+ };
419
+ };
420
+ }, {
421
+ success: boolean;
422
+ }>;
423
+ createVerificationOTP: better_auth.StrictEndpoint<string, {
424
+ method: "POST";
425
+ body: better_auth.ZodObject<{
426
+ email: better_auth.ZodString;
427
+ type: better_auth.ZodEnum<{
428
+ "sign-in": "sign-in";
429
+ "change-email": "change-email";
430
+ "email-verification": "email-verification";
431
+ "forget-password": "forget-password";
432
+ }>;
433
+ }, zod_v4_core.$strip>;
434
+ metadata: {
435
+ openapi: {
436
+ operationId: string;
437
+ description: string;
438
+ responses: {
439
+ 200: {
440
+ description: string;
441
+ content: {
442
+ "application/json": {
443
+ schema: {
444
+ type: "string";
445
+ };
446
+ };
447
+ };
448
+ };
449
+ };
450
+ };
451
+ };
452
+ }, string>;
453
+ getVerificationOTP: better_auth.StrictEndpoint<string, {
454
+ method: "GET";
455
+ query: better_auth.ZodObject<{
456
+ email: better_auth.ZodString;
457
+ type: better_auth.ZodEnum<{
458
+ "sign-in": "sign-in";
459
+ "change-email": "change-email";
460
+ "email-verification": "email-verification";
461
+ "forget-password": "forget-password";
462
+ }>;
463
+ }, zod_v4_core.$strip>;
464
+ metadata: {
465
+ openapi: {
466
+ operationId: string;
467
+ description: string;
468
+ responses: {
469
+ "200": {
470
+ description: string;
471
+ content: {
472
+ "application/json": {
473
+ schema: {
474
+ type: "object";
475
+ properties: {
476
+ otp: {
477
+ type: string;
478
+ nullable: boolean;
479
+ description: string;
480
+ };
481
+ };
482
+ required: string[];
483
+ };
484
+ };
485
+ };
486
+ };
487
+ };
488
+ };
489
+ };
490
+ }, {
491
+ otp: null;
492
+ } | {
493
+ otp: string;
494
+ }>;
495
+ checkVerificationOTP: better_auth.StrictEndpoint<"/email-otp/check-verification-otp", {
496
+ method: "POST";
497
+ body: better_auth.ZodObject<{
498
+ email: better_auth.ZodString;
499
+ type: better_auth.ZodEnum<{
500
+ "sign-in": "sign-in";
501
+ "change-email": "change-email";
502
+ "email-verification": "email-verification";
503
+ "forget-password": "forget-password";
504
+ }>;
505
+ otp: better_auth.ZodString;
506
+ }, zod_v4_core.$strip>;
507
+ metadata: {
508
+ openapi: {
509
+ operationId: string;
510
+ description: string;
511
+ responses: {
512
+ 200: {
513
+ description: string;
514
+ content: {
515
+ "application/json": {
516
+ schema: {
517
+ type: "object";
518
+ properties: {
519
+ success: {
520
+ type: string;
521
+ };
522
+ };
523
+ };
524
+ };
525
+ };
526
+ };
527
+ };
528
+ };
529
+ };
530
+ }, {
531
+ success: boolean;
532
+ }>;
533
+ verifyEmailOTP: better_auth.StrictEndpoint<"/email-otp/verify-email", {
534
+ method: "POST";
535
+ body: better_auth.ZodObject<{
536
+ email: better_auth.ZodString;
537
+ otp: better_auth.ZodString;
538
+ }, zod_v4_core.$strip>;
539
+ metadata: {
540
+ openapi: {
541
+ description: string;
542
+ responses: {
543
+ 200: {
544
+ description: string;
545
+ content: {
546
+ "application/json": {
547
+ schema: {
548
+ type: "object";
549
+ properties: {
550
+ status: {
551
+ type: string;
552
+ description: string;
553
+ enum: boolean[];
554
+ };
555
+ token: {
556
+ type: string;
557
+ nullable: boolean;
558
+ description: string;
559
+ };
560
+ user: {
561
+ $ref: string;
562
+ };
563
+ };
564
+ required: string[];
565
+ };
566
+ };
567
+ };
568
+ };
569
+ };
570
+ };
571
+ };
572
+ }, {
573
+ status: boolean;
574
+ token: string;
575
+ user: {
576
+ id: string;
577
+ createdAt: Date;
578
+ updatedAt: Date;
579
+ email: string;
580
+ emailVerified: boolean;
581
+ name: string;
582
+ image?: string | null | undefined;
583
+ } & Record<string, any>;
584
+ } | {
585
+ status: boolean;
586
+ token: null;
587
+ user: {
588
+ id: string;
589
+ createdAt: Date;
590
+ updatedAt: Date;
591
+ email: string;
592
+ emailVerified: boolean;
593
+ name: string;
594
+ image?: string | null | undefined;
595
+ } & Record<string, any>;
596
+ }>;
597
+ signInEmailOTP: better_auth.StrictEndpoint<"/sign-in/email-otp", {
598
+ method: "POST";
599
+ body: better_auth.ZodIntersection<better_auth.ZodObject<{
600
+ email: better_auth.ZodString;
601
+ otp: better_auth.ZodString;
602
+ name: better_auth.ZodOptional<better_auth.ZodString>;
603
+ image: better_auth.ZodOptional<better_auth.ZodString>;
604
+ }, zod_v4_core.$strip>, better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodAny>>;
605
+ metadata: {
606
+ openapi: {
607
+ operationId: string;
608
+ description: string;
609
+ responses: {
610
+ 200: {
611
+ description: string;
612
+ content: {
613
+ "application/json": {
614
+ schema: {
615
+ type: "object";
616
+ properties: {
617
+ token: {
618
+ type: string;
619
+ description: string;
620
+ };
621
+ user: {
622
+ $ref: string;
623
+ };
624
+ };
625
+ required: string[];
626
+ };
627
+ };
628
+ };
629
+ };
630
+ };
631
+ };
632
+ };
633
+ }, {
634
+ token: string;
635
+ user: {
636
+ id: string;
637
+ createdAt: Date;
638
+ updatedAt: Date;
639
+ email: string;
640
+ emailVerified: boolean;
641
+ name: string;
642
+ image?: string | null | undefined;
643
+ };
644
+ }>;
645
+ requestPasswordResetEmailOTP: better_auth.StrictEndpoint<"/email-otp/request-password-reset", {
646
+ method: "POST";
647
+ body: better_auth.ZodObject<{
648
+ email: better_auth.ZodString;
649
+ }, zod_v4_core.$strip>;
650
+ metadata: {
651
+ openapi: {
652
+ operationId: string;
653
+ description: string;
654
+ responses: {
655
+ 200: {
656
+ description: string;
657
+ content: {
658
+ "application/json": {
659
+ schema: {
660
+ type: "object";
661
+ properties: {
662
+ success: {
663
+ type: string;
664
+ description: string;
665
+ };
666
+ };
667
+ };
668
+ };
669
+ };
670
+ };
671
+ };
672
+ };
673
+ };
674
+ }, {
675
+ success: boolean;
676
+ }>;
677
+ forgetPasswordEmailOTP: better_auth.StrictEndpoint<"/forget-password/email-otp", {
678
+ method: "POST";
679
+ body: better_auth.ZodObject<{
680
+ email: better_auth.ZodString;
681
+ }, zod_v4_core.$strip>;
682
+ metadata: {
683
+ openapi: {
684
+ operationId: string;
685
+ description: string;
686
+ responses: {
687
+ 200: {
688
+ description: string;
689
+ content: {
690
+ "application/json": {
691
+ schema: {
692
+ type: "object";
693
+ properties: {
694
+ success: {
695
+ type: string;
696
+ description: string;
697
+ };
698
+ };
699
+ };
700
+ };
701
+ };
702
+ };
703
+ };
704
+ };
705
+ };
706
+ }, {
707
+ success: boolean;
708
+ }>;
709
+ resetPasswordEmailOTP: better_auth.StrictEndpoint<"/email-otp/reset-password", {
710
+ method: "POST";
711
+ body: better_auth.ZodObject<{
712
+ email: better_auth.ZodString;
713
+ otp: better_auth.ZodString;
714
+ password: better_auth.ZodString;
715
+ }, zod_v4_core.$strip>;
716
+ metadata: {
717
+ openapi: {
718
+ operationId: string;
719
+ description: string;
720
+ responses: {
721
+ 200: {
722
+ description: string;
723
+ content: {
724
+ "application/json": {
725
+ schema: {
726
+ type: "object";
727
+ properties: {
728
+ success: {
729
+ type: string;
730
+ };
731
+ };
732
+ };
733
+ };
734
+ };
735
+ };
736
+ };
737
+ };
738
+ };
739
+ }, {
740
+ success: boolean;
741
+ }>;
742
+ requestEmailChangeEmailOTP: better_auth.StrictEndpoint<"/email-otp/request-email-change", {
743
+ method: "POST";
744
+ body: better_auth.ZodObject<{
745
+ newEmail: better_auth.ZodString;
746
+ otp: better_auth.ZodOptional<better_auth.ZodString>;
747
+ }, zod_v4_core.$strip>;
748
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
749
+ session: {
750
+ session: Record<string, any> & {
751
+ id: string;
752
+ createdAt: Date;
753
+ updatedAt: Date;
754
+ userId: string;
755
+ expiresAt: Date;
756
+ token: string;
757
+ ipAddress?: string | null | undefined;
758
+ userAgent?: string | null | undefined;
759
+ };
760
+ user: Record<string, any> & {
761
+ id: string;
762
+ createdAt: Date;
763
+ updatedAt: Date;
764
+ email: string;
765
+ emailVerified: boolean;
766
+ name: string;
767
+ image?: string | null | undefined;
768
+ };
769
+ };
770
+ }>>[];
771
+ metadata: {
772
+ openapi: {
773
+ operationId: string;
774
+ description: string;
775
+ responses: {
776
+ 200: {
777
+ description: string;
778
+ content: {
779
+ "application/json": {
780
+ schema: {
781
+ type: "object";
782
+ properties: {
783
+ success: {
784
+ type: string;
785
+ };
786
+ };
787
+ };
788
+ };
789
+ };
790
+ };
791
+ };
792
+ };
793
+ };
794
+ }, {
795
+ success: boolean;
796
+ }>;
797
+ changeEmailEmailOTP: better_auth.StrictEndpoint<"/email-otp/change-email", {
798
+ method: "POST";
799
+ body: better_auth.ZodObject<{
800
+ newEmail: better_auth.ZodString;
801
+ otp: better_auth.ZodString;
802
+ }, zod_v4_core.$strip>;
803
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
804
+ session: {
805
+ session: Record<string, any> & {
806
+ id: string;
807
+ createdAt: Date;
808
+ updatedAt: Date;
809
+ userId: string;
810
+ expiresAt: Date;
811
+ token: string;
812
+ ipAddress?: string | null | undefined;
813
+ userAgent?: string | null | undefined;
814
+ };
815
+ user: Record<string, any> & {
816
+ id: string;
817
+ createdAt: Date;
818
+ updatedAt: Date;
819
+ email: string;
820
+ emailVerified: boolean;
821
+ name: string;
822
+ image?: string | null | undefined;
823
+ };
824
+ };
825
+ }>>[];
826
+ metadata: {
827
+ openapi: {
828
+ operationId: string;
829
+ description: string;
830
+ responses: {
831
+ 200: {
832
+ description: string;
833
+ content: {
834
+ "application/json": {
835
+ schema: {
836
+ type: "object";
837
+ properties: {
838
+ success: {
839
+ type: string;
840
+ };
841
+ };
842
+ };
843
+ };
844
+ };
845
+ };
846
+ };
847
+ };
848
+ };
849
+ }, {
850
+ success: boolean;
851
+ }>;
852
+ };
853
+ hooks: {
854
+ after: {
855
+ matcher(context: better_auth.HookEndpointContext): boolean;
856
+ handler: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<void>>;
857
+ }[];
858
+ };
859
+ rateLimit: ({
860
+ pathMatcher(path: string): path is "/email-otp/send-verification-otp";
861
+ window: number;
862
+ max: number;
863
+ } | {
864
+ pathMatcher(path: string): path is "/email-otp/check-verification-otp";
865
+ window: number;
866
+ max: number;
867
+ } | {
868
+ pathMatcher(path: string): path is "/email-otp/verify-email";
869
+ window: number;
870
+ max: number;
871
+ } | {
872
+ pathMatcher(path: string): path is "/sign-in/email-otp";
873
+ window: number;
874
+ max: number;
875
+ } | {
876
+ pathMatcher(path: string): path is "/email-otp/request-password-reset";
877
+ window: number;
878
+ max: number;
879
+ } | {
880
+ pathMatcher(path: string): path is "/email-otp/reset-password";
881
+ window: number;
882
+ max: number;
883
+ } | {
884
+ pathMatcher(path: string): path is "/forget-password/email-otp";
885
+ window: number;
886
+ max: number;
887
+ } | {
888
+ pathMatcher(path: string): path is "/email-otp/request-email-change";
889
+ window: number;
890
+ max: number;
891
+ } | {
892
+ pathMatcher(path: string): path is "/email-otp/change-email";
893
+ window: number;
894
+ max: number;
895
+ })[];
896
+ options: better_auth_plugins.EmailOTPOptions;
897
+ $ERROR_CODES: {
898
+ OTP_EXPIRED: better_auth.RawError<"OTP_EXPIRED">;
899
+ INVALID_OTP: better_auth.RawError<"INVALID_OTP">;
900
+ TOO_MANY_ATTEMPTS: better_auth.RawError<"TOO_MANY_ATTEMPTS">;
901
+ };
902
+ }, {
903
+ id: "admin";
904
+ version: string;
905
+ init(): {
906
+ options: {
907
+ databaseHooks: {
908
+ user: {
909
+ create: {
910
+ before(user: {
911
+ id: string;
912
+ createdAt: Date;
913
+ updatedAt: Date;
914
+ email: string;
915
+ emailVerified: boolean;
916
+ name: string;
917
+ image?: string | null | undefined;
918
+ } & Record<string, unknown>): Promise<{
919
+ data: {
920
+ id: string;
921
+ createdAt: Date;
922
+ updatedAt: Date;
923
+ email: string;
924
+ emailVerified: boolean;
925
+ name: string;
926
+ image?: string | null | undefined;
927
+ role: string;
928
+ };
929
+ }>;
930
+ };
931
+ };
932
+ session: {
933
+ create: {
934
+ before(session: {
935
+ id: string;
936
+ createdAt: Date;
937
+ updatedAt: Date;
938
+ userId: string;
939
+ expiresAt: Date;
940
+ token: string;
941
+ ipAddress?: string | null | undefined;
942
+ userAgent?: string | null | undefined;
943
+ } & Record<string, unknown>, ctx: better_auth.GenericEndpointContext | null): Promise<void>;
944
+ };
945
+ };
946
+ };
947
+ };
948
+ };
949
+ hooks: {
950
+ after: {
951
+ matcher(context: better_auth.HookEndpointContext): boolean;
952
+ handler: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<better_auth_plugins.SessionWithImpersonatedBy[] | undefined>>;
953
+ }[];
954
+ };
955
+ endpoints: {
956
+ setRole: better_auth.StrictEndpoint<"/admin/set-role", {
957
+ method: "POST";
958
+ body: better_auth.ZodObject<{
959
+ userId: better_auth.ZodCoercedString<unknown>;
960
+ role: better_auth.ZodUnion<readonly [better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>]>;
961
+ }, zod_v4_core.$strip>;
962
+ requireHeaders: true;
963
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
964
+ session: {
965
+ user: better_auth_plugins.UserWithRole;
966
+ session: {
967
+ id: string;
968
+ createdAt: Date;
969
+ updatedAt: Date;
970
+ userId: string;
971
+ expiresAt: Date;
972
+ token: string;
973
+ ipAddress?: string | null | undefined;
974
+ userAgent?: string | null | undefined;
975
+ };
976
+ };
977
+ }>>[];
978
+ metadata: {
979
+ openapi: {
980
+ operationId: string;
981
+ summary: string;
982
+ description: string;
983
+ responses: {
984
+ 200: {
985
+ description: string;
986
+ content: {
987
+ "application/json": {
988
+ schema: {
989
+ type: "object";
990
+ properties: {
991
+ user: {
992
+ $ref: string;
993
+ };
994
+ };
995
+ };
996
+ };
997
+ };
998
+ };
999
+ };
1000
+ };
1001
+ $Infer: {
1002
+ body: {
1003
+ userId: string;
1004
+ role: "megacorp_admin" | "customer_admin" | "member" | ("megacorp_admin" | "customer_admin" | "member")[];
1005
+ };
1006
+ };
1007
+ };
1008
+ }, {
1009
+ user: better_auth_plugins.UserWithRole;
1010
+ }>;
1011
+ getUser: better_auth.StrictEndpoint<"/admin/get-user", {
1012
+ method: "GET";
1013
+ query: better_auth.ZodObject<{
1014
+ id: better_auth.ZodString;
1015
+ }, zod_v4_core.$strip>;
1016
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1017
+ session: {
1018
+ user: better_auth_plugins.UserWithRole;
1019
+ session: {
1020
+ id: string;
1021
+ createdAt: Date;
1022
+ updatedAt: Date;
1023
+ userId: string;
1024
+ expiresAt: Date;
1025
+ token: string;
1026
+ ipAddress?: string | null | undefined;
1027
+ userAgent?: string | null | undefined;
1028
+ };
1029
+ };
1030
+ }>>[];
1031
+ metadata: {
1032
+ openapi: {
1033
+ operationId: string;
1034
+ summary: string;
1035
+ description: string;
1036
+ responses: {
1037
+ 200: {
1038
+ description: string;
1039
+ content: {
1040
+ "application/json": {
1041
+ schema: {
1042
+ type: "object";
1043
+ properties: {
1044
+ user: {
1045
+ $ref: string;
1046
+ };
1047
+ };
1048
+ };
1049
+ };
1050
+ };
1051
+ };
1052
+ };
1053
+ };
1054
+ };
1055
+ }, better_auth_plugins.UserWithRole>;
1056
+ createUser: better_auth.StrictEndpoint<"/admin/create-user", {
1057
+ method: "POST";
1058
+ body: better_auth.ZodObject<{
1059
+ email: better_auth.ZodString;
1060
+ password: better_auth.ZodOptional<better_auth.ZodString>;
1061
+ name: better_auth.ZodString;
1062
+ role: better_auth.ZodOptional<better_auth.ZodUnion<readonly [better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>]>>;
1063
+ data: better_auth.ZodOptional<better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodAny>>;
1064
+ }, zod_v4_core.$strip>;
1065
+ metadata: {
1066
+ openapi: {
1067
+ operationId: string;
1068
+ summary: string;
1069
+ description: string;
1070
+ responses: {
1071
+ 200: {
1072
+ description: string;
1073
+ content: {
1074
+ "application/json": {
1075
+ schema: {
1076
+ type: "object";
1077
+ properties: {
1078
+ user: {
1079
+ $ref: string;
1080
+ };
1081
+ };
1082
+ };
1083
+ };
1084
+ };
1085
+ };
1086
+ };
1087
+ };
1088
+ $Infer: {
1089
+ body: {
1090
+ email: string;
1091
+ password?: string | undefined;
1092
+ name: string;
1093
+ role?: "megacorp_admin" | "customer_admin" | "member" | ("megacorp_admin" | "customer_admin" | "member")[] | undefined;
1094
+ data?: Record<string, any> | undefined;
1095
+ };
1096
+ };
1097
+ };
1098
+ }, {
1099
+ user: better_auth_plugins.UserWithRole;
1100
+ }>;
1101
+ adminUpdateUser: better_auth.StrictEndpoint<"/admin/update-user", {
1102
+ method: "POST";
1103
+ body: better_auth.ZodObject<{
1104
+ userId: better_auth.ZodCoercedString<unknown>;
1105
+ data: better_auth.ZodRecord<better_auth.ZodAny, better_auth.ZodAny>;
1106
+ }, zod_v4_core.$strip>;
1107
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1108
+ session: {
1109
+ user: better_auth_plugins.UserWithRole;
1110
+ session: {
1111
+ id: string;
1112
+ createdAt: Date;
1113
+ updatedAt: Date;
1114
+ userId: string;
1115
+ expiresAt: Date;
1116
+ token: string;
1117
+ ipAddress?: string | null | undefined;
1118
+ userAgent?: string | null | undefined;
1119
+ };
1120
+ };
1121
+ }>>[];
1122
+ metadata: {
1123
+ openapi: {
1124
+ operationId: string;
1125
+ summary: string;
1126
+ description: string;
1127
+ responses: {
1128
+ 200: {
1129
+ description: string;
1130
+ content: {
1131
+ "application/json": {
1132
+ schema: {
1133
+ type: "object";
1134
+ properties: {
1135
+ user: {
1136
+ $ref: string;
1137
+ };
1138
+ };
1139
+ };
1140
+ };
1141
+ };
1142
+ };
1143
+ };
1144
+ };
1145
+ };
1146
+ }, better_auth_plugins.UserWithRole>;
1147
+ listUsers: better_auth.StrictEndpoint<"/admin/list-users", {
1148
+ method: "GET";
1149
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1150
+ session: {
1151
+ user: better_auth_plugins.UserWithRole;
1152
+ session: {
1153
+ id: string;
1154
+ createdAt: Date;
1155
+ updatedAt: Date;
1156
+ userId: string;
1157
+ expiresAt: Date;
1158
+ token: string;
1159
+ ipAddress?: string | null | undefined;
1160
+ userAgent?: string | null | undefined;
1161
+ };
1162
+ };
1163
+ }>>[];
1164
+ query: better_auth.ZodObject<{
1165
+ searchValue: better_auth.ZodOptional<better_auth.ZodString>;
1166
+ searchField: better_auth.ZodOptional<better_auth.ZodEnum<{
1167
+ email: "email";
1168
+ name: "name";
1169
+ }>>;
1170
+ searchOperator: better_auth.ZodOptional<better_auth.ZodEnum<{
1171
+ contains: "contains";
1172
+ starts_with: "starts_with";
1173
+ ends_with: "ends_with";
1174
+ }>>;
1175
+ limit: better_auth.ZodOptional<better_auth.ZodUnion<[better_auth.ZodString, better_auth.ZodNumber]>>;
1176
+ offset: better_auth.ZodOptional<better_auth.ZodUnion<[better_auth.ZodString, better_auth.ZodNumber]>>;
1177
+ sortBy: better_auth.ZodOptional<better_auth.ZodString>;
1178
+ sortDirection: better_auth.ZodOptional<better_auth.ZodEnum<{
1179
+ asc: "asc";
1180
+ desc: "desc";
1181
+ }>>;
1182
+ filterField: better_auth.ZodOptional<better_auth.ZodString>;
1183
+ filterValue: better_auth.ZodOptional<better_auth.ZodUnion<[better_auth.ZodUnion<[better_auth.ZodUnion<[better_auth.ZodUnion<[better_auth.ZodString, better_auth.ZodNumber]>, better_auth.ZodBoolean]>, better_auth.ZodArray<better_auth.ZodString>]>, better_auth.ZodArray<better_auth.ZodNumber>]>>;
1184
+ filterOperator: better_auth.ZodOptional<better_auth.ZodEnum<{
1185
+ eq: "eq";
1186
+ ne: "ne";
1187
+ gt: "gt";
1188
+ gte: "gte";
1189
+ lt: "lt";
1190
+ lte: "lte";
1191
+ in: "in";
1192
+ not_in: "not_in";
1193
+ contains: "contains";
1194
+ starts_with: "starts_with";
1195
+ ends_with: "ends_with";
1196
+ }>>;
1197
+ }, zod_v4_core.$strip>;
1198
+ metadata: {
1199
+ openapi: {
1200
+ operationId: string;
1201
+ summary: string;
1202
+ description: string;
1203
+ responses: {
1204
+ 200: {
1205
+ description: string;
1206
+ content: {
1207
+ "application/json": {
1208
+ schema: {
1209
+ type: "object";
1210
+ properties: {
1211
+ users: {
1212
+ type: string;
1213
+ items: {
1214
+ $ref: string;
1215
+ };
1216
+ };
1217
+ total: {
1218
+ type: string;
1219
+ };
1220
+ limit: {
1221
+ type: string;
1222
+ };
1223
+ offset: {
1224
+ type: string;
1225
+ };
1226
+ };
1227
+ required: string[];
1228
+ };
1229
+ };
1230
+ };
1231
+ };
1232
+ };
1233
+ };
1234
+ };
1235
+ }, {
1236
+ users: better_auth_plugins.UserWithRole[];
1237
+ total: number;
1238
+ }>;
1239
+ listUserSessions: better_auth.StrictEndpoint<"/admin/list-user-sessions", {
1240
+ method: "POST";
1241
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1242
+ session: {
1243
+ user: better_auth_plugins.UserWithRole;
1244
+ session: {
1245
+ id: string;
1246
+ createdAt: Date;
1247
+ updatedAt: Date;
1248
+ userId: string;
1249
+ expiresAt: Date;
1250
+ token: string;
1251
+ ipAddress?: string | null | undefined;
1252
+ userAgent?: string | null | undefined;
1253
+ };
1254
+ };
1255
+ }>>[];
1256
+ body: better_auth.ZodObject<{
1257
+ userId: better_auth.ZodCoercedString<unknown>;
1258
+ }, zod_v4_core.$strip>;
1259
+ metadata: {
1260
+ openapi: {
1261
+ operationId: string;
1262
+ summary: string;
1263
+ description: string;
1264
+ responses: {
1265
+ 200: {
1266
+ description: string;
1267
+ content: {
1268
+ "application/json": {
1269
+ schema: {
1270
+ type: "object";
1271
+ properties: {
1272
+ sessions: {
1273
+ type: string;
1274
+ items: {
1275
+ $ref: string;
1276
+ };
1277
+ };
1278
+ };
1279
+ };
1280
+ };
1281
+ };
1282
+ };
1283
+ };
1284
+ };
1285
+ };
1286
+ }, {
1287
+ sessions: better_auth_plugins.SessionWithImpersonatedBy[];
1288
+ }>;
1289
+ unbanUser: better_auth.StrictEndpoint<"/admin/unban-user", {
1290
+ method: "POST";
1291
+ body: better_auth.ZodObject<{
1292
+ userId: better_auth.ZodCoercedString<unknown>;
1293
+ }, zod_v4_core.$strip>;
1294
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1295
+ session: {
1296
+ user: better_auth_plugins.UserWithRole;
1297
+ session: {
1298
+ id: string;
1299
+ createdAt: Date;
1300
+ updatedAt: Date;
1301
+ userId: string;
1302
+ expiresAt: Date;
1303
+ token: string;
1304
+ ipAddress?: string | null | undefined;
1305
+ userAgent?: string | null | undefined;
1306
+ };
1307
+ };
1308
+ }>>[];
1309
+ metadata: {
1310
+ openapi: {
1311
+ operationId: string;
1312
+ summary: string;
1313
+ description: string;
1314
+ responses: {
1315
+ 200: {
1316
+ description: string;
1317
+ content: {
1318
+ "application/json": {
1319
+ schema: {
1320
+ type: "object";
1321
+ properties: {
1322
+ user: {
1323
+ $ref: string;
1324
+ };
1325
+ };
1326
+ };
1327
+ };
1328
+ };
1329
+ };
1330
+ };
1331
+ };
1332
+ };
1333
+ }, {
1334
+ user: better_auth_plugins.UserWithRole;
1335
+ }>;
1336
+ banUser: better_auth.StrictEndpoint<"/admin/ban-user", {
1337
+ method: "POST";
1338
+ body: better_auth.ZodObject<{
1339
+ userId: better_auth.ZodCoercedString<unknown>;
1340
+ banReason: better_auth.ZodOptional<better_auth.ZodString>;
1341
+ banExpiresIn: better_auth.ZodOptional<better_auth.ZodNumber>;
1342
+ }, zod_v4_core.$strip>;
1343
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1344
+ session: {
1345
+ user: better_auth_plugins.UserWithRole;
1346
+ session: {
1347
+ id: string;
1348
+ createdAt: Date;
1349
+ updatedAt: Date;
1350
+ userId: string;
1351
+ expiresAt: Date;
1352
+ token: string;
1353
+ ipAddress?: string | null | undefined;
1354
+ userAgent?: string | null | undefined;
1355
+ };
1356
+ };
1357
+ }>>[];
1358
+ metadata: {
1359
+ openapi: {
1360
+ operationId: string;
1361
+ summary: string;
1362
+ description: string;
1363
+ responses: {
1364
+ 200: {
1365
+ description: string;
1366
+ content: {
1367
+ "application/json": {
1368
+ schema: {
1369
+ type: "object";
1370
+ properties: {
1371
+ user: {
1372
+ $ref: string;
1373
+ };
1374
+ };
1375
+ };
1376
+ };
1377
+ };
1378
+ };
1379
+ };
1380
+ };
1381
+ };
1382
+ }, {
1383
+ user: better_auth_plugins.UserWithRole;
1384
+ }>;
1385
+ impersonateUser: better_auth.StrictEndpoint<"/admin/impersonate-user", {
1386
+ method: "POST";
1387
+ body: better_auth.ZodObject<{
1388
+ userId: better_auth.ZodCoercedString<unknown>;
1389
+ }, zod_v4_core.$strip>;
1390
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1391
+ session: {
1392
+ user: better_auth_plugins.UserWithRole;
1393
+ session: {
1394
+ id: string;
1395
+ createdAt: Date;
1396
+ updatedAt: Date;
1397
+ userId: string;
1398
+ expiresAt: Date;
1399
+ token: string;
1400
+ ipAddress?: string | null | undefined;
1401
+ userAgent?: string | null | undefined;
1402
+ };
1403
+ };
1404
+ }>>[];
1405
+ metadata: {
1406
+ openapi: {
1407
+ operationId: string;
1408
+ summary: string;
1409
+ description: string;
1410
+ responses: {
1411
+ 200: {
1412
+ description: string;
1413
+ content: {
1414
+ "application/json": {
1415
+ schema: {
1416
+ type: "object";
1417
+ properties: {
1418
+ session: {
1419
+ $ref: string;
1420
+ };
1421
+ user: {
1422
+ $ref: string;
1423
+ };
1424
+ };
1425
+ };
1426
+ };
1427
+ };
1428
+ };
1429
+ };
1430
+ };
1431
+ };
1432
+ }, {
1433
+ session: {
1434
+ id: string;
1435
+ createdAt: Date;
1436
+ updatedAt: Date;
1437
+ userId: string;
1438
+ expiresAt: Date;
1439
+ token: string;
1440
+ ipAddress?: string | null | undefined;
1441
+ userAgent?: string | null | undefined;
1442
+ };
1443
+ user: better_auth_plugins.UserWithRole;
1444
+ }>;
1445
+ stopImpersonating: better_auth.StrictEndpoint<"/admin/stop-impersonating", {
1446
+ method: "POST";
1447
+ requireHeaders: true;
1448
+ }, {
1449
+ session: {
1450
+ id: string;
1451
+ createdAt: Date;
1452
+ updatedAt: Date;
1453
+ userId: string;
1454
+ expiresAt: Date;
1455
+ token: string;
1456
+ ipAddress?: string | null | undefined;
1457
+ userAgent?: string | null | undefined;
1458
+ } & Record<string, any>;
1459
+ user: {
1460
+ id: string;
1461
+ createdAt: Date;
1462
+ updatedAt: Date;
1463
+ email: string;
1464
+ emailVerified: boolean;
1465
+ name: string;
1466
+ image?: string | null | undefined;
1467
+ } & Record<string, any>;
1468
+ }>;
1469
+ revokeUserSession: better_auth.StrictEndpoint<"/admin/revoke-user-session", {
1470
+ method: "POST";
1471
+ body: better_auth.ZodObject<{
1472
+ sessionToken: better_auth.ZodString;
1473
+ }, zod_v4_core.$strip>;
1474
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1475
+ session: {
1476
+ user: better_auth_plugins.UserWithRole;
1477
+ session: {
1478
+ id: string;
1479
+ createdAt: Date;
1480
+ updatedAt: Date;
1481
+ userId: string;
1482
+ expiresAt: Date;
1483
+ token: string;
1484
+ ipAddress?: string | null | undefined;
1485
+ userAgent?: string | null | undefined;
1486
+ };
1487
+ };
1488
+ }>>[];
1489
+ metadata: {
1490
+ openapi: {
1491
+ operationId: string;
1492
+ summary: string;
1493
+ description: string;
1494
+ responses: {
1495
+ 200: {
1496
+ description: string;
1497
+ content: {
1498
+ "application/json": {
1499
+ schema: {
1500
+ type: "object";
1501
+ properties: {
1502
+ success: {
1503
+ type: string;
1504
+ };
1505
+ };
1506
+ };
1507
+ };
1508
+ };
1509
+ };
1510
+ };
1511
+ };
1512
+ };
1513
+ }, {
1514
+ success: boolean;
1515
+ }>;
1516
+ revokeUserSessions: better_auth.StrictEndpoint<"/admin/revoke-user-sessions", {
1517
+ method: "POST";
1518
+ body: better_auth.ZodObject<{
1519
+ userId: better_auth.ZodCoercedString<unknown>;
1520
+ }, zod_v4_core.$strip>;
1521
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1522
+ session: {
1523
+ user: better_auth_plugins.UserWithRole;
1524
+ session: {
1525
+ id: string;
1526
+ createdAt: Date;
1527
+ updatedAt: Date;
1528
+ userId: string;
1529
+ expiresAt: Date;
1530
+ token: string;
1531
+ ipAddress?: string | null | undefined;
1532
+ userAgent?: string | null | undefined;
1533
+ };
1534
+ };
1535
+ }>>[];
1536
+ metadata: {
1537
+ openapi: {
1538
+ operationId: string;
1539
+ summary: string;
1540
+ description: string;
1541
+ responses: {
1542
+ 200: {
1543
+ description: string;
1544
+ content: {
1545
+ "application/json": {
1546
+ schema: {
1547
+ type: "object";
1548
+ properties: {
1549
+ success: {
1550
+ type: string;
1551
+ };
1552
+ };
1553
+ };
1554
+ };
1555
+ };
1556
+ };
1557
+ };
1558
+ };
1559
+ };
1560
+ }, {
1561
+ success: boolean;
1562
+ }>;
1563
+ removeUser: better_auth.StrictEndpoint<"/admin/remove-user", {
1564
+ method: "POST";
1565
+ body: better_auth.ZodObject<{
1566
+ userId: better_auth.ZodCoercedString<unknown>;
1567
+ }, zod_v4_core.$strip>;
1568
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1569
+ session: {
1570
+ user: better_auth_plugins.UserWithRole;
1571
+ session: {
1572
+ id: string;
1573
+ createdAt: Date;
1574
+ updatedAt: Date;
1575
+ userId: string;
1576
+ expiresAt: Date;
1577
+ token: string;
1578
+ ipAddress?: string | null | undefined;
1579
+ userAgent?: string | null | undefined;
1580
+ };
1581
+ };
1582
+ }>>[];
1583
+ metadata: {
1584
+ openapi: {
1585
+ operationId: string;
1586
+ summary: string;
1587
+ description: string;
1588
+ responses: {
1589
+ 200: {
1590
+ description: string;
1591
+ content: {
1592
+ "application/json": {
1593
+ schema: {
1594
+ type: "object";
1595
+ properties: {
1596
+ success: {
1597
+ type: string;
1598
+ };
1599
+ };
1600
+ };
1601
+ };
1602
+ };
1603
+ };
1604
+ };
1605
+ };
1606
+ };
1607
+ }, {
1608
+ success: boolean;
1609
+ }>;
1610
+ setUserPassword: better_auth.StrictEndpoint<"/admin/set-user-password", {
1611
+ method: "POST";
1612
+ body: better_auth.ZodObject<{
1613
+ newPassword: better_auth.ZodString;
1614
+ userId: better_auth.ZodCoercedString<unknown>;
1615
+ }, zod_v4_core.$strip>;
1616
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
1617
+ session: {
1618
+ user: better_auth_plugins.UserWithRole;
1619
+ session: {
1620
+ id: string;
1621
+ createdAt: Date;
1622
+ updatedAt: Date;
1623
+ userId: string;
1624
+ expiresAt: Date;
1625
+ token: string;
1626
+ ipAddress?: string | null | undefined;
1627
+ userAgent?: string | null | undefined;
1628
+ };
1629
+ };
1630
+ }>>[];
1631
+ metadata: {
1632
+ openapi: {
1633
+ operationId: string;
1634
+ summary: string;
1635
+ description: string;
1636
+ responses: {
1637
+ 200: {
1638
+ description: string;
1639
+ content: {
1640
+ "application/json": {
1641
+ schema: {
1642
+ type: "object";
1643
+ properties: {
1644
+ status: {
1645
+ type: string;
1646
+ };
1647
+ };
1648
+ };
1649
+ };
1650
+ };
1651
+ };
1652
+ };
1653
+ };
1654
+ };
1655
+ }, {
1656
+ status: boolean;
1657
+ }>;
1658
+ userHasPermission: better_auth.StrictEndpoint<"/admin/has-permission", {
1659
+ method: "POST";
1660
+ body: better_auth.ZodIntersection<better_auth.ZodObject<{
1661
+ userId: better_auth.ZodOptional<better_auth.ZodCoercedString<unknown>>;
1662
+ role: better_auth.ZodOptional<better_auth.ZodString>;
1663
+ }, zod_v4_core.$strip>, better_auth.ZodXor<readonly [better_auth.ZodObject<{
1664
+ permission: better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>>;
1665
+ }, zod_v4_core.$strip>, better_auth.ZodObject<{
1666
+ permissions: better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>>;
1667
+ }, zod_v4_core.$strip>]>>;
1668
+ metadata: {
1669
+ openapi: {
1670
+ description: string;
1671
+ requestBody: {
1672
+ content: {
1673
+ "application/json": {
1674
+ schema: {
1675
+ type: "object";
1676
+ properties: {
1677
+ permissions: {
1678
+ type: string;
1679
+ description: string;
1680
+ };
1681
+ };
1682
+ required: string[];
1683
+ };
1684
+ };
1685
+ };
1686
+ };
1687
+ responses: {
1688
+ "200": {
1689
+ description: string;
1690
+ content: {
1691
+ "application/json": {
1692
+ schema: {
1693
+ type: "object";
1694
+ properties: {
1695
+ error: {
1696
+ type: string;
1697
+ };
1698
+ success: {
1699
+ type: string;
1700
+ };
1701
+ };
1702
+ required: string[];
1703
+ };
1704
+ };
1705
+ };
1706
+ };
1707
+ };
1708
+ };
1709
+ $Infer: {
1710
+ body: {
1711
+ permissions: {
1712
+ readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
1713
+ readonly session?: ("list" | "delete" | "revoke")[] | undefined;
1714
+ };
1715
+ } & {
1716
+ userId?: string | undefined;
1717
+ role?: "megacorp_admin" | "customer_admin" | "member" | undefined;
1718
+ };
1719
+ };
1720
+ };
1721
+ }, {
1722
+ error: null;
1723
+ success: boolean;
1724
+ }>;
1725
+ };
1726
+ $ERROR_CODES: {
1727
+ USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: better_auth.RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
1728
+ FAILED_TO_CREATE_USER: better_auth.RawError<"FAILED_TO_CREATE_USER">;
1729
+ USER_ALREADY_EXISTS: better_auth.RawError<"USER_ALREADY_EXISTS">;
1730
+ YOU_CANNOT_BAN_YOURSELF: better_auth.RawError<"YOU_CANNOT_BAN_YOURSELF">;
1731
+ YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">;
1732
+ YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">;
1733
+ YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">;
1734
+ YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">;
1735
+ YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">;
1736
+ YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">;
1737
+ YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">;
1738
+ YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">;
1739
+ YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">;
1740
+ BANNED_USER: better_auth.RawError<"BANNED_USER">;
1741
+ YOU_ARE_NOT_ALLOWED_TO_GET_USER: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">;
1742
+ NO_DATA_TO_UPDATE: better_auth.RawError<"NO_DATA_TO_UPDATE">;
1743
+ YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">;
1744
+ YOU_CANNOT_REMOVE_YOURSELF: better_auth.RawError<"YOU_CANNOT_REMOVE_YOURSELF">;
1745
+ YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
1746
+ YOU_CANNOT_IMPERSONATE_ADMINS: better_auth.RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
1747
+ INVALID_ROLE_TYPE: better_auth.RawError<"INVALID_ROLE_TYPE">;
1748
+ YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
1749
+ PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: better_auth.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
1750
+ };
1751
+ schema: {
1752
+ user: {
1753
+ fields: {
1754
+ role: {
1755
+ type: "string";
1756
+ required: false;
1757
+ input: false;
1758
+ };
1759
+ banned: {
1760
+ type: "boolean";
1761
+ defaultValue: false;
1762
+ required: false;
1763
+ input: false;
1764
+ };
1765
+ banReason: {
1766
+ type: "string";
1767
+ required: false;
1768
+ input: false;
1769
+ };
1770
+ banExpires: {
1771
+ type: "date";
1772
+ required: false;
1773
+ input: false;
1774
+ };
1775
+ };
1776
+ };
1777
+ session: {
1778
+ fields: {
1779
+ impersonatedBy: {
1780
+ type: "string";
1781
+ required: false;
1782
+ input: false;
1783
+ };
1784
+ };
1785
+ };
1786
+ };
1787
+ options: NoInfer<{
1788
+ defaultRole: "megacorp_admin" | "customer_admin" | "member";
1789
+ ac: {
1790
+ newRole<const TRoleStatements extends better_auth_plugins.Statements>(statements: better_auth_plugins.RoleInput<{
1791
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
1792
+ readonly session: readonly ["list", "revoke", "delete"];
1793
+ }, TRoleStatements>): better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<TRoleStatements>, {
1794
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
1795
+ readonly session: readonly ["list", "revoke", "delete"];
1796
+ }>;
1797
+ statements: {
1798
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
1799
+ readonly session: readonly ["list", "revoke", "delete"];
1800
+ };
1801
+ };
1802
+ roles: {
1803
+ megacorp_admin: better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<{
1804
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
1805
+ readonly session: readonly ["list", "revoke", "delete"];
1806
+ }>, {
1807
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
1808
+ readonly session: readonly ["list", "revoke", "delete"];
1809
+ }>;
1810
+ customer_admin: better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<{
1811
+ readonly user: readonly [];
1812
+ readonly session: readonly [];
1813
+ }>, {
1814
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
1815
+ readonly session: readonly ["list", "revoke", "delete"];
1816
+ }>;
1817
+ member: better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<{
1818
+ readonly user: readonly [];
1819
+ readonly session: readonly [];
1820
+ }>, {
1821
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
1822
+ readonly session: readonly ["list", "revoke", "delete"];
1823
+ }>;
1824
+ };
1825
+ adminRoles: string[];
1826
+ impersonationSessionDuration: number;
1827
+ }>;
1828
+ }];
1829
+ };
1830
+
1831
+ interface CreateMegacorpAuthOptions {
1832
+ /** Shown in emails and stamped on every telemetry event. */
1833
+ appName: string;
1834
+ /** Defaults to process.env. */
1835
+ env?: Record<string, string | undefined>;
1836
+ /** Override the mailer (tests, custom providers). */
1837
+ mailer?: Mailer;
1838
+ /** Path on AUTH_BASE_URL the invite email links to. Default "/". */
1839
+ inviteLinkPath?: string;
1840
+ /** Additional event listener (events also go to the configured sink). */
1841
+ onEvent?: (event: AuthEvent) => void;
1842
+ /** Reuse an existing pg Pool. */
1843
+ pool?: Pool;
1844
+ /** Entra ID credential for Application Insights ingestion (defaults to APPLICATIONINSIGHTS_AUTHENTICATION_STRING / managed identity). */
1845
+ telemetryCredential?: TokenCredential;
1846
+ }
1847
+ type MegacorpBetterAuth = ReturnType<typeof createAuthInstance>;
1848
+ interface MegacorpAuth {
1849
+ auth: MegacorpBetterAuth;
1850
+ config: AuthConfig;
1851
+ pool: Pool;
1852
+ /** Resolves after schema check + bootstrap admins. mount() gates auth routes on it. */
1853
+ ready: Promise<void>;
1854
+ mount(app: Express): void;
1855
+ requireSession(): RequestHandler;
1856
+ requireRole(...roles: Role[]): RequestHandler;
1857
+ getSession(req: Request$1): Promise<SessionInfo | null>;
1858
+ events: {
1859
+ emit(input: EventInput): void;
1860
+ /** Deliver queued telemetry now. */
1861
+ flush(): Promise<void>;
1862
+ /** Stop telemetry timers and drain with bounded retries. Call from your SIGTERM handler before exiting. */
1863
+ shutdown(timeoutMs?: number): Promise<void>;
1864
+ };
1865
+ }
1866
+ type EmitFn = (input: EventInput) => void;
1867
+ /** Better Auth instance with telemetry hooks and the impersonation gate. Kept separate so its type can be exported. */
1868
+ declare function createAuthInstance({ appName, config, pool, mailer, emit }: {
1869
+ appName: string;
1870
+ config: AuthConfig;
1871
+ pool: Pool;
1872
+ mailer: Mailer;
1873
+ emit: EmitFn;
1874
+ }): better_auth.Auth<{
1875
+ hooks: {
1876
+ before: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<void>>;
1877
+ after: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<void>>;
1878
+ };
1879
+ databaseHooks: {
1880
+ session: {
1881
+ create: {
1882
+ after: (session: {
1883
+ id: string;
1884
+ createdAt: Date;
1885
+ updatedAt: Date;
1886
+ userId: string;
1887
+ expiresAt: Date;
1888
+ token: string;
1889
+ ipAddress?: string | null | undefined;
1890
+ userAgent?: string | null | undefined;
1891
+ } & Record<string, unknown>) => Promise<void>;
1892
+ };
1893
+ };
1894
+ };
1895
+ appName: string;
1896
+ baseURL: string;
1897
+ basePath: string;
1898
+ secret: string;
1899
+ trustedOrigins: string[];
1900
+ database: Pool;
1901
+ telemetry: {
1902
+ enabled: false;
1903
+ };
1904
+ emailAndPassword: {
1905
+ enabled: false;
1906
+ };
1907
+ user: {
1908
+ modelName: "auth_user";
1909
+ changeEmail: {
1910
+ enabled: false;
1911
+ };
1912
+ deleteUser: {
1913
+ enabled: false;
1914
+ };
1915
+ };
1916
+ session: {
1917
+ modelName: "auth_session";
1918
+ expiresIn: number;
1919
+ updateAge: number;
1920
+ };
1921
+ account: {
1922
+ modelName: "auth_account";
1923
+ };
1924
+ verification: {
1925
+ modelName: "auth_verification";
1926
+ };
1927
+ rateLimit: {
1928
+ enabled: true;
1929
+ storage: "database";
1930
+ modelName: "auth_rate_limit";
1931
+ window: number;
1932
+ max: number;
1933
+ customRules: {
1934
+ "/email-otp/send-verification-otp": {
1935
+ window: number;
1936
+ max: number;
1937
+ };
1938
+ "/sign-in/email-otp": {
1939
+ window: number;
1940
+ max: number;
1941
+ };
1942
+ "/get-session": {
1943
+ window: number;
1944
+ max: number;
1945
+ };
1946
+ };
1947
+ };
1948
+ advanced: {
1949
+ useSecureCookies: boolean;
1950
+ cookiePrefix: string;
1951
+ ipAddress: {
1952
+ ipAddressHeaders: string[];
1953
+ };
1954
+ database: {
1955
+ generateId: "uuid";
1956
+ };
1957
+ };
1958
+ plugins: [{
1959
+ id: "email-otp";
1960
+ version: string;
1961
+ init(ctx: better_auth.AuthContext): {
1962
+ options: {
1963
+ emailVerification: {
1964
+ sendVerificationEmail(data: {
1965
+ user: better_auth.User;
1966
+ url: string;
1967
+ token: string;
1968
+ }, request: globalThis.Request | undefined): Promise<void>;
1969
+ };
1970
+ };
1971
+ } | undefined;
1972
+ endpoints: {
1973
+ sendVerificationOTP: better_auth.StrictEndpoint<"/email-otp/send-verification-otp", {
1974
+ method: "POST";
1975
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<void>>[];
1976
+ body: better_auth.ZodObject<{
1977
+ email: better_auth.ZodString;
1978
+ type: better_auth.ZodEnum<{
1979
+ "sign-in": "sign-in";
1980
+ "change-email": "change-email";
1981
+ "email-verification": "email-verification";
1982
+ "forget-password": "forget-password";
1983
+ }>;
1984
+ }, zod_v4_core.$strip>;
1985
+ metadata: {
1986
+ openapi: {
1987
+ operationId: string;
1988
+ description: string;
1989
+ responses: {
1990
+ 200: {
1991
+ description: string;
1992
+ content: {
1993
+ "application/json": {
1994
+ schema: {
1995
+ type: "object";
1996
+ properties: {
1997
+ success: {
1998
+ type: string;
1999
+ };
2000
+ };
2001
+ };
2002
+ };
2003
+ };
2004
+ };
2005
+ };
2006
+ };
2007
+ };
2008
+ }, {
2009
+ success: boolean;
2010
+ }>;
2011
+ createVerificationOTP: better_auth.StrictEndpoint<string, {
2012
+ method: "POST";
2013
+ body: better_auth.ZodObject<{
2014
+ email: better_auth.ZodString;
2015
+ type: better_auth.ZodEnum<{
2016
+ "sign-in": "sign-in";
2017
+ "change-email": "change-email";
2018
+ "email-verification": "email-verification";
2019
+ "forget-password": "forget-password";
2020
+ }>;
2021
+ }, zod_v4_core.$strip>;
2022
+ metadata: {
2023
+ openapi: {
2024
+ operationId: string;
2025
+ description: string;
2026
+ responses: {
2027
+ 200: {
2028
+ description: string;
2029
+ content: {
2030
+ "application/json": {
2031
+ schema: {
2032
+ type: "string";
2033
+ };
2034
+ };
2035
+ };
2036
+ };
2037
+ };
2038
+ };
2039
+ };
2040
+ }, string>;
2041
+ getVerificationOTP: better_auth.StrictEndpoint<string, {
2042
+ method: "GET";
2043
+ query: better_auth.ZodObject<{
2044
+ email: better_auth.ZodString;
2045
+ type: better_auth.ZodEnum<{
2046
+ "sign-in": "sign-in";
2047
+ "change-email": "change-email";
2048
+ "email-verification": "email-verification";
2049
+ "forget-password": "forget-password";
2050
+ }>;
2051
+ }, zod_v4_core.$strip>;
2052
+ metadata: {
2053
+ openapi: {
2054
+ operationId: string;
2055
+ description: string;
2056
+ responses: {
2057
+ "200": {
2058
+ description: string;
2059
+ content: {
2060
+ "application/json": {
2061
+ schema: {
2062
+ type: "object";
2063
+ properties: {
2064
+ otp: {
2065
+ type: string;
2066
+ nullable: boolean;
2067
+ description: string;
2068
+ };
2069
+ };
2070
+ required: string[];
2071
+ };
2072
+ };
2073
+ };
2074
+ };
2075
+ };
2076
+ };
2077
+ };
2078
+ }, {
2079
+ otp: null;
2080
+ } | {
2081
+ otp: string;
2082
+ }>;
2083
+ checkVerificationOTP: better_auth.StrictEndpoint<"/email-otp/check-verification-otp", {
2084
+ method: "POST";
2085
+ body: better_auth.ZodObject<{
2086
+ email: better_auth.ZodString;
2087
+ type: better_auth.ZodEnum<{
2088
+ "sign-in": "sign-in";
2089
+ "change-email": "change-email";
2090
+ "email-verification": "email-verification";
2091
+ "forget-password": "forget-password";
2092
+ }>;
2093
+ otp: better_auth.ZodString;
2094
+ }, zod_v4_core.$strip>;
2095
+ metadata: {
2096
+ openapi: {
2097
+ operationId: string;
2098
+ description: string;
2099
+ responses: {
2100
+ 200: {
2101
+ description: string;
2102
+ content: {
2103
+ "application/json": {
2104
+ schema: {
2105
+ type: "object";
2106
+ properties: {
2107
+ success: {
2108
+ type: string;
2109
+ };
2110
+ };
2111
+ };
2112
+ };
2113
+ };
2114
+ };
2115
+ };
2116
+ };
2117
+ };
2118
+ }, {
2119
+ success: boolean;
2120
+ }>;
2121
+ verifyEmailOTP: better_auth.StrictEndpoint<"/email-otp/verify-email", {
2122
+ method: "POST";
2123
+ body: better_auth.ZodObject<{
2124
+ email: better_auth.ZodString;
2125
+ otp: better_auth.ZodString;
2126
+ }, zod_v4_core.$strip>;
2127
+ metadata: {
2128
+ openapi: {
2129
+ description: string;
2130
+ responses: {
2131
+ 200: {
2132
+ description: string;
2133
+ content: {
2134
+ "application/json": {
2135
+ schema: {
2136
+ type: "object";
2137
+ properties: {
2138
+ status: {
2139
+ type: string;
2140
+ description: string;
2141
+ enum: boolean[];
2142
+ };
2143
+ token: {
2144
+ type: string;
2145
+ nullable: boolean;
2146
+ description: string;
2147
+ };
2148
+ user: {
2149
+ $ref: string;
2150
+ };
2151
+ };
2152
+ required: string[];
2153
+ };
2154
+ };
2155
+ };
2156
+ };
2157
+ };
2158
+ };
2159
+ };
2160
+ }, {
2161
+ status: boolean;
2162
+ token: string;
2163
+ user: {
2164
+ id: string;
2165
+ createdAt: Date;
2166
+ updatedAt: Date;
2167
+ email: string;
2168
+ emailVerified: boolean;
2169
+ name: string;
2170
+ image?: string | null | undefined;
2171
+ } & Record<string, any>;
2172
+ } | {
2173
+ status: boolean;
2174
+ token: null;
2175
+ user: {
2176
+ id: string;
2177
+ createdAt: Date;
2178
+ updatedAt: Date;
2179
+ email: string;
2180
+ emailVerified: boolean;
2181
+ name: string;
2182
+ image?: string | null | undefined;
2183
+ } & Record<string, any>;
2184
+ }>;
2185
+ signInEmailOTP: better_auth.StrictEndpoint<"/sign-in/email-otp", {
2186
+ method: "POST";
2187
+ body: better_auth.ZodIntersection<better_auth.ZodObject<{
2188
+ email: better_auth.ZodString;
2189
+ otp: better_auth.ZodString;
2190
+ name: better_auth.ZodOptional<better_auth.ZodString>;
2191
+ image: better_auth.ZodOptional<better_auth.ZodString>;
2192
+ }, zod_v4_core.$strip>, better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodAny>>;
2193
+ metadata: {
2194
+ openapi: {
2195
+ operationId: string;
2196
+ description: string;
2197
+ responses: {
2198
+ 200: {
2199
+ description: string;
2200
+ content: {
2201
+ "application/json": {
2202
+ schema: {
2203
+ type: "object";
2204
+ properties: {
2205
+ token: {
2206
+ type: string;
2207
+ description: string;
2208
+ };
2209
+ user: {
2210
+ $ref: string;
2211
+ };
2212
+ };
2213
+ required: string[];
2214
+ };
2215
+ };
2216
+ };
2217
+ };
2218
+ };
2219
+ };
2220
+ };
2221
+ }, {
2222
+ token: string;
2223
+ user: {
2224
+ id: string;
2225
+ createdAt: Date;
2226
+ updatedAt: Date;
2227
+ email: string;
2228
+ emailVerified: boolean;
2229
+ name: string;
2230
+ image?: string | null | undefined;
2231
+ };
2232
+ }>;
2233
+ requestPasswordResetEmailOTP: better_auth.StrictEndpoint<"/email-otp/request-password-reset", {
2234
+ method: "POST";
2235
+ body: better_auth.ZodObject<{
2236
+ email: better_auth.ZodString;
2237
+ }, zod_v4_core.$strip>;
2238
+ metadata: {
2239
+ openapi: {
2240
+ operationId: string;
2241
+ description: string;
2242
+ responses: {
2243
+ 200: {
2244
+ description: string;
2245
+ content: {
2246
+ "application/json": {
2247
+ schema: {
2248
+ type: "object";
2249
+ properties: {
2250
+ success: {
2251
+ type: string;
2252
+ description: string;
2253
+ };
2254
+ };
2255
+ };
2256
+ };
2257
+ };
2258
+ };
2259
+ };
2260
+ };
2261
+ };
2262
+ }, {
2263
+ success: boolean;
2264
+ }>;
2265
+ forgetPasswordEmailOTP: better_auth.StrictEndpoint<"/forget-password/email-otp", {
2266
+ method: "POST";
2267
+ body: better_auth.ZodObject<{
2268
+ email: better_auth.ZodString;
2269
+ }, zod_v4_core.$strip>;
2270
+ metadata: {
2271
+ openapi: {
2272
+ operationId: string;
2273
+ description: string;
2274
+ responses: {
2275
+ 200: {
2276
+ description: string;
2277
+ content: {
2278
+ "application/json": {
2279
+ schema: {
2280
+ type: "object";
2281
+ properties: {
2282
+ success: {
2283
+ type: string;
2284
+ description: string;
2285
+ };
2286
+ };
2287
+ };
2288
+ };
2289
+ };
2290
+ };
2291
+ };
2292
+ };
2293
+ };
2294
+ }, {
2295
+ success: boolean;
2296
+ }>;
2297
+ resetPasswordEmailOTP: better_auth.StrictEndpoint<"/email-otp/reset-password", {
2298
+ method: "POST";
2299
+ body: better_auth.ZodObject<{
2300
+ email: better_auth.ZodString;
2301
+ otp: better_auth.ZodString;
2302
+ password: better_auth.ZodString;
2303
+ }, zod_v4_core.$strip>;
2304
+ metadata: {
2305
+ openapi: {
2306
+ operationId: string;
2307
+ description: string;
2308
+ responses: {
2309
+ 200: {
2310
+ description: string;
2311
+ content: {
2312
+ "application/json": {
2313
+ schema: {
2314
+ type: "object";
2315
+ properties: {
2316
+ success: {
2317
+ type: string;
2318
+ };
2319
+ };
2320
+ };
2321
+ };
2322
+ };
2323
+ };
2324
+ };
2325
+ };
2326
+ };
2327
+ }, {
2328
+ success: boolean;
2329
+ }>;
2330
+ requestEmailChangeEmailOTP: better_auth.StrictEndpoint<"/email-otp/request-email-change", {
2331
+ method: "POST";
2332
+ body: better_auth.ZodObject<{
2333
+ newEmail: better_auth.ZodString;
2334
+ otp: better_auth.ZodOptional<better_auth.ZodString>;
2335
+ }, zod_v4_core.$strip>;
2336
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2337
+ session: {
2338
+ session: Record<string, any> & {
2339
+ id: string;
2340
+ createdAt: Date;
2341
+ updatedAt: Date;
2342
+ userId: string;
2343
+ expiresAt: Date;
2344
+ token: string;
2345
+ ipAddress?: string | null | undefined;
2346
+ userAgent?: string | null | undefined;
2347
+ };
2348
+ user: Record<string, any> & {
2349
+ id: string;
2350
+ createdAt: Date;
2351
+ updatedAt: Date;
2352
+ email: string;
2353
+ emailVerified: boolean;
2354
+ name: string;
2355
+ image?: string | null | undefined;
2356
+ };
2357
+ };
2358
+ }>>[];
2359
+ metadata: {
2360
+ openapi: {
2361
+ operationId: string;
2362
+ description: string;
2363
+ responses: {
2364
+ 200: {
2365
+ description: string;
2366
+ content: {
2367
+ "application/json": {
2368
+ schema: {
2369
+ type: "object";
2370
+ properties: {
2371
+ success: {
2372
+ type: string;
2373
+ };
2374
+ };
2375
+ };
2376
+ };
2377
+ };
2378
+ };
2379
+ };
2380
+ };
2381
+ };
2382
+ }, {
2383
+ success: boolean;
2384
+ }>;
2385
+ changeEmailEmailOTP: better_auth.StrictEndpoint<"/email-otp/change-email", {
2386
+ method: "POST";
2387
+ body: better_auth.ZodObject<{
2388
+ newEmail: better_auth.ZodString;
2389
+ otp: better_auth.ZodString;
2390
+ }, zod_v4_core.$strip>;
2391
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2392
+ session: {
2393
+ session: Record<string, any> & {
2394
+ id: string;
2395
+ createdAt: Date;
2396
+ updatedAt: Date;
2397
+ userId: string;
2398
+ expiresAt: Date;
2399
+ token: string;
2400
+ ipAddress?: string | null | undefined;
2401
+ userAgent?: string | null | undefined;
2402
+ };
2403
+ user: Record<string, any> & {
2404
+ id: string;
2405
+ createdAt: Date;
2406
+ updatedAt: Date;
2407
+ email: string;
2408
+ emailVerified: boolean;
2409
+ name: string;
2410
+ image?: string | null | undefined;
2411
+ };
2412
+ };
2413
+ }>>[];
2414
+ metadata: {
2415
+ openapi: {
2416
+ operationId: string;
2417
+ description: string;
2418
+ responses: {
2419
+ 200: {
2420
+ description: string;
2421
+ content: {
2422
+ "application/json": {
2423
+ schema: {
2424
+ type: "object";
2425
+ properties: {
2426
+ success: {
2427
+ type: string;
2428
+ };
2429
+ };
2430
+ };
2431
+ };
2432
+ };
2433
+ };
2434
+ };
2435
+ };
2436
+ };
2437
+ }, {
2438
+ success: boolean;
2439
+ }>;
2440
+ };
2441
+ hooks: {
2442
+ after: {
2443
+ matcher(context: better_auth.HookEndpointContext): boolean;
2444
+ handler: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<void>>;
2445
+ }[];
2446
+ };
2447
+ rateLimit: ({
2448
+ pathMatcher(path: string): path is "/email-otp/send-verification-otp";
2449
+ window: number;
2450
+ max: number;
2451
+ } | {
2452
+ pathMatcher(path: string): path is "/email-otp/check-verification-otp";
2453
+ window: number;
2454
+ max: number;
2455
+ } | {
2456
+ pathMatcher(path: string): path is "/email-otp/verify-email";
2457
+ window: number;
2458
+ max: number;
2459
+ } | {
2460
+ pathMatcher(path: string): path is "/sign-in/email-otp";
2461
+ window: number;
2462
+ max: number;
2463
+ } | {
2464
+ pathMatcher(path: string): path is "/email-otp/request-password-reset";
2465
+ window: number;
2466
+ max: number;
2467
+ } | {
2468
+ pathMatcher(path: string): path is "/email-otp/reset-password";
2469
+ window: number;
2470
+ max: number;
2471
+ } | {
2472
+ pathMatcher(path: string): path is "/forget-password/email-otp";
2473
+ window: number;
2474
+ max: number;
2475
+ } | {
2476
+ pathMatcher(path: string): path is "/email-otp/request-email-change";
2477
+ window: number;
2478
+ max: number;
2479
+ } | {
2480
+ pathMatcher(path: string): path is "/email-otp/change-email";
2481
+ window: number;
2482
+ max: number;
2483
+ })[];
2484
+ options: better_auth_plugins.EmailOTPOptions;
2485
+ $ERROR_CODES: {
2486
+ OTP_EXPIRED: better_auth.RawError<"OTP_EXPIRED">;
2487
+ INVALID_OTP: better_auth.RawError<"INVALID_OTP">;
2488
+ TOO_MANY_ATTEMPTS: better_auth.RawError<"TOO_MANY_ATTEMPTS">;
2489
+ };
2490
+ }, {
2491
+ id: "admin";
2492
+ version: string;
2493
+ init(): {
2494
+ options: {
2495
+ databaseHooks: {
2496
+ user: {
2497
+ create: {
2498
+ before(user: {
2499
+ id: string;
2500
+ createdAt: Date;
2501
+ updatedAt: Date;
2502
+ email: string;
2503
+ emailVerified: boolean;
2504
+ name: string;
2505
+ image?: string | null | undefined;
2506
+ } & Record<string, unknown>): Promise<{
2507
+ data: {
2508
+ id: string;
2509
+ createdAt: Date;
2510
+ updatedAt: Date;
2511
+ email: string;
2512
+ emailVerified: boolean;
2513
+ name: string;
2514
+ image?: string | null | undefined;
2515
+ role: string;
2516
+ };
2517
+ }>;
2518
+ };
2519
+ };
2520
+ session: {
2521
+ create: {
2522
+ before(session: {
2523
+ id: string;
2524
+ createdAt: Date;
2525
+ updatedAt: Date;
2526
+ userId: string;
2527
+ expiresAt: Date;
2528
+ token: string;
2529
+ ipAddress?: string | null | undefined;
2530
+ userAgent?: string | null | undefined;
2531
+ } & Record<string, unknown>, ctx: better_auth.GenericEndpointContext | null): Promise<void>;
2532
+ };
2533
+ };
2534
+ };
2535
+ };
2536
+ };
2537
+ hooks: {
2538
+ after: {
2539
+ matcher(context: better_auth.HookEndpointContext): boolean;
2540
+ handler: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<better_auth_plugins.SessionWithImpersonatedBy[] | undefined>>;
2541
+ }[];
2542
+ };
2543
+ endpoints: {
2544
+ setRole: better_auth.StrictEndpoint<"/admin/set-role", {
2545
+ method: "POST";
2546
+ body: better_auth.ZodObject<{
2547
+ userId: better_auth.ZodCoercedString<unknown>;
2548
+ role: better_auth.ZodUnion<readonly [better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>]>;
2549
+ }, zod_v4_core.$strip>;
2550
+ requireHeaders: true;
2551
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2552
+ session: {
2553
+ user: better_auth_plugins.UserWithRole;
2554
+ session: {
2555
+ id: string;
2556
+ createdAt: Date;
2557
+ updatedAt: Date;
2558
+ userId: string;
2559
+ expiresAt: Date;
2560
+ token: string;
2561
+ ipAddress?: string | null | undefined;
2562
+ userAgent?: string | null | undefined;
2563
+ };
2564
+ };
2565
+ }>>[];
2566
+ metadata: {
2567
+ openapi: {
2568
+ operationId: string;
2569
+ summary: string;
2570
+ description: string;
2571
+ responses: {
2572
+ 200: {
2573
+ description: string;
2574
+ content: {
2575
+ "application/json": {
2576
+ schema: {
2577
+ type: "object";
2578
+ properties: {
2579
+ user: {
2580
+ $ref: string;
2581
+ };
2582
+ };
2583
+ };
2584
+ };
2585
+ };
2586
+ };
2587
+ };
2588
+ };
2589
+ $Infer: {
2590
+ body: {
2591
+ userId: string;
2592
+ role: "megacorp_admin" | "customer_admin" | "member" | ("megacorp_admin" | "customer_admin" | "member")[];
2593
+ };
2594
+ };
2595
+ };
2596
+ }, {
2597
+ user: better_auth_plugins.UserWithRole;
2598
+ }>;
2599
+ getUser: better_auth.StrictEndpoint<"/admin/get-user", {
2600
+ method: "GET";
2601
+ query: better_auth.ZodObject<{
2602
+ id: better_auth.ZodString;
2603
+ }, zod_v4_core.$strip>;
2604
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2605
+ session: {
2606
+ user: better_auth_plugins.UserWithRole;
2607
+ session: {
2608
+ id: string;
2609
+ createdAt: Date;
2610
+ updatedAt: Date;
2611
+ userId: string;
2612
+ expiresAt: Date;
2613
+ token: string;
2614
+ ipAddress?: string | null | undefined;
2615
+ userAgent?: string | null | undefined;
2616
+ };
2617
+ };
2618
+ }>>[];
2619
+ metadata: {
2620
+ openapi: {
2621
+ operationId: string;
2622
+ summary: string;
2623
+ description: string;
2624
+ responses: {
2625
+ 200: {
2626
+ description: string;
2627
+ content: {
2628
+ "application/json": {
2629
+ schema: {
2630
+ type: "object";
2631
+ properties: {
2632
+ user: {
2633
+ $ref: string;
2634
+ };
2635
+ };
2636
+ };
2637
+ };
2638
+ };
2639
+ };
2640
+ };
2641
+ };
2642
+ };
2643
+ }, better_auth_plugins.UserWithRole>;
2644
+ createUser: better_auth.StrictEndpoint<"/admin/create-user", {
2645
+ method: "POST";
2646
+ body: better_auth.ZodObject<{
2647
+ email: better_auth.ZodString;
2648
+ password: better_auth.ZodOptional<better_auth.ZodString>;
2649
+ name: better_auth.ZodString;
2650
+ role: better_auth.ZodOptional<better_auth.ZodUnion<readonly [better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>]>>;
2651
+ data: better_auth.ZodOptional<better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodAny>>;
2652
+ }, zod_v4_core.$strip>;
2653
+ metadata: {
2654
+ openapi: {
2655
+ operationId: string;
2656
+ summary: string;
2657
+ description: string;
2658
+ responses: {
2659
+ 200: {
2660
+ description: string;
2661
+ content: {
2662
+ "application/json": {
2663
+ schema: {
2664
+ type: "object";
2665
+ properties: {
2666
+ user: {
2667
+ $ref: string;
2668
+ };
2669
+ };
2670
+ };
2671
+ };
2672
+ };
2673
+ };
2674
+ };
2675
+ };
2676
+ $Infer: {
2677
+ body: {
2678
+ email: string;
2679
+ password?: string | undefined;
2680
+ name: string;
2681
+ role?: "megacorp_admin" | "customer_admin" | "member" | ("megacorp_admin" | "customer_admin" | "member")[] | undefined;
2682
+ data?: Record<string, any> | undefined;
2683
+ };
2684
+ };
2685
+ };
2686
+ }, {
2687
+ user: better_auth_plugins.UserWithRole;
2688
+ }>;
2689
+ adminUpdateUser: better_auth.StrictEndpoint<"/admin/update-user", {
2690
+ method: "POST";
2691
+ body: better_auth.ZodObject<{
2692
+ userId: better_auth.ZodCoercedString<unknown>;
2693
+ data: better_auth.ZodRecord<better_auth.ZodAny, better_auth.ZodAny>;
2694
+ }, zod_v4_core.$strip>;
2695
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2696
+ session: {
2697
+ user: better_auth_plugins.UserWithRole;
2698
+ session: {
2699
+ id: string;
2700
+ createdAt: Date;
2701
+ updatedAt: Date;
2702
+ userId: string;
2703
+ expiresAt: Date;
2704
+ token: string;
2705
+ ipAddress?: string | null | undefined;
2706
+ userAgent?: string | null | undefined;
2707
+ };
2708
+ };
2709
+ }>>[];
2710
+ metadata: {
2711
+ openapi: {
2712
+ operationId: string;
2713
+ summary: string;
2714
+ description: string;
2715
+ responses: {
2716
+ 200: {
2717
+ description: string;
2718
+ content: {
2719
+ "application/json": {
2720
+ schema: {
2721
+ type: "object";
2722
+ properties: {
2723
+ user: {
2724
+ $ref: string;
2725
+ };
2726
+ };
2727
+ };
2728
+ };
2729
+ };
2730
+ };
2731
+ };
2732
+ };
2733
+ };
2734
+ }, better_auth_plugins.UserWithRole>;
2735
+ listUsers: better_auth.StrictEndpoint<"/admin/list-users", {
2736
+ method: "GET";
2737
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2738
+ session: {
2739
+ user: better_auth_plugins.UserWithRole;
2740
+ session: {
2741
+ id: string;
2742
+ createdAt: Date;
2743
+ updatedAt: Date;
2744
+ userId: string;
2745
+ expiresAt: Date;
2746
+ token: string;
2747
+ ipAddress?: string | null | undefined;
2748
+ userAgent?: string | null | undefined;
2749
+ };
2750
+ };
2751
+ }>>[];
2752
+ query: better_auth.ZodObject<{
2753
+ searchValue: better_auth.ZodOptional<better_auth.ZodString>;
2754
+ searchField: better_auth.ZodOptional<better_auth.ZodEnum<{
2755
+ email: "email";
2756
+ name: "name";
2757
+ }>>;
2758
+ searchOperator: better_auth.ZodOptional<better_auth.ZodEnum<{
2759
+ contains: "contains";
2760
+ starts_with: "starts_with";
2761
+ ends_with: "ends_with";
2762
+ }>>;
2763
+ limit: better_auth.ZodOptional<better_auth.ZodUnion<[better_auth.ZodString, better_auth.ZodNumber]>>;
2764
+ offset: better_auth.ZodOptional<better_auth.ZodUnion<[better_auth.ZodString, better_auth.ZodNumber]>>;
2765
+ sortBy: better_auth.ZodOptional<better_auth.ZodString>;
2766
+ sortDirection: better_auth.ZodOptional<better_auth.ZodEnum<{
2767
+ asc: "asc";
2768
+ desc: "desc";
2769
+ }>>;
2770
+ filterField: better_auth.ZodOptional<better_auth.ZodString>;
2771
+ filterValue: better_auth.ZodOptional<better_auth.ZodUnion<[better_auth.ZodUnion<[better_auth.ZodUnion<[better_auth.ZodUnion<[better_auth.ZodString, better_auth.ZodNumber]>, better_auth.ZodBoolean]>, better_auth.ZodArray<better_auth.ZodString>]>, better_auth.ZodArray<better_auth.ZodNumber>]>>;
2772
+ filterOperator: better_auth.ZodOptional<better_auth.ZodEnum<{
2773
+ eq: "eq";
2774
+ ne: "ne";
2775
+ gt: "gt";
2776
+ gte: "gte";
2777
+ lt: "lt";
2778
+ lte: "lte";
2779
+ in: "in";
2780
+ not_in: "not_in";
2781
+ contains: "contains";
2782
+ starts_with: "starts_with";
2783
+ ends_with: "ends_with";
2784
+ }>>;
2785
+ }, zod_v4_core.$strip>;
2786
+ metadata: {
2787
+ openapi: {
2788
+ operationId: string;
2789
+ summary: string;
2790
+ description: string;
2791
+ responses: {
2792
+ 200: {
2793
+ description: string;
2794
+ content: {
2795
+ "application/json": {
2796
+ schema: {
2797
+ type: "object";
2798
+ properties: {
2799
+ users: {
2800
+ type: string;
2801
+ items: {
2802
+ $ref: string;
2803
+ };
2804
+ };
2805
+ total: {
2806
+ type: string;
2807
+ };
2808
+ limit: {
2809
+ type: string;
2810
+ };
2811
+ offset: {
2812
+ type: string;
2813
+ };
2814
+ };
2815
+ required: string[];
2816
+ };
2817
+ };
2818
+ };
2819
+ };
2820
+ };
2821
+ };
2822
+ };
2823
+ }, {
2824
+ users: better_auth_plugins.UserWithRole[];
2825
+ total: number;
2826
+ }>;
2827
+ listUserSessions: better_auth.StrictEndpoint<"/admin/list-user-sessions", {
2828
+ method: "POST";
2829
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2830
+ session: {
2831
+ user: better_auth_plugins.UserWithRole;
2832
+ session: {
2833
+ id: string;
2834
+ createdAt: Date;
2835
+ updatedAt: Date;
2836
+ userId: string;
2837
+ expiresAt: Date;
2838
+ token: string;
2839
+ ipAddress?: string | null | undefined;
2840
+ userAgent?: string | null | undefined;
2841
+ };
2842
+ };
2843
+ }>>[];
2844
+ body: better_auth.ZodObject<{
2845
+ userId: better_auth.ZodCoercedString<unknown>;
2846
+ }, zod_v4_core.$strip>;
2847
+ metadata: {
2848
+ openapi: {
2849
+ operationId: string;
2850
+ summary: string;
2851
+ description: string;
2852
+ responses: {
2853
+ 200: {
2854
+ description: string;
2855
+ content: {
2856
+ "application/json": {
2857
+ schema: {
2858
+ type: "object";
2859
+ properties: {
2860
+ sessions: {
2861
+ type: string;
2862
+ items: {
2863
+ $ref: string;
2864
+ };
2865
+ };
2866
+ };
2867
+ };
2868
+ };
2869
+ };
2870
+ };
2871
+ };
2872
+ };
2873
+ };
2874
+ }, {
2875
+ sessions: better_auth_plugins.SessionWithImpersonatedBy[];
2876
+ }>;
2877
+ unbanUser: better_auth.StrictEndpoint<"/admin/unban-user", {
2878
+ method: "POST";
2879
+ body: better_auth.ZodObject<{
2880
+ userId: better_auth.ZodCoercedString<unknown>;
2881
+ }, zod_v4_core.$strip>;
2882
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2883
+ session: {
2884
+ user: better_auth_plugins.UserWithRole;
2885
+ session: {
2886
+ id: string;
2887
+ createdAt: Date;
2888
+ updatedAt: Date;
2889
+ userId: string;
2890
+ expiresAt: Date;
2891
+ token: string;
2892
+ ipAddress?: string | null | undefined;
2893
+ userAgent?: string | null | undefined;
2894
+ };
2895
+ };
2896
+ }>>[];
2897
+ metadata: {
2898
+ openapi: {
2899
+ operationId: string;
2900
+ summary: string;
2901
+ description: string;
2902
+ responses: {
2903
+ 200: {
2904
+ description: string;
2905
+ content: {
2906
+ "application/json": {
2907
+ schema: {
2908
+ type: "object";
2909
+ properties: {
2910
+ user: {
2911
+ $ref: string;
2912
+ };
2913
+ };
2914
+ };
2915
+ };
2916
+ };
2917
+ };
2918
+ };
2919
+ };
2920
+ };
2921
+ }, {
2922
+ user: better_auth_plugins.UserWithRole;
2923
+ }>;
2924
+ banUser: better_auth.StrictEndpoint<"/admin/ban-user", {
2925
+ method: "POST";
2926
+ body: better_auth.ZodObject<{
2927
+ userId: better_auth.ZodCoercedString<unknown>;
2928
+ banReason: better_auth.ZodOptional<better_auth.ZodString>;
2929
+ banExpiresIn: better_auth.ZodOptional<better_auth.ZodNumber>;
2930
+ }, zod_v4_core.$strip>;
2931
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2932
+ session: {
2933
+ user: better_auth_plugins.UserWithRole;
2934
+ session: {
2935
+ id: string;
2936
+ createdAt: Date;
2937
+ updatedAt: Date;
2938
+ userId: string;
2939
+ expiresAt: Date;
2940
+ token: string;
2941
+ ipAddress?: string | null | undefined;
2942
+ userAgent?: string | null | undefined;
2943
+ };
2944
+ };
2945
+ }>>[];
2946
+ metadata: {
2947
+ openapi: {
2948
+ operationId: string;
2949
+ summary: string;
2950
+ description: string;
2951
+ responses: {
2952
+ 200: {
2953
+ description: string;
2954
+ content: {
2955
+ "application/json": {
2956
+ schema: {
2957
+ type: "object";
2958
+ properties: {
2959
+ user: {
2960
+ $ref: string;
2961
+ };
2962
+ };
2963
+ };
2964
+ };
2965
+ };
2966
+ };
2967
+ };
2968
+ };
2969
+ };
2970
+ }, {
2971
+ user: better_auth_plugins.UserWithRole;
2972
+ }>;
2973
+ impersonateUser: better_auth.StrictEndpoint<"/admin/impersonate-user", {
2974
+ method: "POST";
2975
+ body: better_auth.ZodObject<{
2976
+ userId: better_auth.ZodCoercedString<unknown>;
2977
+ }, zod_v4_core.$strip>;
2978
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
2979
+ session: {
2980
+ user: better_auth_plugins.UserWithRole;
2981
+ session: {
2982
+ id: string;
2983
+ createdAt: Date;
2984
+ updatedAt: Date;
2985
+ userId: string;
2986
+ expiresAt: Date;
2987
+ token: string;
2988
+ ipAddress?: string | null | undefined;
2989
+ userAgent?: string | null | undefined;
2990
+ };
2991
+ };
2992
+ }>>[];
2993
+ metadata: {
2994
+ openapi: {
2995
+ operationId: string;
2996
+ summary: string;
2997
+ description: string;
2998
+ responses: {
2999
+ 200: {
3000
+ description: string;
3001
+ content: {
3002
+ "application/json": {
3003
+ schema: {
3004
+ type: "object";
3005
+ properties: {
3006
+ session: {
3007
+ $ref: string;
3008
+ };
3009
+ user: {
3010
+ $ref: string;
3011
+ };
3012
+ };
3013
+ };
3014
+ };
3015
+ };
3016
+ };
3017
+ };
3018
+ };
3019
+ };
3020
+ }, {
3021
+ session: {
3022
+ id: string;
3023
+ createdAt: Date;
3024
+ updatedAt: Date;
3025
+ userId: string;
3026
+ expiresAt: Date;
3027
+ token: string;
3028
+ ipAddress?: string | null | undefined;
3029
+ userAgent?: string | null | undefined;
3030
+ };
3031
+ user: better_auth_plugins.UserWithRole;
3032
+ }>;
3033
+ stopImpersonating: better_auth.StrictEndpoint<"/admin/stop-impersonating", {
3034
+ method: "POST";
3035
+ requireHeaders: true;
3036
+ }, {
3037
+ session: {
3038
+ id: string;
3039
+ createdAt: Date;
3040
+ updatedAt: Date;
3041
+ userId: string;
3042
+ expiresAt: Date;
3043
+ token: string;
3044
+ ipAddress?: string | null | undefined;
3045
+ userAgent?: string | null | undefined;
3046
+ } & Record<string, any>;
3047
+ user: {
3048
+ id: string;
3049
+ createdAt: Date;
3050
+ updatedAt: Date;
3051
+ email: string;
3052
+ emailVerified: boolean;
3053
+ name: string;
3054
+ image?: string | null | undefined;
3055
+ } & Record<string, any>;
3056
+ }>;
3057
+ revokeUserSession: better_auth.StrictEndpoint<"/admin/revoke-user-session", {
3058
+ method: "POST";
3059
+ body: better_auth.ZodObject<{
3060
+ sessionToken: better_auth.ZodString;
3061
+ }, zod_v4_core.$strip>;
3062
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
3063
+ session: {
3064
+ user: better_auth_plugins.UserWithRole;
3065
+ session: {
3066
+ id: string;
3067
+ createdAt: Date;
3068
+ updatedAt: Date;
3069
+ userId: string;
3070
+ expiresAt: Date;
3071
+ token: string;
3072
+ ipAddress?: string | null | undefined;
3073
+ userAgent?: string | null | undefined;
3074
+ };
3075
+ };
3076
+ }>>[];
3077
+ metadata: {
3078
+ openapi: {
3079
+ operationId: string;
3080
+ summary: string;
3081
+ description: string;
3082
+ responses: {
3083
+ 200: {
3084
+ description: string;
3085
+ content: {
3086
+ "application/json": {
3087
+ schema: {
3088
+ type: "object";
3089
+ properties: {
3090
+ success: {
3091
+ type: string;
3092
+ };
3093
+ };
3094
+ };
3095
+ };
3096
+ };
3097
+ };
3098
+ };
3099
+ };
3100
+ };
3101
+ }, {
3102
+ success: boolean;
3103
+ }>;
3104
+ revokeUserSessions: better_auth.StrictEndpoint<"/admin/revoke-user-sessions", {
3105
+ method: "POST";
3106
+ body: better_auth.ZodObject<{
3107
+ userId: better_auth.ZodCoercedString<unknown>;
3108
+ }, zod_v4_core.$strip>;
3109
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
3110
+ session: {
3111
+ user: better_auth_plugins.UserWithRole;
3112
+ session: {
3113
+ id: string;
3114
+ createdAt: Date;
3115
+ updatedAt: Date;
3116
+ userId: string;
3117
+ expiresAt: Date;
3118
+ token: string;
3119
+ ipAddress?: string | null | undefined;
3120
+ userAgent?: string | null | undefined;
3121
+ };
3122
+ };
3123
+ }>>[];
3124
+ metadata: {
3125
+ openapi: {
3126
+ operationId: string;
3127
+ summary: string;
3128
+ description: string;
3129
+ responses: {
3130
+ 200: {
3131
+ description: string;
3132
+ content: {
3133
+ "application/json": {
3134
+ schema: {
3135
+ type: "object";
3136
+ properties: {
3137
+ success: {
3138
+ type: string;
3139
+ };
3140
+ };
3141
+ };
3142
+ };
3143
+ };
3144
+ };
3145
+ };
3146
+ };
3147
+ };
3148
+ }, {
3149
+ success: boolean;
3150
+ }>;
3151
+ removeUser: better_auth.StrictEndpoint<"/admin/remove-user", {
3152
+ method: "POST";
3153
+ body: better_auth.ZodObject<{
3154
+ userId: better_auth.ZodCoercedString<unknown>;
3155
+ }, zod_v4_core.$strip>;
3156
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
3157
+ session: {
3158
+ user: better_auth_plugins.UserWithRole;
3159
+ session: {
3160
+ id: string;
3161
+ createdAt: Date;
3162
+ updatedAt: Date;
3163
+ userId: string;
3164
+ expiresAt: Date;
3165
+ token: string;
3166
+ ipAddress?: string | null | undefined;
3167
+ userAgent?: string | null | undefined;
3168
+ };
3169
+ };
3170
+ }>>[];
3171
+ metadata: {
3172
+ openapi: {
3173
+ operationId: string;
3174
+ summary: string;
3175
+ description: string;
3176
+ responses: {
3177
+ 200: {
3178
+ description: string;
3179
+ content: {
3180
+ "application/json": {
3181
+ schema: {
3182
+ type: "object";
3183
+ properties: {
3184
+ success: {
3185
+ type: string;
3186
+ };
3187
+ };
3188
+ };
3189
+ };
3190
+ };
3191
+ };
3192
+ };
3193
+ };
3194
+ };
3195
+ }, {
3196
+ success: boolean;
3197
+ }>;
3198
+ setUserPassword: better_auth.StrictEndpoint<"/admin/set-user-password", {
3199
+ method: "POST";
3200
+ body: better_auth.ZodObject<{
3201
+ newPassword: better_auth.ZodString;
3202
+ userId: better_auth.ZodCoercedString<unknown>;
3203
+ }, zod_v4_core.$strip>;
3204
+ use: better_auth.Middleware<better_auth.MiddlewareOptions, (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
3205
+ session: {
3206
+ user: better_auth_plugins.UserWithRole;
3207
+ session: {
3208
+ id: string;
3209
+ createdAt: Date;
3210
+ updatedAt: Date;
3211
+ userId: string;
3212
+ expiresAt: Date;
3213
+ token: string;
3214
+ ipAddress?: string | null | undefined;
3215
+ userAgent?: string | null | undefined;
3216
+ };
3217
+ };
3218
+ }>>[];
3219
+ metadata: {
3220
+ openapi: {
3221
+ operationId: string;
3222
+ summary: string;
3223
+ description: string;
3224
+ responses: {
3225
+ 200: {
3226
+ description: string;
3227
+ content: {
3228
+ "application/json": {
3229
+ schema: {
3230
+ type: "object";
3231
+ properties: {
3232
+ status: {
3233
+ type: string;
3234
+ };
3235
+ };
3236
+ };
3237
+ };
3238
+ };
3239
+ };
3240
+ };
3241
+ };
3242
+ };
3243
+ }, {
3244
+ status: boolean;
3245
+ }>;
3246
+ userHasPermission: better_auth.StrictEndpoint<"/admin/has-permission", {
3247
+ method: "POST";
3248
+ body: better_auth.ZodIntersection<better_auth.ZodObject<{
3249
+ userId: better_auth.ZodOptional<better_auth.ZodCoercedString<unknown>>;
3250
+ role: better_auth.ZodOptional<better_auth.ZodString>;
3251
+ }, zod_v4_core.$strip>, better_auth.ZodXor<readonly [better_auth.ZodObject<{
3252
+ permission: better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>>;
3253
+ }, zod_v4_core.$strip>, better_auth.ZodObject<{
3254
+ permissions: better_auth.ZodRecord<better_auth.ZodString, better_auth.ZodArray<better_auth.ZodString>>;
3255
+ }, zod_v4_core.$strip>]>>;
3256
+ metadata: {
3257
+ openapi: {
3258
+ description: string;
3259
+ requestBody: {
3260
+ content: {
3261
+ "application/json": {
3262
+ schema: {
3263
+ type: "object";
3264
+ properties: {
3265
+ permissions: {
3266
+ type: string;
3267
+ description: string;
3268
+ };
3269
+ };
3270
+ required: string[];
3271
+ };
3272
+ };
3273
+ };
3274
+ };
3275
+ responses: {
3276
+ "200": {
3277
+ description: string;
3278
+ content: {
3279
+ "application/json": {
3280
+ schema: {
3281
+ type: "object";
3282
+ properties: {
3283
+ error: {
3284
+ type: string;
3285
+ };
3286
+ success: {
3287
+ type: string;
3288
+ };
3289
+ };
3290
+ required: string[];
3291
+ };
3292
+ };
3293
+ };
3294
+ };
3295
+ };
3296
+ };
3297
+ $Infer: {
3298
+ body: {
3299
+ permissions: {
3300
+ readonly user?: ("create" | "list" | "set-role" | "ban" | "impersonate" | "impersonate-admins" | "delete" | "set-password" | "set-email" | "get" | "update")[] | undefined;
3301
+ readonly session?: ("list" | "delete" | "revoke")[] | undefined;
3302
+ };
3303
+ } & {
3304
+ userId?: string | undefined;
3305
+ role?: "megacorp_admin" | "customer_admin" | "member" | undefined;
3306
+ };
3307
+ };
3308
+ };
3309
+ }, {
3310
+ error: null;
3311
+ success: boolean;
3312
+ }>;
3313
+ };
3314
+ $ERROR_CODES: {
3315
+ USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: better_auth.RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
3316
+ FAILED_TO_CREATE_USER: better_auth.RawError<"FAILED_TO_CREATE_USER">;
3317
+ USER_ALREADY_EXISTS: better_auth.RawError<"USER_ALREADY_EXISTS">;
3318
+ YOU_CANNOT_BAN_YOURSELF: better_auth.RawError<"YOU_CANNOT_BAN_YOURSELF">;
3319
+ YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">;
3320
+ YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">;
3321
+ YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">;
3322
+ YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">;
3323
+ YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">;
3324
+ YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">;
3325
+ YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">;
3326
+ YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">;
3327
+ YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">;
3328
+ BANNED_USER: better_auth.RawError<"BANNED_USER">;
3329
+ YOU_ARE_NOT_ALLOWED_TO_GET_USER: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">;
3330
+ NO_DATA_TO_UPDATE: better_auth.RawError<"NO_DATA_TO_UPDATE">;
3331
+ YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">;
3332
+ YOU_CANNOT_REMOVE_YOURSELF: better_auth.RawError<"YOU_CANNOT_REMOVE_YOURSELF">;
3333
+ YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
3334
+ YOU_CANNOT_IMPERSONATE_ADMINS: better_auth.RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
3335
+ INVALID_ROLE_TYPE: better_auth.RawError<"INVALID_ROLE_TYPE">;
3336
+ YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: better_auth.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
3337
+ PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: better_auth.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
3338
+ };
3339
+ schema: {
3340
+ user: {
3341
+ fields: {
3342
+ role: {
3343
+ type: "string";
3344
+ required: false;
3345
+ input: false;
3346
+ };
3347
+ banned: {
3348
+ type: "boolean";
3349
+ defaultValue: false;
3350
+ required: false;
3351
+ input: false;
3352
+ };
3353
+ banReason: {
3354
+ type: "string";
3355
+ required: false;
3356
+ input: false;
3357
+ };
3358
+ banExpires: {
3359
+ type: "date";
3360
+ required: false;
3361
+ input: false;
3362
+ };
3363
+ };
3364
+ };
3365
+ session: {
3366
+ fields: {
3367
+ impersonatedBy: {
3368
+ type: "string";
3369
+ required: false;
3370
+ input: false;
3371
+ };
3372
+ };
3373
+ };
3374
+ };
3375
+ options: NoInfer<{
3376
+ defaultRole: "megacorp_admin" | "customer_admin" | "member";
3377
+ ac: {
3378
+ newRole<const TRoleStatements extends better_auth_plugins.Statements>(statements: better_auth_plugins.RoleInput<{
3379
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
3380
+ readonly session: readonly ["list", "revoke", "delete"];
3381
+ }, TRoleStatements>): better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<TRoleStatements>, {
3382
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
3383
+ readonly session: readonly ["list", "revoke", "delete"];
3384
+ }>;
3385
+ statements: {
3386
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
3387
+ readonly session: readonly ["list", "revoke", "delete"];
3388
+ };
3389
+ };
3390
+ roles: {
3391
+ megacorp_admin: better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<{
3392
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
3393
+ readonly session: readonly ["list", "revoke", "delete"];
3394
+ }>, {
3395
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
3396
+ readonly session: readonly ["list", "revoke", "delete"];
3397
+ }>;
3398
+ customer_admin: better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<{
3399
+ readonly user: readonly [];
3400
+ readonly session: readonly [];
3401
+ }>, {
3402
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
3403
+ readonly session: readonly ["list", "revoke", "delete"];
3404
+ }>;
3405
+ member: better_auth_plugins.Role<better_auth_plugins.ExactRoleStatements<{
3406
+ readonly user: readonly [];
3407
+ readonly session: readonly [];
3408
+ }>, {
3409
+ readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
3410
+ readonly session: readonly ["list", "revoke", "delete"];
3411
+ }>;
3412
+ };
3413
+ adminRoles: string[];
3414
+ impersonationSessionDuration: number;
3415
+ }>;
3416
+ }];
3417
+ }>;
3418
+ declare function createMegacorpAuth(opts: CreateMegacorpAuthOptions): MegacorpAuth;
3419
+
3420
+ export { AUTH_EVENTS, AppInsightsExporter, type AuthConfig, AuthConfigError, type AuthEvent, type AuthEventName, type CreateMegacorpAuthOptions, DEFAULT_ROLE, type EdgeMode, type EventBase, type EventInput, type EventSink, HttpError, type InviteMail, type IpRequestLike, type Mailer, type MegacorpAuth, type MegacorpBetterAuth, type OtpMail, REQUIRED_COLUMNS, ROLES, type Role, SchemaError, type SessionInfo, type SessionUser, TABLES, acsMailer, assertNoVendorTelemetry, assertSchema, authEventSchema, azureCredential, buildBetterAuthOptions, buildEvent, canInvite, consoleMailer, createMegacorpAuth, emailDomain, envSchema, findMissingSchema, getClientIp, hasRole, hashUserId, ipAddressHeaders, ipInCidr, isCloudflareIp, isRole, loadConfig, parseConnectionString, parseRoles, trustProxySetting };