@objectstack/spec 0.1.2 → 0.3.0

package/dist/system/auth.zod.d.ts

@@ -0,0 +1,3319 @@
+import { z } from 'zod';
+/**
+ * Authentication Protocol
+ *
+ * Defines the standard authentication specification for the ObjectStack ecosystem.
+ * This protocol supports multiple authentication strategies, session management,
+ * and comprehensive security features.
+ *
+ * This is a framework-agnostic specification that can be implemented with any
+ * authentication library (better-auth, Auth.js, Passport, etc.)
+ */
+/**
+ * Supported authentication strategies
+ */
+export declare const AuthStrategy: z.ZodEnum<["email_password", "magic_link", "oauth", "passkey", "otp", "anonymous"]>;
+export type AuthStrategy = z.infer<typeof AuthStrategy>;
+/**
+ * OAuth Provider Configuration
+ * Supports popular OAuth2 providers
+ */
+export declare const OAuthProviderSchema: z.ZodObject<{
+    provider: z.ZodEnum<["google", "github", "facebook", "twitter", "linkedin", "microsoft", "apple", "discord", "gitlab", "custom"]>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    redirectUri: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    displayName: z.ZodOptional<z.ZodString>;
+    icon: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+    clientId: string;
+    clientSecret: string;
+    icon?: string | undefined;
+    scopes?: string[] | undefined;
+    redirectUri?: string | undefined;
+    displayName?: string | undefined;
+}, {
+    provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+    clientId: string;
+    clientSecret: string;
+    icon?: string | undefined;
+    enabled?: boolean | undefined;
+    scopes?: string[] | undefined;
+    redirectUri?: string | undefined;
+    displayName?: string | undefined;
+}>;
+export type OAuthProvider = z.infer<typeof OAuthProviderSchema>;
+/**
+ * Email & Password Strategy Configuration
+ */
+export declare const EmailPasswordConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    requireEmailVerification: z.ZodDefault<z.ZodBoolean>;
+    minPasswordLength: z.ZodDefault<z.ZodNumber>;
+    requirePasswordComplexity: z.ZodDefault<z.ZodBoolean>;
+    allowPasswordReset: z.ZodDefault<z.ZodBoolean>;
+    passwordResetExpiry: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    requireEmailVerification: boolean;
+    minPasswordLength: number;
+    requirePasswordComplexity: boolean;
+    allowPasswordReset: boolean;
+    passwordResetExpiry: number;
+}, {
+    enabled?: boolean | undefined;
+    requireEmailVerification?: boolean | undefined;
+    minPasswordLength?: number | undefined;
+    requirePasswordComplexity?: boolean | undefined;
+    allowPasswordReset?: boolean | undefined;
+    passwordResetExpiry?: number | undefined;
+}>;
+export type EmailPasswordConfig = z.infer<typeof EmailPasswordConfigSchema>;
+/**
+ * Magic Link Strategy Configuration
+ */
+export declare const MagicLinkConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    expiryTime: z.ZodDefault<z.ZodNumber>;
+    sendEmail: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+        to: z.ZodString;
+        link: z.ZodString;
+        token: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        token: string;
+        to: string;
+        link: string;
+    }, {
+        token: string;
+        to: string;
+        link: string;
+    }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    expiryTime: number;
+    sendEmail?: ((args_0: {
+        token: string;
+        to: string;
+        link: string;
+    }, ...args: unknown[]) => Promise<void>) | undefined;
+}, {
+    enabled?: boolean | undefined;
+    expiryTime?: number | undefined;
+    sendEmail?: ((args_0: {
+        token: string;
+        to: string;
+        link: string;
+    }, ...args: unknown[]) => Promise<void>) | undefined;
+}>;
+export type MagicLinkConfig = z.infer<typeof MagicLinkConfigSchema>;
+/**
+ * Passkey (WebAuthn) Strategy Configuration
+ */
+export declare const PasskeyConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    rpName: z.ZodString;
+    rpId: z.ZodOptional<z.ZodString>;
+    allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    userVerification: z.ZodDefault<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+    attestation: z.ZodDefault<z.ZodEnum<["none", "indirect", "direct", "enterprise"]>>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    rpName: string;
+    userVerification: "required" | "preferred" | "discouraged";
+    attestation: "none" | "indirect" | "direct" | "enterprise";
+    rpId?: string | undefined;
+    allowedOrigins?: string[] | undefined;
+}, {
+    rpName: string;
+    enabled?: boolean | undefined;
+    rpId?: string | undefined;
+    allowedOrigins?: string[] | undefined;
+    userVerification?: "required" | "preferred" | "discouraged" | undefined;
+    attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
+}>;
+export type PasskeyConfig = z.infer<typeof PasskeyConfigSchema>;
+/**
+ * Session Configuration
+ */
+export declare const SessionConfigSchema: z.ZodObject<{
+    expiresIn: z.ZodDefault<z.ZodNumber>;
+    updateAge: z.ZodDefault<z.ZodNumber>;
+    cookieName: z.ZodDefault<z.ZodString>;
+    cookieSecure: z.ZodDefault<z.ZodBoolean>;
+    cookieSameSite: z.ZodDefault<z.ZodEnum<["strict", "lax", "none"]>>;
+    cookieDomain: z.ZodOptional<z.ZodString>;
+    cookiePath: z.ZodDefault<z.ZodString>;
+    cookieHttpOnly: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    expiresIn: number;
+    updateAge: number;
+    cookieName: string;
+    cookieSecure: boolean;
+    cookieSameSite: "strict" | "none" | "lax";
+    cookiePath: string;
+    cookieHttpOnly: boolean;
+    cookieDomain?: string | undefined;
+}, {
+    expiresIn?: number | undefined;
+    updateAge?: number | undefined;
+    cookieName?: string | undefined;
+    cookieSecure?: boolean | undefined;
+    cookieSameSite?: "strict" | "none" | "lax" | undefined;
+    cookieDomain?: string | undefined;
+    cookiePath?: string | undefined;
+    cookieHttpOnly?: boolean | undefined;
+}>;
+export type SessionConfig = z.infer<typeof SessionConfigSchema>;
+/**
+ * Rate Limiting Configuration
+ */
+export declare const RateLimitConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    maxAttempts: z.ZodDefault<z.ZodNumber>;
+    windowMs: z.ZodDefault<z.ZodNumber>;
+    blockDuration: z.ZodDefault<z.ZodNumber>;
+    skipSuccessfulRequests: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    windowMs: number;
+    maxAttempts: number;
+    blockDuration: number;
+    skipSuccessfulRequests: boolean;
+}, {
+    enabled?: boolean | undefined;
+    windowMs?: number | undefined;
+    maxAttempts?: number | undefined;
+    blockDuration?: number | undefined;
+    skipSuccessfulRequests?: boolean | undefined;
+}>;
+export type RateLimitConfig = z.infer<typeof RateLimitConfigSchema>;
+/**
+ * CSRF Protection Configuration
+ */
+export declare const CSRFConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    tokenLength: z.ZodDefault<z.ZodNumber>;
+    cookieName: z.ZodDefault<z.ZodString>;
+    headerName: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    cookieName: string;
+    tokenLength: number;
+    headerName: string;
+}, {
+    enabled?: boolean | undefined;
+    cookieName?: string | undefined;
+    tokenLength?: number | undefined;
+    headerName?: string | undefined;
+}>;
+export type CSRFConfig = z.infer<typeof CSRFConfigSchema>;
+/**
+ * Account Linking Configuration
+ * Allows linking multiple auth methods to a single user account
+ */
+export declare const AccountLinkingConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    autoLink: z.ZodDefault<z.ZodBoolean>;
+    requireVerification: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    autoLink: boolean;
+    requireVerification: boolean;
+}, {
+    enabled?: boolean | undefined;
+    autoLink?: boolean | undefined;
+    requireVerification?: boolean | undefined;
+}>;
+export type AccountLinkingConfig = z.infer<typeof AccountLinkingConfigSchema>;
+/**
+ * Two-Factor Authentication (2FA) Configuration
+ */
+export declare const TwoFactorConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    issuer: z.ZodOptional<z.ZodString>;
+    qrCodeSize: z.ZodDefault<z.ZodNumber>;
+    backupCodes: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        count: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        count: number;
+        enabled: boolean;
+    }, {
+        count?: number | undefined;
+        enabled?: boolean | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    qrCodeSize: number;
+    issuer?: string | undefined;
+    backupCodes?: {
+        count: number;
+        enabled: boolean;
+    } | undefined;
+}, {
+    enabled?: boolean | undefined;
+    issuer?: string | undefined;
+    qrCodeSize?: number | undefined;
+    backupCodes?: {
+        count?: number | undefined;
+        enabled?: boolean | undefined;
+    } | undefined;
+}>;
+export type TwoFactorConfig = z.infer<typeof TwoFactorConfigSchema>;
+/**
+ * OIDC / OAuth2 Enterprise Configuration
+ * OpenID Connect configuration for enterprise SSO
+ */
+export declare const OIDCConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    issuer: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    displayName: z.ZodOptional<z.ZodString>;
+    icon: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    clientId: string;
+    clientSecret: string;
+    scopes: string[];
+    issuer: string;
+    icon?: string | undefined;
+    displayName?: string | undefined;
+    attributeMapping?: Record<string, string> | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    issuer: string;
+    icon?: string | undefined;
+    enabled?: boolean | undefined;
+    scopes?: string[] | undefined;
+    displayName?: string | undefined;
+    attributeMapping?: Record<string, string> | undefined;
+}>;
+export type OIDCConfig = z.infer<typeof OIDCConfigSchema>;
+/**
+ * SAML 2.0 Enterprise Configuration
+ * SAML configuration for legacy enterprise SSO
+ */
+export declare const SAMLConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    entryPoint: z.ZodString;
+    cert: z.ZodString;
+    issuer: z.ZodString;
+    signatureAlgorithm: z.ZodDefault<z.ZodEnum<["sha256", "sha512"]>>;
+    attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    displayName: z.ZodOptional<z.ZodString>;
+    icon: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    issuer: string;
+    entryPoint: string;
+    cert: string;
+    signatureAlgorithm: "sha256" | "sha512";
+    icon?: string | undefined;
+    displayName?: string | undefined;
+    attributeMapping?: Record<string, string> | undefined;
+}, {
+    issuer: string;
+    entryPoint: string;
+    cert: string;
+    icon?: string | undefined;
+    enabled?: boolean | undefined;
+    displayName?: string | undefined;
+    attributeMapping?: Record<string, string> | undefined;
+    signatureAlgorithm?: "sha256" | "sha512" | undefined;
+}>;
+export type SAMLConfig = z.infer<typeof SAMLConfigSchema>;
+/**
+ * LDAP / Active Directory Enterprise Configuration
+ * LDAP configuration for on-premise directory services
+ */
+export declare const LDAPConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    url: z.ZodString;
+    bindDn: z.ZodString;
+    bindCredentials: z.ZodString;
+    searchBase: z.ZodString;
+    searchFilter: z.ZodString;
+    groupSearchBase: z.ZodOptional<z.ZodString>;
+    displayName: z.ZodOptional<z.ZodString>;
+    icon: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    enabled: boolean;
+    bindDn: string;
+    bindCredentials: string;
+    searchBase: string;
+    searchFilter: string;
+    icon?: string | undefined;
+    displayName?: string | undefined;
+    groupSearchBase?: string | undefined;
+}, {
+    url: string;
+    bindDn: string;
+    bindCredentials: string;
+    searchBase: string;
+    searchFilter: string;
+    icon?: string | undefined;
+    enabled?: boolean | undefined;
+    displayName?: string | undefined;
+    groupSearchBase?: string | undefined;
+}>;
+export type LDAPConfig = z.infer<typeof LDAPConfigSchema>;
+/**
+ * Enterprise Authentication Configuration
+ * Combines SAML, LDAP, and OIDC configurations for enterprise SSO
+ */
+export declare const EnterpriseAuthConfigSchema: z.ZodObject<{
+    oidc: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        issuer: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        displayName: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        clientId: string;
+        clientSecret: string;
+        scopes: string[];
+        issuer: string;
+        icon?: string | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+    }, {
+        clientId: string;
+        clientSecret: string;
+        issuer: string;
+        icon?: string | undefined;
+        enabled?: boolean | undefined;
+        scopes?: string[] | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+    }>>;
+    saml: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        entryPoint: z.ZodString;
+        cert: z.ZodString;
+        issuer: z.ZodString;
+        signatureAlgorithm: z.ZodDefault<z.ZodEnum<["sha256", "sha512"]>>;
+        attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        displayName: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        issuer: string;
+        entryPoint: string;
+        cert: string;
+        signatureAlgorithm: "sha256" | "sha512";
+        icon?: string | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+    }, {
+        issuer: string;
+        entryPoint: string;
+        cert: string;
+        icon?: string | undefined;
+        enabled?: boolean | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+        signatureAlgorithm?: "sha256" | "sha512" | undefined;
+    }>>;
+    ldap: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        url: z.ZodString;
+        bindDn: z.ZodString;
+        bindCredentials: z.ZodString;
+        searchBase: z.ZodString;
+        searchFilter: z.ZodString;
+        groupSearchBase: z.ZodOptional<z.ZodString>;
+        displayName: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+        enabled: boolean;
+        bindDn: string;
+        bindCredentials: string;
+        searchBase: string;
+        searchFilter: string;
+        icon?: string | undefined;
+        displayName?: string | undefined;
+        groupSearchBase?: string | undefined;
+    }, {
+        url: string;
+        bindDn: string;
+        bindCredentials: string;
+        searchBase: string;
+        searchFilter: string;
+        icon?: string | undefined;
+        enabled?: boolean | undefined;
+        displayName?: string | undefined;
+        groupSearchBase?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    oidc?: {
+        enabled: boolean;
+        clientId: string;
+        clientSecret: string;
+        scopes: string[];
+        issuer: string;
+        icon?: string | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+    } | undefined;
+    saml?: {
+        enabled: boolean;
+        issuer: string;
+        entryPoint: string;
+        cert: string;
+        signatureAlgorithm: "sha256" | "sha512";
+        icon?: string | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+    } | undefined;
+    ldap?: {
+        url: string;
+        enabled: boolean;
+        bindDn: string;
+        bindCredentials: string;
+        searchBase: string;
+        searchFilter: string;
+        icon?: string | undefined;
+        displayName?: string | undefined;
+        groupSearchBase?: string | undefined;
+    } | undefined;
+}, {
+    oidc?: {
+        clientId: string;
+        clientSecret: string;
+        issuer: string;
+        icon?: string | undefined;
+        enabled?: boolean | undefined;
+        scopes?: string[] | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+    } | undefined;
+    saml?: {
+        issuer: string;
+        entryPoint: string;
+        cert: string;
+        icon?: string | undefined;
+        enabled?: boolean | undefined;
+        displayName?: string | undefined;
+        attributeMapping?: Record<string, string> | undefined;
+        signatureAlgorithm?: "sha256" | "sha512" | undefined;
+    } | undefined;
+    ldap?: {
+        url: string;
+        bindDn: string;
+        bindCredentials: string;
+        searchBase: string;
+        searchFilter: string;
+        icon?: string | undefined;
+        enabled?: boolean | undefined;
+        displayName?: string | undefined;
+        groupSearchBase?: string | undefined;
+    } | undefined;
+}>;
+export type EnterpriseAuthConfig = z.infer<typeof EnterpriseAuthConfigSchema>;
+/**
+ * User Field Mapping Configuration
+ * Maps authentication user fields to ObjectStack user object fields
+ */
+export declare const UserFieldMappingSchema: z.ZodObject<{
+    id: z.ZodDefault<z.ZodString>;
+    email: z.ZodDefault<z.ZodString>;
+    name: z.ZodDefault<z.ZodString>;
+    image: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+    emailVerified: z.ZodDefault<z.ZodString>;
+    createdAt: z.ZodDefault<z.ZodString>;
+    updatedAt: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    name: string;
+    id: string;
+    emailVerified: string;
+    createdAt: string;
+    updatedAt: string;
+    image?: string | undefined;
+}, {
+    email?: string | undefined;
+    image?: string | undefined;
+    name?: string | undefined;
+    id?: string | undefined;
+    emailVerified?: string | undefined;
+    createdAt?: string | undefined;
+    updatedAt?: string | undefined;
+}>;
+export type UserFieldMapping = z.infer<typeof UserFieldMappingSchema>;
+/**
+ * Database Adapter Configuration
+ */
+export declare const DatabaseAdapterSchema: z.ZodObject<{
+    type: z.ZodEnum<["prisma", "drizzle", "kysely", "custom"]>;
+    connectionString: z.ZodOptional<z.ZodString>;
+    tablePrefix: z.ZodDefault<z.ZodString>;
+    schema: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "custom" | "prisma" | "drizzle" | "kysely";
+    tablePrefix: string;
+    connectionString?: string | undefined;
+    schema?: string | undefined;
+}, {
+    type: "custom" | "prisma" | "drizzle" | "kysely";
+    connectionString?: string | undefined;
+    tablePrefix?: string | undefined;
+    schema?: string | undefined;
+}>;
+export type DatabaseAdapter = z.infer<typeof DatabaseAdapterSchema>;
+/**
+ * Default field mappings for better-auth compatibility
+ * These mappings bridge the gap between ObjectStack standard (Auth.js conventions)
+ * and better-auth's field naming conventions
+ */
+export declare const BETTER_AUTH_FIELD_MAPPINGS: {
+    readonly session: {
+        readonly sessionToken: "token";
+        readonly expires: "expiresAt";
+    };
+    readonly account: {
+        readonly providerAccountId: "accountId";
+        readonly provider: "providerId";
+    };
+};
+/**
+ * Database Field Mapping Configuration
+ * Maps ObjectStack standard field names to driver-specific field names.
+ *
+ * Useful when the underlying authentication driver (e.g., better-auth) uses
+ * different column names than the ObjectStack standard schemas (which follow
+ * Auth.js conventions).
+ *
+ * @example
+ * ```typescript
+ * mapping: {
+ *   session: {
+ *     sessionToken: 'token',      // better-auth uses 'token'
+ *     expires: 'expiresAt'        // better-auth uses 'expiresAt'
+ *   },
+ *   account: {
+ *     providerAccountId: 'accountId',  // better-auth uses 'accountId'
+ *     provider: 'providerId'           // better-auth uses 'providerId'
+ *   }
+ * }
+ * ```
+ */
+export declare const DatabaseMappingSchema: z.ZodObject<{
+    /**
+     * User model field mapping
+     * Maps ObjectStack User fields to driver fields
+     */
+    user: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Session model field mapping
+     * Maps ObjectStack Session fields to driver fields
+     */
+    session: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Account model field mapping
+     * Maps ObjectStack Account fields to driver fields
+     */
+    account: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /**
+     * Verification token field mapping
+     * Maps ObjectStack VerificationToken fields to driver fields
+     */
+    verificationToken: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    session: Record<string, string>;
+    account: Record<string, string>;
+    user?: Record<string, string> | undefined;
+    verificationToken?: Record<string, string> | undefined;
+}, {
+    user?: Record<string, string> | undefined;
+    session?: Record<string, string> | undefined;
+    account?: Record<string, string> | undefined;
+    verificationToken?: Record<string, string> | undefined;
+}>;
+export type DatabaseMapping = z.infer<typeof DatabaseMappingSchema>;
+/**
+ * Authentication Plugin Configuration
+ * Extends authentication with additional features
+ */
+export declare const AuthPluginConfigSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    enabled: boolean;
+    options?: Record<string, any> | undefined;
+}, {
+    name: string;
+    options?: Record<string, any> | undefined;
+    enabled?: boolean | undefined;
+}>;
+export type AuthPluginConfig = z.infer<typeof AuthPluginConfigSchema>;
+/**
+ * Complete Authentication Configuration Schema
+ *
+ * This is the main configuration object for authentication
+ * in an ObjectStack application.
+ *
+ * @example
+ * ```typescript
+ * const authConfig: AuthConfig = {
+ *   name: 'main_auth',
+ *   label: 'Main Authentication',
+ *   strategies: ['email_password', 'oauth'],
+ *   baseUrl: 'https://app.example.com',
+ *   secret: process.env.AUTH_SECRET,
+ *   driver: 'better-auth', // Optional, defaults to 'better-auth'
+ *   emailPassword: {
+ *     enabled: true,
+ *     minPasswordLength: 8,
+ *   },
+ *   oauth: {
+ *     providers: [{
+ *       provider: 'google',
+ *       clientId: process.env.GOOGLE_CLIENT_ID,
+ *       clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+ *     }],
+ *   },
+ *   session: {
+ *     expiresIn: 604800, // 7 days
+ *   },
+ * };
+ * ```
+ */
+export declare const AuthConfigSchema: z.ZodObject<{
+    /**
+     * Unique identifier for this auth configuration
+     * Must be in snake_case following ObjectStack conventions
+     */
+    name: z.ZodString;
+    /**
+     * Human-readable label
+     */
+    label: z.ZodString;
+    /**
+     * The underlying authentication implementation driver
+     * Default: 'better-auth' (the reference implementation)
+     * Can be: 'better-auth', 'auth-js', 'passport', or custom driver name
+     */
+    driver: z.ZodDefault<z.ZodString>;
+    /**
+     * Enabled authentication strategies
+     */
+    strategies: z.ZodArray<z.ZodEnum<["email_password", "magic_link", "oauth", "passkey", "otp", "anonymous"]>, "many">;
+    /**
+     * Base URL for the application
+     */
+    baseUrl: z.ZodString;
+    /**
+     * Secret key for signing tokens and cookies
+     * Should be loaded from environment variables
+     */
+    secret: z.ZodString;
+    /**
+     * Email & Password configuration
+     */
+    emailPassword: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        requireEmailVerification: z.ZodDefault<z.ZodBoolean>;
+        minPasswordLength: z.ZodDefault<z.ZodNumber>;
+        requirePasswordComplexity: z.ZodDefault<z.ZodBoolean>;
+        allowPasswordReset: z.ZodDefault<z.ZodBoolean>;
+        passwordResetExpiry: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        requireEmailVerification: boolean;
+        minPasswordLength: number;
+        requirePasswordComplexity: boolean;
+        allowPasswordReset: boolean;
+        passwordResetExpiry: number;
+    }, {
+        enabled?: boolean | undefined;
+        requireEmailVerification?: boolean | undefined;
+        minPasswordLength?: number | undefined;
+        requirePasswordComplexity?: boolean | undefined;
+        allowPasswordReset?: boolean | undefined;
+        passwordResetExpiry?: number | undefined;
+    }>>;
+    /**
+     * Magic Link configuration
+     */
+    magicLink: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        expiryTime: z.ZodDefault<z.ZodNumber>;
+        sendEmail: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+            to: z.ZodString;
+            link: z.ZodString;
+            token: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            token: string;
+            to: string;
+            link: string;
+        }, {
+            token: string;
+            to: string;
+            link: string;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        expiryTime: number;
+        sendEmail?: ((args_0: {
+            token: string;
+            to: string;
+            link: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        expiryTime?: number | undefined;
+        sendEmail?: ((args_0: {
+            token: string;
+            to: string;
+            link: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    }>>;
+    /**
+     * Passkey (WebAuthn) configuration
+     */
+    passkey: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        rpName: z.ZodString;
+        rpId: z.ZodOptional<z.ZodString>;
+        allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        userVerification: z.ZodDefault<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+        attestation: z.ZodDefault<z.ZodEnum<["none", "indirect", "direct", "enterprise"]>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        rpName: string;
+        userVerification: "required" | "preferred" | "discouraged";
+        attestation: "none" | "indirect" | "direct" | "enterprise";
+        rpId?: string | undefined;
+        allowedOrigins?: string[] | undefined;
+    }, {
+        rpName: string;
+        enabled?: boolean | undefined;
+        rpId?: string | undefined;
+        allowedOrigins?: string[] | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
+    }>>;
+    /**
+     * OAuth configuration
+     */
+    oauth: z.ZodOptional<z.ZodObject<{
+        providers: z.ZodArray<z.ZodObject<{
+            provider: z.ZodEnum<["google", "github", "facebook", "twitter", "linkedin", "microsoft", "apple", "discord", "gitlab", "custom"]>;
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            redirectUri: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            displayName: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+            clientId: string;
+            clientSecret: string;
+            icon?: string | undefined;
+            scopes?: string[] | undefined;
+            redirectUri?: string | undefined;
+            displayName?: string | undefined;
+        }, {
+            provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+            clientId: string;
+            clientSecret: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            scopes?: string[] | undefined;
+            redirectUri?: string | undefined;
+            displayName?: string | undefined;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        providers: {
+            enabled: boolean;
+            provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+            clientId: string;
+            clientSecret: string;
+            icon?: string | undefined;
+            scopes?: string[] | undefined;
+            redirectUri?: string | undefined;
+            displayName?: string | undefined;
+        }[];
+    }, {
+        providers: {
+            provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+            clientId: string;
+            clientSecret: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            scopes?: string[] | undefined;
+            redirectUri?: string | undefined;
+            displayName?: string | undefined;
+        }[];
+    }>>;
+    /**
+     * Session configuration
+     */
+    session: z.ZodDefault<z.ZodObject<{
+        expiresIn: z.ZodDefault<z.ZodNumber>;
+        updateAge: z.ZodDefault<z.ZodNumber>;
+        cookieName: z.ZodDefault<z.ZodString>;
+        cookieSecure: z.ZodDefault<z.ZodBoolean>;
+        cookieSameSite: z.ZodDefault<z.ZodEnum<["strict", "lax", "none"]>>;
+        cookieDomain: z.ZodOptional<z.ZodString>;
+        cookiePath: z.ZodDefault<z.ZodString>;
+        cookieHttpOnly: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        expiresIn: number;
+        updateAge: number;
+        cookieName: string;
+        cookieSecure: boolean;
+        cookieSameSite: "strict" | "none" | "lax";
+        cookiePath: string;
+        cookieHttpOnly: boolean;
+        cookieDomain?: string | undefined;
+    }, {
+        expiresIn?: number | undefined;
+        updateAge?: number | undefined;
+        cookieName?: string | undefined;
+        cookieSecure?: boolean | undefined;
+        cookieSameSite?: "strict" | "none" | "lax" | undefined;
+        cookieDomain?: string | undefined;
+        cookiePath?: string | undefined;
+        cookieHttpOnly?: boolean | undefined;
+    }>>;
+    /**
+     * Rate limiting configuration
+     */
+    rateLimit: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        windowMs: z.ZodDefault<z.ZodNumber>;
+        blockDuration: z.ZodDefault<z.ZodNumber>;
+        skipSuccessfulRequests: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        windowMs: number;
+        maxAttempts: number;
+        blockDuration: number;
+        skipSuccessfulRequests: boolean;
+    }, {
+        enabled?: boolean | undefined;
+        windowMs?: number | undefined;
+        maxAttempts?: number | undefined;
+        blockDuration?: number | undefined;
+        skipSuccessfulRequests?: boolean | undefined;
+    }>>;
+    /**
+     * CSRF protection configuration
+     */
+    csrf: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        tokenLength: z.ZodDefault<z.ZodNumber>;
+        cookieName: z.ZodDefault<z.ZodString>;
+        headerName: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        cookieName: string;
+        tokenLength: number;
+        headerName: string;
+    }, {
+        enabled?: boolean | undefined;
+        cookieName?: string | undefined;
+        tokenLength?: number | undefined;
+        headerName?: string | undefined;
+    }>>;
+    /**
+     * Account linking configuration
+     */
+    accountLinking: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        autoLink: z.ZodDefault<z.ZodBoolean>;
+        requireVerification: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        autoLink: boolean;
+        requireVerification: boolean;
+    }, {
+        enabled?: boolean | undefined;
+        autoLink?: boolean | undefined;
+        requireVerification?: boolean | undefined;
+    }>>;
+    /**
+     * Two-factor authentication configuration
+     */
+    twoFactor: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        issuer: z.ZodOptional<z.ZodString>;
+        qrCodeSize: z.ZodDefault<z.ZodNumber>;
+        backupCodes: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            count: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            count: number;
+            enabled: boolean;
+        }, {
+            count?: number | undefined;
+            enabled?: boolean | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        qrCodeSize: number;
+        issuer?: string | undefined;
+        backupCodes?: {
+            count: number;
+            enabled: boolean;
+        } | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        issuer?: string | undefined;
+        qrCodeSize?: number | undefined;
+        backupCodes?: {
+            count?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * Organization (Multi-tenant) configuration
+     * Enables B2B SaaS scenarios where users belong to multiple teams/workspaces
+     */
+    organization: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        allowUserToCreateOrg: z.ZodDefault<z.ZodBoolean>;
+        defaultRole: z.ZodDefault<z.ZodString>;
+        creatorRole: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        allowUserToCreateOrg: boolean;
+        defaultRole: string;
+        creatorRole: string;
+    }, {
+        enabled?: boolean | undefined;
+        allowUserToCreateOrg?: boolean | undefined;
+        defaultRole?: string | undefined;
+        creatorRole?: string | undefined;
+    }>>;
+    /**
+     * Enterprise authentication configuration (SAML, LDAP, OIDC)
+     */
+    enterprise: z.ZodOptional<z.ZodObject<{
+        oidc: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            issuer: z.ZodString;
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+            scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            displayName: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            clientId: string;
+            clientSecret: string;
+            scopes: string[];
+            issuer: string;
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        }, {
+            clientId: string;
+            clientSecret: string;
+            issuer: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            scopes?: string[] | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        }>>;
+        saml: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            entryPoint: z.ZodString;
+            cert: z.ZodString;
+            issuer: z.ZodString;
+            signatureAlgorithm: z.ZodDefault<z.ZodEnum<["sha256", "sha512"]>>;
+            attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            displayName: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            issuer: string;
+            entryPoint: string;
+            cert: string;
+            signatureAlgorithm: "sha256" | "sha512";
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        }, {
+            issuer: string;
+            entryPoint: string;
+            cert: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+            signatureAlgorithm?: "sha256" | "sha512" | undefined;
+        }>>;
+        ldap: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            url: z.ZodString;
+            bindDn: z.ZodString;
+            bindCredentials: z.ZodString;
+            searchBase: z.ZodString;
+            searchFilter: z.ZodString;
+            groupSearchBase: z.ZodOptional<z.ZodString>;
+            displayName: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            url: string;
+            enabled: boolean;
+            bindDn: string;
+            bindCredentials: string;
+            searchBase: string;
+            searchFilter: string;
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            groupSearchBase?: string | undefined;
+        }, {
+            url: string;
+            bindDn: string;
+            bindCredentials: string;
+            searchBase: string;
+            searchFilter: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            displayName?: string | undefined;
+            groupSearchBase?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        oidc?: {
+            enabled: boolean;
+            clientId: string;
+            clientSecret: string;
+            scopes: string[];
+            issuer: string;
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        } | undefined;
+        saml?: {
+            enabled: boolean;
+            issuer: string;
+            entryPoint: string;
+            cert: string;
+            signatureAlgorithm: "sha256" | "sha512";
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        } | undefined;
+        ldap?: {
+            url: string;
+            enabled: boolean;
+            bindDn: string;
+            bindCredentials: string;
+            searchBase: string;
+            searchFilter: string;
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            groupSearchBase?: string | undefined;
+        } | undefined;
+    }, {
+        oidc?: {
+            clientId: string;
+            clientSecret: string;
+            issuer: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            scopes?: string[] | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        } | undefined;
+        saml?: {
+            issuer: string;
+            entryPoint: string;
+            cert: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+            signatureAlgorithm?: "sha256" | "sha512" | undefined;
+        } | undefined;
+        ldap?: {
+            url: string;
+            bindDn: string;
+            bindCredentials: string;
+            searchBase: string;
+            searchFilter: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            displayName?: string | undefined;
+            groupSearchBase?: string | undefined;
+        } | undefined;
+    }>>;
+    /**
+     * User field mapping
+     */
+    userFieldMapping: z.ZodDefault<z.ZodObject<{
+        id: z.ZodDefault<z.ZodString>;
+        email: z.ZodDefault<z.ZodString>;
+        name: z.ZodDefault<z.ZodString>;
+        image: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+        emailVerified: z.ZodDefault<z.ZodString>;
+        createdAt: z.ZodDefault<z.ZodString>;
+        updatedAt: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        email: string;
+        name: string;
+        id: string;
+        emailVerified: string;
+        createdAt: string;
+        updatedAt: string;
+        image?: string | undefined;
+    }, {
+        email?: string | undefined;
+        image?: string | undefined;
+        name?: string | undefined;
+        id?: string | undefined;
+        emailVerified?: string | undefined;
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+    }>>;
+    /**
+     * Database adapter configuration
+     */
+    database: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<["prisma", "drizzle", "kysely", "custom"]>;
+        connectionString: z.ZodOptional<z.ZodString>;
+        tablePrefix: z.ZodDefault<z.ZodString>;
+        schema: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "custom" | "prisma" | "drizzle" | "kysely";
+        tablePrefix: string;
+        connectionString?: string | undefined;
+        schema?: string | undefined;
+    }, {
+        type: "custom" | "prisma" | "drizzle" | "kysely";
+        connectionString?: string | undefined;
+        tablePrefix?: string | undefined;
+        schema?: string | undefined;
+    }>>;
+    /**
+     * Database field mapping configuration
+     * Maps ObjectStack standard field names to driver-specific field names.
+     *
+     * This is distinct from the database adapter configuration and provides
+     * instructions for the driver to map our standard schema fields to the
+     * underlying engine's fields (e.g., better-auth uses 'token' instead of 'sessionToken').
+     */
+    mapping: z.ZodOptional<z.ZodObject<{
+        /**
+         * User model field mapping
+         * Maps ObjectStack User fields to driver fields
+         */
+        user: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /**
+         * Session model field mapping
+         * Maps ObjectStack Session fields to driver fields
+         */
+        session: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /**
+         * Account model field mapping
+         * Maps ObjectStack Account fields to driver fields
+         */
+        account: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /**
+         * Verification token field mapping
+         * Maps ObjectStack VerificationToken fields to driver fields
+         */
+        verificationToken: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        session: Record<string, string>;
+        account: Record<string, string>;
+        user?: Record<string, string> | undefined;
+        verificationToken?: Record<string, string> | undefined;
+    }, {
+        user?: Record<string, string> | undefined;
+        session?: Record<string, string> | undefined;
+        account?: Record<string, string> | undefined;
+        verificationToken?: Record<string, string> | undefined;
+    }>>;
+    /**
+     * Additional authentication plugins
+     */
+    plugins: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        enabled: boolean;
+        options?: Record<string, any> | undefined;
+    }, {
+        name: string;
+        options?: Record<string, any> | undefined;
+        enabled?: boolean | undefined;
+    }>, "many">>;
+    /**
+     * Custom hooks for authentication events
+     */
+    hooks: z.ZodOptional<z.ZodObject<{
+        beforeSignIn: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+            email: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            email: string;
+        }, {
+            email: string;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        afterSignIn: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+            user: z.ZodAny;
+            session: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            user?: any;
+            session?: any;
+        }, {
+            user?: any;
+            session?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        beforeSignUp: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+            email: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            email: string;
+            name?: string | undefined;
+        }, {
+            email: string;
+            name?: string | undefined;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        afterSignUp: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+            user: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            user?: any;
+        }, {
+            user?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        beforeSignOut: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+            sessionId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            sessionId: string;
+        }, {
+            sessionId: string;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        afterSignOut: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+            sessionId: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            sessionId: string;
+        }, {
+            sessionId: string;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+    }, "strip", z.ZodTypeAny, {
+        beforeSignIn?: ((args_0: {
+            email: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignIn?: ((args_0: {
+            user?: any;
+            session?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignUp?: ((args_0: {
+            email: string;
+            name?: string | undefined;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignUp?: ((args_0: {
+            user?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    }, {
+        beforeSignIn?: ((args_0: {
+            email: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignIn?: ((args_0: {
+            user?: any;
+            session?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignUp?: ((args_0: {
+            email: string;
+            name?: string | undefined;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignUp?: ((args_0: {
+            user?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    }>>;
+    /**
+     * Advanced security settings
+     */
+    security: z.ZodOptional<z.ZodObject<{
+        allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        trustProxy: z.ZodDefault<z.ZodBoolean>;
+        ipRateLimiting: z.ZodDefault<z.ZodBoolean>;
+        sessionFingerprinting: z.ZodDefault<z.ZodBoolean>;
+        maxSessions: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        trustProxy: boolean;
+        ipRateLimiting: boolean;
+        sessionFingerprinting: boolean;
+        maxSessions: number;
+        allowedOrigins?: string[] | undefined;
+    }, {
+        allowedOrigins?: string[] | undefined;
+        trustProxy?: boolean | undefined;
+        ipRateLimiting?: boolean | undefined;
+        sessionFingerprinting?: boolean | undefined;
+        maxSessions?: number | undefined;
+    }>>;
+    /**
+     * Email configuration for transactional emails
+     */
+    email: z.ZodOptional<z.ZodObject<{
+        from: z.ZodString;
+        fromName: z.ZodOptional<z.ZodString>;
+        provider: z.ZodEnum<["smtp", "sendgrid", "mailgun", "ses", "resend", "custom"]>;
+        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+    }, "strip", z.ZodTypeAny, {
+        provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+        from: string;
+        config?: Record<string, any> | undefined;
+        fromName?: string | undefined;
+    }, {
+        provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+        from: string;
+        config?: Record<string, any> | undefined;
+        fromName?: string | undefined;
+    }>>;
+    /**
+     * UI customization options
+     */
+    ui: z.ZodOptional<z.ZodObject<{
+        brandName: z.ZodOptional<z.ZodString>;
+        logo: z.ZodOptional<z.ZodString>;
+        primaryColor: z.ZodOptional<z.ZodString>;
+        customCss: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        primaryColor?: string | undefined;
+        logo?: string | undefined;
+        brandName?: string | undefined;
+        customCss?: string | undefined;
+    }, {
+        primaryColor?: string | undefined;
+        logo?: string | undefined;
+        brandName?: string | undefined;
+        customCss?: string | undefined;
+    }>>;
+    /**
+     * Whether this auth provider is active
+     */
+    active: z.ZodDefault<z.ZodBoolean>;
+    /**
+     * Whether to allow new user registration
+     */
+    allowRegistration: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    label: string;
+    name: string;
+    active: boolean;
+    driver: string;
+    secret: string;
+    rateLimit: {
+        enabled: boolean;
+        windowMs: number;
+        maxAttempts: number;
+        blockDuration: number;
+        skipSuccessfulRequests: boolean;
+    };
+    session: {
+        expiresIn: number;
+        updateAge: number;
+        cookieName: string;
+        cookieSecure: boolean;
+        cookieSameSite: "strict" | "none" | "lax";
+        cookiePath: string;
+        cookieHttpOnly: boolean;
+        cookieDomain?: string | undefined;
+    };
+    strategies: ("oauth" | "email_password" | "magic_link" | "passkey" | "otp" | "anonymous")[];
+    baseUrl: string;
+    csrf: {
+        enabled: boolean;
+        cookieName: string;
+        tokenLength: number;
+        headerName: string;
+    };
+    accountLinking: {
+        enabled: boolean;
+        autoLink: boolean;
+        requireVerification: boolean;
+    };
+    userFieldMapping: {
+        email: string;
+        name: string;
+        id: string;
+        emailVerified: string;
+        createdAt: string;
+        updatedAt: string;
+        image?: string | undefined;
+    };
+    plugins: {
+        name: string;
+        enabled: boolean;
+        options?: Record<string, any> | undefined;
+    }[];
+    allowRegistration: boolean;
+    email?: {
+        provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+        from: string;
+        config?: Record<string, any> | undefined;
+        fromName?: string | undefined;
+    } | undefined;
+    oauth?: {
+        providers: {
+            enabled: boolean;
+            provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+            clientId: string;
+            clientSecret: string;
+            icon?: string | undefined;
+            scopes?: string[] | undefined;
+            redirectUri?: string | undefined;
+            displayName?: string | undefined;
+        }[];
+    } | undefined;
+    passkey?: {
+        enabled: boolean;
+        rpName: string;
+        userVerification: "required" | "preferred" | "discouraged";
+        attestation: "none" | "indirect" | "direct" | "enterprise";
+        rpId?: string | undefined;
+        allowedOrigins?: string[] | undefined;
+    } | undefined;
+    enterprise?: {
+        oidc?: {
+            enabled: boolean;
+            clientId: string;
+            clientSecret: string;
+            scopes: string[];
+            issuer: string;
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        } | undefined;
+        saml?: {
+            enabled: boolean;
+            issuer: string;
+            entryPoint: string;
+            cert: string;
+            signatureAlgorithm: "sha256" | "sha512";
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        } | undefined;
+        ldap?: {
+            url: string;
+            enabled: boolean;
+            bindDn: string;
+            bindCredentials: string;
+            searchBase: string;
+            searchFilter: string;
+            icon?: string | undefined;
+            displayName?: string | undefined;
+            groupSearchBase?: string | undefined;
+        } | undefined;
+    } | undefined;
+    emailPassword?: {
+        enabled: boolean;
+        requireEmailVerification: boolean;
+        minPasswordLength: number;
+        requirePasswordComplexity: boolean;
+        allowPasswordReset: boolean;
+        passwordResetExpiry: number;
+    } | undefined;
+    magicLink?: {
+        enabled: boolean;
+        expiryTime: number;
+        sendEmail?: ((args_0: {
+            token: string;
+            to: string;
+            link: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    } | undefined;
+    twoFactor?: {
+        enabled: boolean;
+        qrCodeSize: number;
+        issuer?: string | undefined;
+        backupCodes?: {
+            count: number;
+            enabled: boolean;
+        } | undefined;
+    } | undefined;
+    organization?: {
+        enabled: boolean;
+        allowUserToCreateOrg: boolean;
+        defaultRole: string;
+        creatorRole: string;
+    } | undefined;
+    database?: {
+        type: "custom" | "prisma" | "drizzle" | "kysely";
+        tablePrefix: string;
+        connectionString?: string | undefined;
+        schema?: string | undefined;
+    } | undefined;
+    mapping?: {
+        session: Record<string, string>;
+        account: Record<string, string>;
+        user?: Record<string, string> | undefined;
+        verificationToken?: Record<string, string> | undefined;
+    } | undefined;
+    hooks?: {
+        beforeSignIn?: ((args_0: {
+            email: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignIn?: ((args_0: {
+            user?: any;
+            session?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignUp?: ((args_0: {
+            email: string;
+            name?: string | undefined;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignUp?: ((args_0: {
+            user?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    } | undefined;
+    security?: {
+        trustProxy: boolean;
+        ipRateLimiting: boolean;
+        sessionFingerprinting: boolean;
+        maxSessions: number;
+        allowedOrigins?: string[] | undefined;
+    } | undefined;
+    ui?: {
+        primaryColor?: string | undefined;
+        logo?: string | undefined;
+        brandName?: string | undefined;
+        customCss?: string | undefined;
+    } | undefined;
+}, {
+    label: string;
+    name: string;
+    secret: string;
+    strategies: ("oauth" | "email_password" | "magic_link" | "passkey" | "otp" | "anonymous")[];
+    baseUrl: string;
+    email?: {
+        provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+        from: string;
+        config?: Record<string, any> | undefined;
+        fromName?: string | undefined;
+    } | undefined;
+    active?: boolean | undefined;
+    driver?: string | undefined;
+    rateLimit?: {
+        enabled?: boolean | undefined;
+        windowMs?: number | undefined;
+        maxAttempts?: number | undefined;
+        blockDuration?: number | undefined;
+        skipSuccessfulRequests?: boolean | undefined;
+    } | undefined;
+    oauth?: {
+        providers: {
+            provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+            clientId: string;
+            clientSecret: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            scopes?: string[] | undefined;
+            redirectUri?: string | undefined;
+            displayName?: string | undefined;
+        }[];
+    } | undefined;
+    passkey?: {
+        rpName: string;
+        enabled?: boolean | undefined;
+        rpId?: string | undefined;
+        allowedOrigins?: string[] | undefined;
+        userVerification?: "required" | "preferred" | "discouraged" | undefined;
+        attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
+    } | undefined;
+    enterprise?: {
+        oidc?: {
+            clientId: string;
+            clientSecret: string;
+            issuer: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            scopes?: string[] | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+        } | undefined;
+        saml?: {
+            issuer: string;
+            entryPoint: string;
+            cert: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            displayName?: string | undefined;
+            attributeMapping?: Record<string, string> | undefined;
+            signatureAlgorithm?: "sha256" | "sha512" | undefined;
+        } | undefined;
+        ldap?: {
+            url: string;
+            bindDn: string;
+            bindCredentials: string;
+            searchBase: string;
+            searchFilter: string;
+            icon?: string | undefined;
+            enabled?: boolean | undefined;
+            displayName?: string | undefined;
+            groupSearchBase?: string | undefined;
+        } | undefined;
+    } | undefined;
+    session?: {
+        expiresIn?: number | undefined;
+        updateAge?: number | undefined;
+        cookieName?: string | undefined;
+        cookieSecure?: boolean | undefined;
+        cookieSameSite?: "strict" | "none" | "lax" | undefined;
+        cookieDomain?: string | undefined;
+        cookiePath?: string | undefined;
+        cookieHttpOnly?: boolean | undefined;
+    } | undefined;
+    emailPassword?: {
+        enabled?: boolean | undefined;
+        requireEmailVerification?: boolean | undefined;
+        minPasswordLength?: number | undefined;
+        requirePasswordComplexity?: boolean | undefined;
+        allowPasswordReset?: boolean | undefined;
+        passwordResetExpiry?: number | undefined;
+    } | undefined;
+    magicLink?: {
+        enabled?: boolean | undefined;
+        expiryTime?: number | undefined;
+        sendEmail?: ((args_0: {
+            token: string;
+            to: string;
+            link: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    } | undefined;
+    csrf?: {
+        enabled?: boolean | undefined;
+        cookieName?: string | undefined;
+        tokenLength?: number | undefined;
+        headerName?: string | undefined;
+    } | undefined;
+    accountLinking?: {
+        enabled?: boolean | undefined;
+        autoLink?: boolean | undefined;
+        requireVerification?: boolean | undefined;
+    } | undefined;
+    twoFactor?: {
+        enabled?: boolean | undefined;
+        issuer?: string | undefined;
+        qrCodeSize?: number | undefined;
+        backupCodes?: {
+            count?: number | undefined;
+            enabled?: boolean | undefined;
+        } | undefined;
+    } | undefined;
+    organization?: {
+        enabled?: boolean | undefined;
+        allowUserToCreateOrg?: boolean | undefined;
+        defaultRole?: string | undefined;
+        creatorRole?: string | undefined;
+    } | undefined;
+    userFieldMapping?: {
+        email?: string | undefined;
+        image?: string | undefined;
+        name?: string | undefined;
+        id?: string | undefined;
+        emailVerified?: string | undefined;
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+    } | undefined;
+    database?: {
+        type: "custom" | "prisma" | "drizzle" | "kysely";
+        connectionString?: string | undefined;
+        tablePrefix?: string | undefined;
+        schema?: string | undefined;
+    } | undefined;
+    mapping?: {
+        user?: Record<string, string> | undefined;
+        session?: Record<string, string> | undefined;
+        account?: Record<string, string> | undefined;
+        verificationToken?: Record<string, string> | undefined;
+    } | undefined;
+    plugins?: {
+        name: string;
+        options?: Record<string, any> | undefined;
+        enabled?: boolean | undefined;
+    }[] | undefined;
+    hooks?: {
+        beforeSignIn?: ((args_0: {
+            email: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignIn?: ((args_0: {
+            user?: any;
+            session?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignUp?: ((args_0: {
+            email: string;
+            name?: string | undefined;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignUp?: ((args_0: {
+            user?: any;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        beforeSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+        afterSignOut?: ((args_0: {
+            sessionId: string;
+        }, ...args: unknown[]) => Promise<void>) | undefined;
+    } | undefined;
+    security?: {
+        allowedOrigins?: string[] | undefined;
+        trustProxy?: boolean | undefined;
+        ipRateLimiting?: boolean | undefined;
+        sessionFingerprinting?: boolean | undefined;
+        maxSessions?: number | undefined;
+    } | undefined;
+    ui?: {
+        primaryColor?: string | undefined;
+        logo?: string | undefined;
+        brandName?: string | undefined;
+        customCss?: string | undefined;
+    } | undefined;
+    allowRegistration?: boolean | undefined;
+}>;
+/**
+ * TypeScript type inferred from AuthConfigSchema
+ */
+export type AuthConfig = z.infer<typeof AuthConfigSchema>;
+/**
+ * Standard Authentication Provider Schema
+ * Wraps the configuration for use in the identity system
+ */
+export declare const StandardAuthProviderSchema: z.ZodObject<{
+    type: z.ZodLiteral<"standard_auth">;
+    config: z.ZodObject<{
+        /**
+         * Unique identifier for this auth configuration
+         * Must be in snake_case following ObjectStack conventions
+         */
+        name: z.ZodString;
+        /**
+         * Human-readable label
+         */
+        label: z.ZodString;
+        /**
+         * The underlying authentication implementation driver
+         * Default: 'better-auth' (the reference implementation)
+         * Can be: 'better-auth', 'auth-js', 'passport', or custom driver name
+         */
+        driver: z.ZodDefault<z.ZodString>;
+        /**
+         * Enabled authentication strategies
+         */
+        strategies: z.ZodArray<z.ZodEnum<["email_password", "magic_link", "oauth", "passkey", "otp", "anonymous"]>, "many">;
+        /**
+         * Base URL for the application
+         */
+        baseUrl: z.ZodString;
+        /**
+         * Secret key for signing tokens and cookies
+         * Should be loaded from environment variables
+         */
+        secret: z.ZodString;
+        /**
+         * Email & Password configuration
+         */
+        emailPassword: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            requireEmailVerification: z.ZodDefault<z.ZodBoolean>;
+            minPasswordLength: z.ZodDefault<z.ZodNumber>;
+            requirePasswordComplexity: z.ZodDefault<z.ZodBoolean>;
+            allowPasswordReset: z.ZodDefault<z.ZodBoolean>;
+            passwordResetExpiry: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            requireEmailVerification: boolean;
+            minPasswordLength: number;
+            requirePasswordComplexity: boolean;
+            allowPasswordReset: boolean;
+            passwordResetExpiry: number;
+        }, {
+            enabled?: boolean | undefined;
+            requireEmailVerification?: boolean | undefined;
+            minPasswordLength?: number | undefined;
+            requirePasswordComplexity?: boolean | undefined;
+            allowPasswordReset?: boolean | undefined;
+            passwordResetExpiry?: number | undefined;
+        }>>;
+        /**
+         * Magic Link configuration
+         */
+        magicLink: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            expiryTime: z.ZodDefault<z.ZodNumber>;
+            sendEmail: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+                to: z.ZodString;
+                link: z.ZodString;
+                token: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                token: string;
+                to: string;
+                link: string;
+            }, {
+                token: string;
+                to: string;
+                link: string;
+            }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            expiryTime: number;
+            sendEmail?: ((args_0: {
+                token: string;
+                to: string;
+                link: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            expiryTime?: number | undefined;
+            sendEmail?: ((args_0: {
+                token: string;
+                to: string;
+                link: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        }>>;
+        /**
+         * Passkey (WebAuthn) configuration
+         */
+        passkey: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            rpName: z.ZodString;
+            rpId: z.ZodOptional<z.ZodString>;
+            allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            userVerification: z.ZodDefault<z.ZodEnum<["required", "preferred", "discouraged"]>>;
+            attestation: z.ZodDefault<z.ZodEnum<["none", "indirect", "direct", "enterprise"]>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            rpName: string;
+            userVerification: "required" | "preferred" | "discouraged";
+            attestation: "none" | "indirect" | "direct" | "enterprise";
+            rpId?: string | undefined;
+            allowedOrigins?: string[] | undefined;
+        }, {
+            rpName: string;
+            enabled?: boolean | undefined;
+            rpId?: string | undefined;
+            allowedOrigins?: string[] | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
+        }>>;
+        /**
+         * OAuth configuration
+         */
+        oauth: z.ZodOptional<z.ZodObject<{
+            providers: z.ZodArray<z.ZodObject<{
+                provider: z.ZodEnum<["google", "github", "facebook", "twitter", "linkedin", "microsoft", "apple", "discord", "gitlab", "custom"]>;
+                clientId: z.ZodString;
+                clientSecret: z.ZodString;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                redirectUri: z.ZodOptional<z.ZodString>;
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                displayName: z.ZodOptional<z.ZodString>;
+                icon: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }, {
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }>, "many">;
+        }, "strip", z.ZodTypeAny, {
+            providers: {
+                enabled: boolean;
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }[];
+        }, {
+            providers: {
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }[];
+        }>>;
+        /**
+         * Session configuration
+         */
+        session: z.ZodDefault<z.ZodObject<{
+            expiresIn: z.ZodDefault<z.ZodNumber>;
+            updateAge: z.ZodDefault<z.ZodNumber>;
+            cookieName: z.ZodDefault<z.ZodString>;
+            cookieSecure: z.ZodDefault<z.ZodBoolean>;
+            cookieSameSite: z.ZodDefault<z.ZodEnum<["strict", "lax", "none"]>>;
+            cookieDomain: z.ZodOptional<z.ZodString>;
+            cookiePath: z.ZodDefault<z.ZodString>;
+            cookieHttpOnly: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            expiresIn: number;
+            updateAge: number;
+            cookieName: string;
+            cookieSecure: boolean;
+            cookieSameSite: "strict" | "none" | "lax";
+            cookiePath: string;
+            cookieHttpOnly: boolean;
+            cookieDomain?: string | undefined;
+        }, {
+            expiresIn?: number | undefined;
+            updateAge?: number | undefined;
+            cookieName?: string | undefined;
+            cookieSecure?: boolean | undefined;
+            cookieSameSite?: "strict" | "none" | "lax" | undefined;
+            cookieDomain?: string | undefined;
+            cookiePath?: string | undefined;
+            cookieHttpOnly?: boolean | undefined;
+        }>>;
+        /**
+         * Rate limiting configuration
+         */
+        rateLimit: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            maxAttempts: z.ZodDefault<z.ZodNumber>;
+            windowMs: z.ZodDefault<z.ZodNumber>;
+            blockDuration: z.ZodDefault<z.ZodNumber>;
+            skipSuccessfulRequests: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            windowMs: number;
+            maxAttempts: number;
+            blockDuration: number;
+            skipSuccessfulRequests: boolean;
+        }, {
+            enabled?: boolean | undefined;
+            windowMs?: number | undefined;
+            maxAttempts?: number | undefined;
+            blockDuration?: number | undefined;
+            skipSuccessfulRequests?: boolean | undefined;
+        }>>;
+        /**
+         * CSRF protection configuration
+         */
+        csrf: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            tokenLength: z.ZodDefault<z.ZodNumber>;
+            cookieName: z.ZodDefault<z.ZodString>;
+            headerName: z.ZodDefault<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            cookieName: string;
+            tokenLength: number;
+            headerName: string;
+        }, {
+            enabled?: boolean | undefined;
+            cookieName?: string | undefined;
+            tokenLength?: number | undefined;
+            headerName?: string | undefined;
+        }>>;
+        /**
+         * Account linking configuration
+         */
+        accountLinking: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            autoLink: z.ZodDefault<z.ZodBoolean>;
+            requireVerification: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            autoLink: boolean;
+            requireVerification: boolean;
+        }, {
+            enabled?: boolean | undefined;
+            autoLink?: boolean | undefined;
+            requireVerification?: boolean | undefined;
+        }>>;
+        /**
+         * Two-factor authentication configuration
+         */
+        twoFactor: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            issuer: z.ZodOptional<z.ZodString>;
+            qrCodeSize: z.ZodDefault<z.ZodNumber>;
+            backupCodes: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                count: z.ZodDefault<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                count: number;
+                enabled: boolean;
+            }, {
+                count?: number | undefined;
+                enabled?: boolean | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            qrCodeSize: number;
+            issuer?: string | undefined;
+            backupCodes?: {
+                count: number;
+                enabled: boolean;
+            } | undefined;
+        }, {
+            enabled?: boolean | undefined;
+            issuer?: string | undefined;
+            qrCodeSize?: number | undefined;
+            backupCodes?: {
+                count?: number | undefined;
+                enabled?: boolean | undefined;
+            } | undefined;
+        }>>;
+        /**
+         * Organization (Multi-tenant) configuration
+         * Enables B2B SaaS scenarios where users belong to multiple teams/workspaces
+         */
+        organization: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            allowUserToCreateOrg: z.ZodDefault<z.ZodBoolean>;
+            defaultRole: z.ZodDefault<z.ZodString>;
+            creatorRole: z.ZodDefault<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            allowUserToCreateOrg: boolean;
+            defaultRole: string;
+            creatorRole: string;
+        }, {
+            enabled?: boolean | undefined;
+            allowUserToCreateOrg?: boolean | undefined;
+            defaultRole?: string | undefined;
+            creatorRole?: string | undefined;
+        }>>;
+        /**
+         * Enterprise authentication configuration (SAML, LDAP, OIDC)
+         */
+        enterprise: z.ZodOptional<z.ZodObject<{
+            oidc: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                issuer: z.ZodString;
+                clientId: z.ZodString;
+                clientSecret: z.ZodString;
+                scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                displayName: z.ZodOptional<z.ZodString>;
+                icon: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                clientId: string;
+                clientSecret: string;
+                scopes: string[];
+                issuer: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            }, {
+                clientId: string;
+                clientSecret: string;
+                issuer: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            }>>;
+            saml: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                entryPoint: z.ZodString;
+                cert: z.ZodString;
+                issuer: z.ZodString;
+                signatureAlgorithm: z.ZodDefault<z.ZodEnum<["sha256", "sha512"]>>;
+                attributeMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                displayName: z.ZodOptional<z.ZodString>;
+                icon: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                enabled: boolean;
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                signatureAlgorithm: "sha256" | "sha512";
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            }, {
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+                signatureAlgorithm?: "sha256" | "sha512" | undefined;
+            }>>;
+            ldap: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                url: z.ZodString;
+                bindDn: z.ZodString;
+                bindCredentials: z.ZodString;
+                searchBase: z.ZodString;
+                searchFilter: z.ZodString;
+                groupSearchBase: z.ZodOptional<z.ZodString>;
+                displayName: z.ZodOptional<z.ZodString>;
+                icon: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                url: string;
+                enabled: boolean;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            }, {
+                url: string;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            oidc?: {
+                enabled: boolean;
+                clientId: string;
+                clientSecret: string;
+                scopes: string[];
+                issuer: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            saml?: {
+                enabled: boolean;
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                signatureAlgorithm: "sha256" | "sha512";
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            ldap?: {
+                url: string;
+                enabled: boolean;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            } | undefined;
+        }, {
+            oidc?: {
+                clientId: string;
+                clientSecret: string;
+                issuer: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            saml?: {
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+                signatureAlgorithm?: "sha256" | "sha512" | undefined;
+            } | undefined;
+            ldap?: {
+                url: string;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            } | undefined;
+        }>>;
+        /**
+         * User field mapping
+         */
+        userFieldMapping: z.ZodDefault<z.ZodObject<{
+            id: z.ZodDefault<z.ZodString>;
+            email: z.ZodDefault<z.ZodString>;
+            name: z.ZodDefault<z.ZodString>;
+            image: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+            emailVerified: z.ZodDefault<z.ZodString>;
+            createdAt: z.ZodDefault<z.ZodString>;
+            updatedAt: z.ZodDefault<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            email: string;
+            name: string;
+            id: string;
+            emailVerified: string;
+            createdAt: string;
+            updatedAt: string;
+            image?: string | undefined;
+        }, {
+            email?: string | undefined;
+            image?: string | undefined;
+            name?: string | undefined;
+            id?: string | undefined;
+            emailVerified?: string | undefined;
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+        }>>;
+        /**
+         * Database adapter configuration
+         */
+        database: z.ZodOptional<z.ZodObject<{
+            type: z.ZodEnum<["prisma", "drizzle", "kysely", "custom"]>;
+            connectionString: z.ZodOptional<z.ZodString>;
+            tablePrefix: z.ZodDefault<z.ZodString>;
+            schema: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "custom" | "prisma" | "drizzle" | "kysely";
+            tablePrefix: string;
+            connectionString?: string | undefined;
+            schema?: string | undefined;
+        }, {
+            type: "custom" | "prisma" | "drizzle" | "kysely";
+            connectionString?: string | undefined;
+            tablePrefix?: string | undefined;
+            schema?: string | undefined;
+        }>>;
+        /**
+         * Database field mapping configuration
+         * Maps ObjectStack standard field names to driver-specific field names.
+         *
+         * This is distinct from the database adapter configuration and provides
+         * instructions for the driver to map our standard schema fields to the
+         * underlying engine's fields (e.g., better-auth uses 'token' instead of 'sessionToken').
+         */
+        mapping: z.ZodOptional<z.ZodObject<{
+            /**
+             * User model field mapping
+             * Maps ObjectStack User fields to driver fields
+             */
+            user: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /**
+             * Session model field mapping
+             * Maps ObjectStack Session fields to driver fields
+             */
+            session: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /**
+             * Account model field mapping
+             * Maps ObjectStack Account fields to driver fields
+             */
+            account: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /**
+             * Verification token field mapping
+             * Maps ObjectStack VerificationToken fields to driver fields
+             */
+            verificationToken: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            session: Record<string, string>;
+            account: Record<string, string>;
+            user?: Record<string, string> | undefined;
+            verificationToken?: Record<string, string> | undefined;
+        }, {
+            user?: Record<string, string> | undefined;
+            session?: Record<string, string> | undefined;
+            account?: Record<string, string> | undefined;
+            verificationToken?: Record<string, string> | undefined;
+        }>>;
+        /**
+         * Additional authentication plugins
+         */
+        plugins: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            options: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            enabled: boolean;
+            options?: Record<string, any> | undefined;
+        }, {
+            name: string;
+            options?: Record<string, any> | undefined;
+            enabled?: boolean | undefined;
+        }>, "many">>;
+        /**
+         * Custom hooks for authentication events
+         */
+        hooks: z.ZodOptional<z.ZodObject<{
+            beforeSignIn: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+                email: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                email: string;
+            }, {
+                email: string;
+            }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+            afterSignIn: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+                user: z.ZodAny;
+                session: z.ZodAny;
+            }, "strip", z.ZodTypeAny, {
+                user?: any;
+                session?: any;
+            }, {
+                user?: any;
+                session?: any;
+            }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+            beforeSignUp: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+                email: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                email: string;
+                name?: string | undefined;
+            }, {
+                email: string;
+                name?: string | undefined;
+            }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+            afterSignUp: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+                user: z.ZodAny;
+            }, "strip", z.ZodTypeAny, {
+                user?: any;
+            }, {
+                user?: any;
+            }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+            beforeSignOut: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+                sessionId: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                sessionId: string;
+            }, {
+                sessionId: string;
+            }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+            afterSignOut: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodObject<{
+                sessionId: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                sessionId: string;
+            }, {
+                sessionId: string;
+            }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>>;
+        }, "strip", z.ZodTypeAny, {
+            beforeSignIn?: ((args_0: {
+                email: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignIn?: ((args_0: {
+                user?: any;
+                session?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignUp?: ((args_0: {
+                email: string;
+                name?: string | undefined;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignUp?: ((args_0: {
+                user?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        }, {
+            beforeSignIn?: ((args_0: {
+                email: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignIn?: ((args_0: {
+                user?: any;
+                session?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignUp?: ((args_0: {
+                email: string;
+                name?: string | undefined;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignUp?: ((args_0: {
+                user?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        }>>;
+        /**
+         * Advanced security settings
+         */
+        security: z.ZodOptional<z.ZodObject<{
+            allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustProxy: z.ZodDefault<z.ZodBoolean>;
+            ipRateLimiting: z.ZodDefault<z.ZodBoolean>;
+            sessionFingerprinting: z.ZodDefault<z.ZodBoolean>;
+            maxSessions: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            trustProxy: boolean;
+            ipRateLimiting: boolean;
+            sessionFingerprinting: boolean;
+            maxSessions: number;
+            allowedOrigins?: string[] | undefined;
+        }, {
+            allowedOrigins?: string[] | undefined;
+            trustProxy?: boolean | undefined;
+            ipRateLimiting?: boolean | undefined;
+            sessionFingerprinting?: boolean | undefined;
+            maxSessions?: number | undefined;
+        }>>;
+        /**
+         * Email configuration for transactional emails
+         */
+        email: z.ZodOptional<z.ZodObject<{
+            from: z.ZodString;
+            fromName: z.ZodOptional<z.ZodString>;
+            provider: z.ZodEnum<["smtp", "sendgrid", "mailgun", "ses", "resend", "custom"]>;
+            config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+            from: string;
+            config?: Record<string, any> | undefined;
+            fromName?: string | undefined;
+        }, {
+            provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+            from: string;
+            config?: Record<string, any> | undefined;
+            fromName?: string | undefined;
+        }>>;
+        /**
+         * UI customization options
+         */
+        ui: z.ZodOptional<z.ZodObject<{
+            brandName: z.ZodOptional<z.ZodString>;
+            logo: z.ZodOptional<z.ZodString>;
+            primaryColor: z.ZodOptional<z.ZodString>;
+            customCss: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            primaryColor?: string | undefined;
+            logo?: string | undefined;
+            brandName?: string | undefined;
+            customCss?: string | undefined;
+        }, {
+            primaryColor?: string | undefined;
+            logo?: string | undefined;
+            brandName?: string | undefined;
+            customCss?: string | undefined;
+        }>>;
+        /**
+         * Whether this auth provider is active
+         */
+        active: z.ZodDefault<z.ZodBoolean>;
+        /**
+         * Whether to allow new user registration
+         */
+        allowRegistration: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        label: string;
+        name: string;
+        active: boolean;
+        driver: string;
+        secret: string;
+        rateLimit: {
+            enabled: boolean;
+            windowMs: number;
+            maxAttempts: number;
+            blockDuration: number;
+            skipSuccessfulRequests: boolean;
+        };
+        session: {
+            expiresIn: number;
+            updateAge: number;
+            cookieName: string;
+            cookieSecure: boolean;
+            cookieSameSite: "strict" | "none" | "lax";
+            cookiePath: string;
+            cookieHttpOnly: boolean;
+            cookieDomain?: string | undefined;
+        };
+        strategies: ("oauth" | "email_password" | "magic_link" | "passkey" | "otp" | "anonymous")[];
+        baseUrl: string;
+        csrf: {
+            enabled: boolean;
+            cookieName: string;
+            tokenLength: number;
+            headerName: string;
+        };
+        accountLinking: {
+            enabled: boolean;
+            autoLink: boolean;
+            requireVerification: boolean;
+        };
+        userFieldMapping: {
+            email: string;
+            name: string;
+            id: string;
+            emailVerified: string;
+            createdAt: string;
+            updatedAt: string;
+            image?: string | undefined;
+        };
+        plugins: {
+            name: string;
+            enabled: boolean;
+            options?: Record<string, any> | undefined;
+        }[];
+        allowRegistration: boolean;
+        email?: {
+            provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+            from: string;
+            config?: Record<string, any> | undefined;
+            fromName?: string | undefined;
+        } | undefined;
+        oauth?: {
+            providers: {
+                enabled: boolean;
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }[];
+        } | undefined;
+        passkey?: {
+            enabled: boolean;
+            rpName: string;
+            userVerification: "required" | "preferred" | "discouraged";
+            attestation: "none" | "indirect" | "direct" | "enterprise";
+            rpId?: string | undefined;
+            allowedOrigins?: string[] | undefined;
+        } | undefined;
+        enterprise?: {
+            oidc?: {
+                enabled: boolean;
+                clientId: string;
+                clientSecret: string;
+                scopes: string[];
+                issuer: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            saml?: {
+                enabled: boolean;
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                signatureAlgorithm: "sha256" | "sha512";
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            ldap?: {
+                url: string;
+                enabled: boolean;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            } | undefined;
+        } | undefined;
+        emailPassword?: {
+            enabled: boolean;
+            requireEmailVerification: boolean;
+            minPasswordLength: number;
+            requirePasswordComplexity: boolean;
+            allowPasswordReset: boolean;
+            passwordResetExpiry: number;
+        } | undefined;
+        magicLink?: {
+            enabled: boolean;
+            expiryTime: number;
+            sendEmail?: ((args_0: {
+                token: string;
+                to: string;
+                link: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        twoFactor?: {
+            enabled: boolean;
+            qrCodeSize: number;
+            issuer?: string | undefined;
+            backupCodes?: {
+                count: number;
+                enabled: boolean;
+            } | undefined;
+        } | undefined;
+        organization?: {
+            enabled: boolean;
+            allowUserToCreateOrg: boolean;
+            defaultRole: string;
+            creatorRole: string;
+        } | undefined;
+        database?: {
+            type: "custom" | "prisma" | "drizzle" | "kysely";
+            tablePrefix: string;
+            connectionString?: string | undefined;
+            schema?: string | undefined;
+        } | undefined;
+        mapping?: {
+            session: Record<string, string>;
+            account: Record<string, string>;
+            user?: Record<string, string> | undefined;
+            verificationToken?: Record<string, string> | undefined;
+        } | undefined;
+        hooks?: {
+            beforeSignIn?: ((args_0: {
+                email: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignIn?: ((args_0: {
+                user?: any;
+                session?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignUp?: ((args_0: {
+                email: string;
+                name?: string | undefined;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignUp?: ((args_0: {
+                user?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        security?: {
+            trustProxy: boolean;
+            ipRateLimiting: boolean;
+            sessionFingerprinting: boolean;
+            maxSessions: number;
+            allowedOrigins?: string[] | undefined;
+        } | undefined;
+        ui?: {
+            primaryColor?: string | undefined;
+            logo?: string | undefined;
+            brandName?: string | undefined;
+            customCss?: string | undefined;
+        } | undefined;
+    }, {
+        label: string;
+        name: string;
+        secret: string;
+        strategies: ("oauth" | "email_password" | "magic_link" | "passkey" | "otp" | "anonymous")[];
+        baseUrl: string;
+        email?: {
+            provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+            from: string;
+            config?: Record<string, any> | undefined;
+            fromName?: string | undefined;
+        } | undefined;
+        active?: boolean | undefined;
+        driver?: string | undefined;
+        rateLimit?: {
+            enabled?: boolean | undefined;
+            windowMs?: number | undefined;
+            maxAttempts?: number | undefined;
+            blockDuration?: number | undefined;
+            skipSuccessfulRequests?: boolean | undefined;
+        } | undefined;
+        oauth?: {
+            providers: {
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }[];
+        } | undefined;
+        passkey?: {
+            rpName: string;
+            enabled?: boolean | undefined;
+            rpId?: string | undefined;
+            allowedOrigins?: string[] | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
+        } | undefined;
+        enterprise?: {
+            oidc?: {
+                clientId: string;
+                clientSecret: string;
+                issuer: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            saml?: {
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+                signatureAlgorithm?: "sha256" | "sha512" | undefined;
+            } | undefined;
+            ldap?: {
+                url: string;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            } | undefined;
+        } | undefined;
+        session?: {
+            expiresIn?: number | undefined;
+            updateAge?: number | undefined;
+            cookieName?: string | undefined;
+            cookieSecure?: boolean | undefined;
+            cookieSameSite?: "strict" | "none" | "lax" | undefined;
+            cookieDomain?: string | undefined;
+            cookiePath?: string | undefined;
+            cookieHttpOnly?: boolean | undefined;
+        } | undefined;
+        emailPassword?: {
+            enabled?: boolean | undefined;
+            requireEmailVerification?: boolean | undefined;
+            minPasswordLength?: number | undefined;
+            requirePasswordComplexity?: boolean | undefined;
+            allowPasswordReset?: boolean | undefined;
+            passwordResetExpiry?: number | undefined;
+        } | undefined;
+        magicLink?: {
+            enabled?: boolean | undefined;
+            expiryTime?: number | undefined;
+            sendEmail?: ((args_0: {
+                token: string;
+                to: string;
+                link: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        csrf?: {
+            enabled?: boolean | undefined;
+            cookieName?: string | undefined;
+            tokenLength?: number | undefined;
+            headerName?: string | undefined;
+        } | undefined;
+        accountLinking?: {
+            enabled?: boolean | undefined;
+            autoLink?: boolean | undefined;
+            requireVerification?: boolean | undefined;
+        } | undefined;
+        twoFactor?: {
+            enabled?: boolean | undefined;
+            issuer?: string | undefined;
+            qrCodeSize?: number | undefined;
+            backupCodes?: {
+                count?: number | undefined;
+                enabled?: boolean | undefined;
+            } | undefined;
+        } | undefined;
+        organization?: {
+            enabled?: boolean | undefined;
+            allowUserToCreateOrg?: boolean | undefined;
+            defaultRole?: string | undefined;
+            creatorRole?: string | undefined;
+        } | undefined;
+        userFieldMapping?: {
+            email?: string | undefined;
+            image?: string | undefined;
+            name?: string | undefined;
+            id?: string | undefined;
+            emailVerified?: string | undefined;
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+        } | undefined;
+        database?: {
+            type: "custom" | "prisma" | "drizzle" | "kysely";
+            connectionString?: string | undefined;
+            tablePrefix?: string | undefined;
+            schema?: string | undefined;
+        } | undefined;
+        mapping?: {
+            user?: Record<string, string> | undefined;
+            session?: Record<string, string> | undefined;
+            account?: Record<string, string> | undefined;
+            verificationToken?: Record<string, string> | undefined;
+        } | undefined;
+        plugins?: {
+            name: string;
+            options?: Record<string, any> | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+        hooks?: {
+            beforeSignIn?: ((args_0: {
+                email: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignIn?: ((args_0: {
+                user?: any;
+                session?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignUp?: ((args_0: {
+                email: string;
+                name?: string | undefined;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignUp?: ((args_0: {
+                user?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        security?: {
+            allowedOrigins?: string[] | undefined;
+            trustProxy?: boolean | undefined;
+            ipRateLimiting?: boolean | undefined;
+            sessionFingerprinting?: boolean | undefined;
+            maxSessions?: number | undefined;
+        } | undefined;
+        ui?: {
+            primaryColor?: string | undefined;
+            logo?: string | undefined;
+            brandName?: string | undefined;
+            customCss?: string | undefined;
+        } | undefined;
+        allowRegistration?: boolean | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    type: "standard_auth";
+    config: {
+        label: string;
+        name: string;
+        active: boolean;
+        driver: string;
+        secret: string;
+        rateLimit: {
+            enabled: boolean;
+            windowMs: number;
+            maxAttempts: number;
+            blockDuration: number;
+            skipSuccessfulRequests: boolean;
+        };
+        session: {
+            expiresIn: number;
+            updateAge: number;
+            cookieName: string;
+            cookieSecure: boolean;
+            cookieSameSite: "strict" | "none" | "lax";
+            cookiePath: string;
+            cookieHttpOnly: boolean;
+            cookieDomain?: string | undefined;
+        };
+        strategies: ("oauth" | "email_password" | "magic_link" | "passkey" | "otp" | "anonymous")[];
+        baseUrl: string;
+        csrf: {
+            enabled: boolean;
+            cookieName: string;
+            tokenLength: number;
+            headerName: string;
+        };
+        accountLinking: {
+            enabled: boolean;
+            autoLink: boolean;
+            requireVerification: boolean;
+        };
+        userFieldMapping: {
+            email: string;
+            name: string;
+            id: string;
+            emailVerified: string;
+            createdAt: string;
+            updatedAt: string;
+            image?: string | undefined;
+        };
+        plugins: {
+            name: string;
+            enabled: boolean;
+            options?: Record<string, any> | undefined;
+        }[];
+        allowRegistration: boolean;
+        email?: {
+            provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+            from: string;
+            config?: Record<string, any> | undefined;
+            fromName?: string | undefined;
+        } | undefined;
+        oauth?: {
+            providers: {
+                enabled: boolean;
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }[];
+        } | undefined;
+        passkey?: {
+            enabled: boolean;
+            rpName: string;
+            userVerification: "required" | "preferred" | "discouraged";
+            attestation: "none" | "indirect" | "direct" | "enterprise";
+            rpId?: string | undefined;
+            allowedOrigins?: string[] | undefined;
+        } | undefined;
+        enterprise?: {
+            oidc?: {
+                enabled: boolean;
+                clientId: string;
+                clientSecret: string;
+                scopes: string[];
+                issuer: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            saml?: {
+                enabled: boolean;
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                signatureAlgorithm: "sha256" | "sha512";
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            ldap?: {
+                url: string;
+                enabled: boolean;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            } | undefined;
+        } | undefined;
+        emailPassword?: {
+            enabled: boolean;
+            requireEmailVerification: boolean;
+            minPasswordLength: number;
+            requirePasswordComplexity: boolean;
+            allowPasswordReset: boolean;
+            passwordResetExpiry: number;
+        } | undefined;
+        magicLink?: {
+            enabled: boolean;
+            expiryTime: number;
+            sendEmail?: ((args_0: {
+                token: string;
+                to: string;
+                link: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        twoFactor?: {
+            enabled: boolean;
+            qrCodeSize: number;
+            issuer?: string | undefined;
+            backupCodes?: {
+                count: number;
+                enabled: boolean;
+            } | undefined;
+        } | undefined;
+        organization?: {
+            enabled: boolean;
+            allowUserToCreateOrg: boolean;
+            defaultRole: string;
+            creatorRole: string;
+        } | undefined;
+        database?: {
+            type: "custom" | "prisma" | "drizzle" | "kysely";
+            tablePrefix: string;
+            connectionString?: string | undefined;
+            schema?: string | undefined;
+        } | undefined;
+        mapping?: {
+            session: Record<string, string>;
+            account: Record<string, string>;
+            user?: Record<string, string> | undefined;
+            verificationToken?: Record<string, string> | undefined;
+        } | undefined;
+        hooks?: {
+            beforeSignIn?: ((args_0: {
+                email: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignIn?: ((args_0: {
+                user?: any;
+                session?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignUp?: ((args_0: {
+                email: string;
+                name?: string | undefined;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignUp?: ((args_0: {
+                user?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        security?: {
+            trustProxy: boolean;
+            ipRateLimiting: boolean;
+            sessionFingerprinting: boolean;
+            maxSessions: number;
+            allowedOrigins?: string[] | undefined;
+        } | undefined;
+        ui?: {
+            primaryColor?: string | undefined;
+            logo?: string | undefined;
+            brandName?: string | undefined;
+            customCss?: string | undefined;
+        } | undefined;
+    };
+}, {
+    type: "standard_auth";
+    config: {
+        label: string;
+        name: string;
+        secret: string;
+        strategies: ("oauth" | "email_password" | "magic_link" | "passkey" | "otp" | "anonymous")[];
+        baseUrl: string;
+        email?: {
+            provider: "custom" | "smtp" | "sendgrid" | "mailgun" | "ses" | "resend";
+            from: string;
+            config?: Record<string, any> | undefined;
+            fromName?: string | undefined;
+        } | undefined;
+        active?: boolean | undefined;
+        driver?: string | undefined;
+        rateLimit?: {
+            enabled?: boolean | undefined;
+            windowMs?: number | undefined;
+            maxAttempts?: number | undefined;
+            blockDuration?: number | undefined;
+            skipSuccessfulRequests?: boolean | undefined;
+        } | undefined;
+        oauth?: {
+            providers: {
+                provider: "custom" | "google" | "github" | "facebook" | "twitter" | "linkedin" | "microsoft" | "apple" | "discord" | "gitlab";
+                clientId: string;
+                clientSecret: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                redirectUri?: string | undefined;
+                displayName?: string | undefined;
+            }[];
+        } | undefined;
+        passkey?: {
+            rpName: string;
+            enabled?: boolean | undefined;
+            rpId?: string | undefined;
+            allowedOrigins?: string[] | undefined;
+            userVerification?: "required" | "preferred" | "discouraged" | undefined;
+            attestation?: "none" | "indirect" | "direct" | "enterprise" | undefined;
+        } | undefined;
+        enterprise?: {
+            oidc?: {
+                clientId: string;
+                clientSecret: string;
+                issuer: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                scopes?: string[] | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+            } | undefined;
+            saml?: {
+                issuer: string;
+                entryPoint: string;
+                cert: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                attributeMapping?: Record<string, string> | undefined;
+                signatureAlgorithm?: "sha256" | "sha512" | undefined;
+            } | undefined;
+            ldap?: {
+                url: string;
+                bindDn: string;
+                bindCredentials: string;
+                searchBase: string;
+                searchFilter: string;
+                icon?: string | undefined;
+                enabled?: boolean | undefined;
+                displayName?: string | undefined;
+                groupSearchBase?: string | undefined;
+            } | undefined;
+        } | undefined;
+        session?: {
+            expiresIn?: number | undefined;
+            updateAge?: number | undefined;
+            cookieName?: string | undefined;
+            cookieSecure?: boolean | undefined;
+            cookieSameSite?: "strict" | "none" | "lax" | undefined;
+            cookieDomain?: string | undefined;
+            cookiePath?: string | undefined;
+            cookieHttpOnly?: boolean | undefined;
+        } | undefined;
+        emailPassword?: {
+            enabled?: boolean | undefined;
+            requireEmailVerification?: boolean | undefined;
+            minPasswordLength?: number | undefined;
+            requirePasswordComplexity?: boolean | undefined;
+            allowPasswordReset?: boolean | undefined;
+            passwordResetExpiry?: number | undefined;
+        } | undefined;
+        magicLink?: {
+            enabled?: boolean | undefined;
+            expiryTime?: number | undefined;
+            sendEmail?: ((args_0: {
+                token: string;
+                to: string;
+                link: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        csrf?: {
+            enabled?: boolean | undefined;
+            cookieName?: string | undefined;
+            tokenLength?: number | undefined;
+            headerName?: string | undefined;
+        } | undefined;
+        accountLinking?: {
+            enabled?: boolean | undefined;
+            autoLink?: boolean | undefined;
+            requireVerification?: boolean | undefined;
+        } | undefined;
+        twoFactor?: {
+            enabled?: boolean | undefined;
+            issuer?: string | undefined;
+            qrCodeSize?: number | undefined;
+            backupCodes?: {
+                count?: number | undefined;
+                enabled?: boolean | undefined;
+            } | undefined;
+        } | undefined;
+        organization?: {
+            enabled?: boolean | undefined;
+            allowUserToCreateOrg?: boolean | undefined;
+            defaultRole?: string | undefined;
+            creatorRole?: string | undefined;
+        } | undefined;
+        userFieldMapping?: {
+            email?: string | undefined;
+            image?: string | undefined;
+            name?: string | undefined;
+            id?: string | undefined;
+            emailVerified?: string | undefined;
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+        } | undefined;
+        database?: {
+            type: "custom" | "prisma" | "drizzle" | "kysely";
+            connectionString?: string | undefined;
+            tablePrefix?: string | undefined;
+            schema?: string | undefined;
+        } | undefined;
+        mapping?: {
+            user?: Record<string, string> | undefined;
+            session?: Record<string, string> | undefined;
+            account?: Record<string, string> | undefined;
+            verificationToken?: Record<string, string> | undefined;
+        } | undefined;
+        plugins?: {
+            name: string;
+            options?: Record<string, any> | undefined;
+            enabled?: boolean | undefined;
+        }[] | undefined;
+        hooks?: {
+            beforeSignIn?: ((args_0: {
+                email: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignIn?: ((args_0: {
+                user?: any;
+                session?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignUp?: ((args_0: {
+                email: string;
+                name?: string | undefined;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignUp?: ((args_0: {
+                user?: any;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            beforeSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+            afterSignOut?: ((args_0: {
+                sessionId: string;
+            }, ...args: unknown[]) => Promise<void>) | undefined;
+        } | undefined;
+        security?: {
+            allowedOrigins?: string[] | undefined;
+            trustProxy?: boolean | undefined;
+            ipRateLimiting?: boolean | undefined;
+            sessionFingerprinting?: boolean | undefined;
+            maxSessions?: number | undefined;
+        } | undefined;
+        ui?: {
+            primaryColor?: string | undefined;
+            logo?: string | undefined;
+            brandName?: string | undefined;
+            customCss?: string | undefined;
+        } | undefined;
+        allowRegistration?: boolean | undefined;
+    };
+}>;
+export type StandardAuthProvider = z.infer<typeof StandardAuthProviderSchema>;
+//# sourceMappingURL=auth.zod.d.ts.map