@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/dist/internal/Apps.d.ts

@@ -0,0 +1,3051 @@
+import type * as PendingKey from './PendingKey.js';
+import type * as Realm from './Realm.js';
+/** Another app already has the client ID. */
+export declare class ExistsError extends Error {
+    readonly name = "Apps.ExistsError";
+    constructor(options: {
+        clientId: string;
+    });
+}
+/** A name, a redirect URI, or another value of an app is not valid. */
+export declare class InvalidError extends Error {
+    readonly name = "Apps.InvalidError";
+}
+/** No OAuth app has the client ID. */
+export declare class NotFoundError extends Error {
+    readonly name = "Apps.NotFoundError";
+    constructor(options: {
+        clientId: string;
+    });
+}
+/** The app redeems codes with PKCE alone, so it has no client secret to rotate. */
+export declare class PublicError extends Error {
+    readonly name = "Apps.PublicError";
+    constructor(options: {
+        clientId: string;
+    });
+}
+/** An OAuth app, as `tempo-id admin apps` returns it. */
+export type App = {
+    /** The client ID, which the app sends as `client_id`. */
+    clientId: string;
+    /** When the app was created. */
+    createdAt: Date | null;
+    /** Whether the app signs in through the device grant, in place of a redirect, as a CLI does. */
+    device: boolean;
+    /** The display name, which the approval page shows. */
+    name: string | null;
+    /** Every URI that `GET /oauth2/end-session` may return to after it ends the session. */
+    postLogoutRedirectUris: readonly string[];
+    /** Every URI that the app returns to. */
+    redirectUris: readonly string[];
+    /** Whether the app holds a client secret, which its backend sends to the token endpoint. */
+    secret: boolean;
+    /** Whether the app holds the `tempo-id:sign` scope, which permits a challenge. */
+    sign: boolean;
+    /** Whether a request without a key skips the approval page. */
+    skipConsent: boolean;
+    /** `web` for a browser app or an app with a backend, and `native` for a mobile app. */
+    type: 'native' | 'web';
+};
+/** The grant type of the device grant (RFC 8628 §3.4). */
+export declare const deviceGrant = "urn:ietf:params:oauth:grant-type:device_code";
+/** The scope that lets an app bind its own challenge into a key authorization. */
+export declare const signScope = "tempo-id:sign";
+/**
+ * Returns whether `clientSecret` is the client secret of the enabled app with `clientId`. An
+ * unknown app, a disabled app, and an app without a client secret return `false`. Better Auth still
+ * authenticates the request itself, so a match only decides which app a rate limit counts.
+ */
+export declare function authenticate(db: Realm.Database, options: authenticate.Options): Promise<boolean>;
+export declare namespace authenticate {
+    type Options = {
+        /** The client ID that the request names. */
+        clientId: string;
+        /** The client secret that the request sends. */
+        clientSecret: string;
+    };
+}
+/**
+ * Registers an app, and returns it with its client secret. The secret appears only in this result,
+ * since the row holds only its hash. A `clientId` or `clientSecret` keeps the values of an app that
+ * another deployment registered.
+ *
+ * Throws `InvalidError` for an invalid name, redirect URI, client ID, or client secret, or a device
+ * app with a secret, and `ExistsError` when another app has the client ID.
+ */
+export declare function create(db: Realm.Database, options: create.Options): Promise<{
+    app: App;
+    clientSecret?: string;
+}>;
+export declare namespace create {
+    type Options = {
+        /**
+         * The client ID, such as the one that another deployment issued. Defaults to 32 random letters,
+         * as Better Auth issues.
+         */
+        clientId?: string | undefined;
+        /**
+         * The client secret, such as the one that another deployment issued. It gives the app a secret
+         * without `secret`. Defaults to a new secret when `secret` is set.
+         */
+        clientSecret?: string | undefined;
+        /**
+         * Whether the app signs in through the device grant, in place of a redirect, as a CLI does.
+         * Defaults to `false`.
+         */
+        device?: boolean | undefined;
+        /** The display name, which the approval page shows. */
+        name: string;
+        /** Every URI that `GET /oauth2/end-session` may return to. Defaults to none. */
+        postLogoutRedirectUris?: readonly string[] | undefined;
+        /** Every URI that the app returns to, in each environment. A device app may have none. */
+        redirectUris?: readonly string[] | undefined;
+        /** Whether the app receives a client secret, for its backend. Defaults to `false`. */
+        secret?: boolean | undefined;
+        /** Whether the app holds the `tempo-id:sign` scope. Defaults to `false`. */
+        sign?: boolean | undefined;
+        /** Whether a request without a key skips the approval page. Defaults to `false`. */
+        skipConsent?: boolean | undefined;
+        /** The application type. Defaults to `web`. */
+        type?: App['type'] | undefined;
+    };
+}
+/**
+ * Returns whether `origin` is the origin of a redirect URI of an enabled first-party app, one that
+ * skips consent. Pages on such an origin call the API with the session cookie. A disabled app,
+ * which Better Auth refuses, gives no origin. The registration rules keep production redirect URIs
+ * on `https`, so the check filters no scheme.
+ */
+export declare function firstPartyOrigin(db: Realm.Database, options: firstPartyOrigin.Options): Promise<boolean>;
+export declare namespace firstPartyOrigin {
+    type Options = {
+        /** The request's `Origin`. */
+        origin: string;
+    };
+}
+/**
+ * Returns the app with `clientId`. Throws `NotFoundError` when no app has it, or with `enabled`,
+ * when the app is disabled.
+ */
+export declare function get(db: Realm.Database, options: get.Options): Promise<App>;
+export declare namespace get {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+        /** Whether a disabled app counts as no app. Defaults to `false`. */
+        enabled?: boolean | undefined;
+    };
+}
+/**
+ * Returns the SHA-256 hash of a client secret, as base64url without padding, which the row holds.
+ * Better Auth verifies a client secret against it.
+ */
+export declare function hashSecret(secret: string): Promise<string>;
+/** Returns every app, oldest first. */
+export declare function list(db: Realm.Database): Promise<readonly App[]>;
+/**
+ * Returns the Better Auth plugins that serve OAuth apps: the JWT plugin, which signs tokens with
+ * RS256, and the OAuth provider. `baseURL` is Tempo ID's origin, which is `iss` and the one resource.
+ */
+export declare function plugins(options: plugins.Options): ({
+    id: "jwt";
+    version: string;
+    options: NoInfer<{
+        adapter: {
+            getJwks: (ctx: import("better-auth").GenericEndpointContext) => Promise<import("better-auth/plugins/jwt").Jwk[]>;
+        };
+        jwks: {
+            gracePeriod: number;
+            jwksPath: string;
+            keyPairConfig: {
+                alg: 'RS256';
+                modulusLength: number;
+            };
+        };
+        jwt: {
+            issuer: string;
+        };
+    }>;
+    init(ctx: import("better-auth").AuthContext): {
+        context: {
+            sessionConfig: {
+                cookieCacheSigner: import("better-auth").CookieCacheSigner;
+                updateAge: number;
+                expiresIn: number;
+                freshAge: number;
+                cookieRefreshCache: false | {
+                    enabled: true;
+                    updateAge: number;
+                };
+            };
+        };
+    } | undefined;
+    endpoints: {
+        getJwks: import("better-call").StrictEndpoint<string, {
+            method: "GET";
+            metadata: {
+                openapi: {
+                    operationId: string;
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            keys: {
+                                                type: string;
+                                                description: string;
+                                                items: {
+                                                    type: string;
+                                                    properties: {
+                                                        kid: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        kty: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        alg: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        use: {
+                                                            type: string;
+                                                            description: string;
+                                                            enum: string[];
+                                                            nullable: boolean;
+                                                        };
+                                                        n: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        e: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        crv: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        x: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        y: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                    };
+                                                    required: string[];
+                                                };
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("jose").JSONWebKeySet>;
+        getToken: import("better-call").StrictEndpoint<"/token", {
+            method: "GET";
+            requireHeaders: true;
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    operationId: string;
+                    description: string;
+                    responses: {
+                        200: {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            token: {
+                                                type: string;
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            token: string;
+        }>;
+        signJWT: import("better-call").StrictEndpoint<string, {
+            method: "POST";
+            metadata: {
+                $Infer: {
+                    body: {
+                        payload: import("jose").JWTPayload;
+                        overrideOptions?: import("better-auth/plugins/jwt").JwtOptions | undefined;
+                    };
+                };
+            };
+            body: import("zod").ZodObject<{
+                payload: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>;
+                overrideOptions: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+            }, import("zod/v4/core").$strip>;
+        }, {
+            token: string;
+        }>;
+        verifyJWT: import("better-call").StrictEndpoint<string, {
+            method: "POST";
+            metadata: {
+                $Infer: {
+                    body: {
+                        token: string;
+                        issuer?: string;
+                    };
+                    response: {
+                        payload: {
+                            sub: string;
+                            aud: string;
+                            [key: string]: any;
+                        } | null;
+                    };
+                };
+            };
+            body: import("zod").ZodObject<{
+                token: import("zod").ZodString;
+                issuer: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+        }, {
+            payload: (import("jose").JWTPayload & Required<Pick<import("jose").JWTPayload, "sub" | "aud">>) | null;
+        }>;
+    };
+    hooks: {
+        after: {
+            matcher(context: import("better-auth").HookEndpointContext): boolean;
+            handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+        }[];
+    };
+    schema: {
+        jwks: {
+            fields: {
+                publicKey: {
+                    type: "string";
+                    required: true;
+                };
+                privateKey: {
+                    type: "string";
+                    required: true;
+                };
+                createdAt: {
+                    type: "date";
+                    required: true;
+                };
+                expiresAt: {
+                    type: "date";
+                    required: false;
+                };
+                alg: {
+                    type: "string";
+                    required: false;
+                };
+                crv: {
+                    type: "string";
+                    required: false;
+                };
+            };
+        };
+    };
+} | {
+    id: "oauth-provider";
+    version: string;
+    options: NoInfer<{
+        allowDynamicClientRegistration: false;
+        consentPage: string;
+        customIdTokenClaims: (info: {
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & Record<string, unknown>;
+            scopes: import("@better-auth/oauth-provider").Scope[];
+            metadata?: Record<string, any>;
+        }) => {
+            email: string;
+            email_verified: boolean;
+        } | {
+            email?: never;
+            email_verified?: never;
+        };
+        enforcePerClientResources: false;
+        loginPage: string;
+        postLogin?: {
+            consentReferenceId: () => undefined;
+            page: string;
+            shouldRedirect: (context: {
+                headers: Headers;
+                session: {
+                    id: string;
+                };
+                user: {
+                    id: string;
+                };
+            }) => Promise<boolean>;
+        };
+        customTokenResponseFields?: (info: {
+            grantType: string;
+            user?: {
+                id: string;
+            } | null | undefined;
+            verificationValue?: {
+                query: {
+                    client_id: string;
+                    code_challenge?: string | undefined;
+                    key_authorization?: unknown;
+                };
+            };
+        }) => Promise<{
+            account?: never;
+            key_authorization?: never;
+        } | {
+            account: `0x${string}`;
+            key_authorization: import("ox/tempo/KeyAuthorization").Rpc;
+        }>;
+        resources: {
+            accessTokenTtl: number;
+            identifier: string;
+            name: string;
+        }[];
+        scopes: ("email" | "offline_access" | "openid" | "profile")[];
+        storeClientSecret: {
+            hash: typeof hashSecret;
+        };
+    }>;
+    onRequest: (request: Request, ctx: import("better-auth").AuthContext) => Promise<{
+        response: Response;
+    } | {
+        request: Request;
+    } | void>;
+    init: (ctx: import("better-auth").AuthContext) => Promise<{
+        options: {
+            databaseHooks: {
+                session: {
+                    delete: {
+                        before(session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, unknown>, hookCtx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+                        after(session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, unknown>, hookCtx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+                    };
+                };
+            };
+        };
+    }>;
+    hooks: {
+        before: {
+            matcher(ctx: import("better-auth").HookEndpointContext): any;
+            handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+        }[];
+        after: {
+            matcher(ctx: import("better-auth").HookEndpointContext): boolean;
+            handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                redirect: true;
+                url: string;
+            } | undefined>>;
+        }[];
+    };
+    endpoints: {
+        getOAuthServerConfig: import("better-call").StrictEndpoint<"/.well-known/oauth-authorization-server", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").AuthServerMetadata>;
+        getOpenIdConfig: import("better-call").StrictEndpoint<"/.well-known/openid-configuration", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            jwks_uri?: string | undefined;
+            userinfo_endpoint: string;
+            acr_values_supported?: string[] | undefined;
+            subject_types_supported: ("public" | "pairwise")[];
+            claims_supported: string[];
+            claims_parameter_supported?: boolean | undefined;
+            end_session_endpoint: string;
+            request_parameter_supported?: boolean | undefined;
+            request_uri_parameter_supported?: boolean | undefined;
+            prompt_values_supported: import("@better-auth/oauth-provider").Prompt[];
+            issuer: string;
+            authorization_endpoint: string;
+            token_endpoint: string;
+            registration_endpoint?: string | undefined;
+            scopes_supported?: string[] | undefined;
+            response_types_supported: "code"[];
+            response_modes_supported: "query"[];
+            grant_types_supported: import("@better-auth/oauth-provider").GrantType[];
+            token_endpoint_auth_methods_supported?: import("@better-auth/oauth-provider").TokenEndpointAuthMethod[] | undefined;
+            token_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+            service_documentation?: string | undefined;
+            ui_locales_supported?: string[] | undefined;
+            op_policy_uri?: string | undefined;
+            op_tos_uri?: string | undefined;
+            revocation_endpoint?: string | undefined;
+            revocation_endpoint_auth_methods_supported?: import("@better-auth/oauth-provider").TokenEndpointAuthMethod[] | undefined;
+            revocation_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+            introspection_endpoint?: string | undefined;
+            introspection_endpoint_auth_methods_supported?: import("@better-auth/oauth-provider").TokenEndpointAuthMethod[] | undefined;
+            introspection_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+            code_challenge_methods_supported: "S256"[];
+            authorization_response_iss_parameter_supported?: boolean | undefined;
+            client_id_metadata_document_supported?: boolean | undefined;
+            backchannel_logout_supported?: boolean | undefined;
+            backchannel_logout_session_supported?: boolean | undefined;
+            dpop_signing_alg_values_supported?: import("better-auth/plugins/jwt").JWSAlgorithms[] | undefined;
+            id_token_signing_alg_values_supported: import("better-auth/plugins/jwt").JWSAlgorithms[] | ["HS256"];
+        }>;
+        oauth2Authorize: import("better-call").StrictEndpoint<"/oauth2/authorize", {
+            method: ("GET" | "POST")[];
+            body: import("zod").ZodObject<{}, import("zod/v4/core").$loose>;
+            redirectOnError: import("@better-auth/oauth-provider").OAuthRedirectOnError<import("better-auth").GenericEndpointContext, {
+                redirect: true;
+                url: string;
+            }>;
+            metadata: {
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    parameters: ({
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "string";
+                            format?: undefined;
+                            minimum?: undefined;
+                            items?: undefined;
+                        };
+                        description: string;
+                    } | {
+                        name: string;
+                        in: "query";
+                        required: true;
+                        schema: {
+                            type: "string";
+                            format?: undefined;
+                            minimum?: undefined;
+                            items?: undefined;
+                        };
+                        description: string;
+                    } | {
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "string";
+                            format: string;
+                            minimum?: undefined;
+                            items?: undefined;
+                        };
+                        description: string;
+                    } | {
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "integer";
+                            minimum: number;
+                            format?: undefined;
+                            items?: undefined;
+                        };
+                        description: string;
+                    } | {
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "array";
+                            items: {
+                                type: "string";
+                            };
+                            format?: undefined;
+                            minimum?: undefined;
+                        };
+                        description: string;
+                    })[];
+                    responses: {
+                        "302": {
+                            description: string;
+                            headers: {
+                                Location: {
+                                    description: string;
+                                    schema: {
+                                        type: string;
+                                        format: string;
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            state: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            redirect: true;
+            url: string;
+        }>;
+        oauth2Consent: import("better-call").StrictEndpoint<"/oauth2/consent", {
+            method: "POST";
+            body: import("zod").ZodObject<{
+                accept: import("zod").ZodBoolean;
+                scope: import("zod").ZodOptional<import("zod").ZodString>;
+                claims: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>]>>;
+                oauth_query: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            redirect_uri: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            redirect: true;
+            url: string;
+        } | {
+            redirect: boolean;
+            url: string;
+        }>;
+        oauth2Continue: import("better-call").StrictEndpoint<"/oauth2/continue", {
+            method: "POST";
+            body: import("zod").ZodObject<{
+                selected: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                created: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                postLogin: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                oauth_query: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            redirect_uri: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            redirect: true;
+            url: string;
+        }>;
+        oauth2Token: import("better-call").StrictEndpoint<"/oauth2/token", {
+            method: "POST";
+            cloneRequest: true;
+            body: import("zod").ZodObject<{
+                grant_type: import("zod").ZodString;
+                client_id: import("zod").ZodOptional<import("zod").ZodString>;
+                client_secret: import("zod").ZodOptional<import("zod").ZodString>;
+                client_assertion: import("zod").ZodOptional<import("zod").ZodString>;
+                client_assertion_type: import("zod").ZodOptional<import("zod").ZodString>;
+                code: import("zod").ZodOptional<import("zod").ZodString>;
+                code_verifier: import("zod").ZodOptional<import("zod").ZodString>;
+                redirect_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                refresh_token: import("zod").ZodOptional<import("zod").ZodString>;
+                resource: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodArray<import("zod").ZodString>]>>;
+                scope: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$loose>;
+            errorCodesByField: {
+                grant_type: {
+                    missing: "invalid_request";
+                    invalid: "unsupported_grant_type";
+                };
+                resource: {
+                    invalid: "invalid_target";
+                };
+            };
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    parameters: {
+                        name: string;
+                        in: "header";
+                        required: false;
+                        schema: {
+                            type: "string";
+                        };
+                        description: string;
+                    }[];
+                    requestBody: {
+                        required: boolean;
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object";
+                                    properties: {
+                                        grant_type: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_id: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_secret: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        code: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        code_verifier: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        redirect_uri: {
+                                            type: string;
+                                            format: string;
+                                            description: string;
+                                        };
+                                        refresh_token: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        resource: {
+                                            oneOf: ({
+                                                type: string;
+                                                description: string;
+                                                items?: undefined;
+                                            } | {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            })[];
+                                            description: string;
+                                        };
+                                        scope: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            access_token: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            token_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            expires_in: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            refresh_token: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            id_token: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            error_uri: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            expires_in: number;
+            access_token: string;
+            expires_at: number;
+            token_type: import("@better-auth/oauth-provider").TokenType;
+            refresh_token: string | undefined;
+            scope: string;
+            id_token: string | undefined;
+        }>;
+        oauth2Introspect: import("better-call").StrictEndpoint<"/oauth2/introspect", {
+            method: "POST";
+            cloneRequest: true;
+            body: import("zod").ZodObject<{
+                client_id: import("zod").ZodOptional<import("zod").ZodString>;
+                client_secret: import("zod").ZodOptional<import("zod").ZodString>;
+                client_assertion: import("zod").ZodOptional<import("zod").ZodString>;
+                client_assertion_type: import("zod").ZodOptional<import("zod").ZodString>;
+                token: import("zod").ZodString;
+                token_type_hint: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    requestBody: {
+                        required: boolean;
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object";
+                                    properties: {
+                                        client_id: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_secret: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token_type_hint: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            active: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            username: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            token_type: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            exp: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            iat: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            nbf: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            sub: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            aud: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            iss: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            jti: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            error_uri: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("jose").JWTPayload>;
+        oauth2Revoke: import("better-call").StrictEndpoint<"/oauth2/revoke", {
+            method: "POST";
+            cloneRequest: true;
+            body: import("zod").ZodObject<{
+                client_id: import("zod").ZodOptional<import("zod").ZodString>;
+                client_secret: import("zod").ZodOptional<import("zod").ZodString>;
+                client_assertion: import("zod").ZodOptional<import("zod").ZodString>;
+                client_assertion_type: import("zod").ZodOptional<import("zod").ZodString>;
+                token: import("zod").ZodString;
+                token_type_hint: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    requestBody: {
+                        required: boolean;
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object";
+                                    properties: {
+                                        client_id: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_secret: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token_type_hint: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        description: string;
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            error_uri: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, null | undefined>;
+        oauth2UserInfo: import("better-call").StrictEndpoint<"/oauth2/userinfo", {
+            method: ("GET" | "POST")[];
+            body: import("zod").ZodOptional<import("zod").ZodObject<{
+                access_token: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$loose>>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    security: ({
+                        bearerAuth: never[];
+                        OAuth2?: undefined;
+                    } | {
+                        OAuth2: string[];
+                        bearerAuth?: undefined;
+                    })[];
+                    parameters: {
+                        name: string;
+                        in: "header";
+                        required: false;
+                        schema: {
+                            type: "string";
+                        };
+                        description: string;
+                    }[];
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            sub: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            email: {
+                                                type: string;
+                                                format: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            name: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            picture: {
+                                                type: string;
+                                                format: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            given_name: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            family_name: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            email_verified: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "401": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "403": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            sub: unknown;
+        }>;
+        oauth2EndSession: import("better-call").StrictEndpoint<"/oauth2/end-session", {
+            method: ("GET" | "POST")[];
+            body: import("zod").ZodOptional<import("zod").ZodObject<{
+                id_token_hint: import("zod").ZodOptional<import("zod").ZodString>;
+                client_id: import("zod").ZodOptional<import("zod").ZodString>;
+                post_logout_redirect_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                state: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>>;
+            query: import("zod").ZodOptional<import("zod").ZodObject<{
+                id_token_hint: import("zod").ZodOptional<import("zod").ZodString>;
+                client_id: import("zod").ZodOptional<import("zod").ZodString>;
+                post_logout_redirect_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                state: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                $Infer: {
+                    body: {
+                        id_token_hint?: string;
+                        client_id?: string;
+                        post_logout_redirect_uri?: string;
+                        state?: string;
+                    } | {
+                        query: {
+                            id_token_hint?: string;
+                            client_id?: string;
+                            post_logout_redirect_uri?: string;
+                            state?: string;
+                        };
+                    };
+                    query: {
+                        id_token_hint?: string;
+                        client_id?: string;
+                        post_logout_redirect_uri?: string;
+                        state?: string;
+                    };
+                };
+                openapi: {
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            redirect_uri: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                            message: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                    };
+                                };
+                                "text/html": {
+                                    schema: {
+                                        type: "string";
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, Response | {
+            redirect: true;
+            url: string;
+        } | null>;
+        oauth2EndSessionConfirmation: import("better-call").StrictEndpoint<"/oauth2/end-session/confirm", {
+            method: "POST";
+            body: import("zod").ZodObject<{
+                action: import("zod").ZodLiteral<"confirm">;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                scope: "http";
+            };
+        }, Response | {
+            redirect: true;
+            url: string;
+        } | null>;
+        registerOAuthClient: import("better-call").StrictEndpoint<"/oauth2/register", {
+            method: "POST";
+            body: import("zod").ZodObject<{
+                redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                scope: import("zod").ZodOptional<import("zod").ZodString>;
+                client_name: import("zod").ZodOptional<import("zod").ZodString>;
+                client_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                logo_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                contacts: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                tos_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                policy_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                software_id: import("zod").ZodOptional<import("zod").ZodString>;
+                software_version: import("zod").ZodOptional<import("zod").ZodString>;
+                software_statement: import("zod").ZodOptional<import("zod").ZodString>;
+                post_logout_redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                backchannel_logout_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                backchannel_logout_session_required: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                token_endpoint_auth_method: import("zod").ZodOptional<import("zod").ZodString>;
+                jwks: import("zod").ZodOptional<import("zod").ZodObject<{
+                    keys: import("zod").ZodArray<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+                }, import("zod/v4/core").$strip>>;
+                jwks_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                grant_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                response_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
+                    code: "code";
+                }>>>;
+                application_type: import("zod").ZodOptional<import("zod").ZodEnum<{
+                    web: "web";
+                    native: "native";
+                }>>;
+                subject_type: import("zod").ZodOptional<import("zod").ZodEnum<{
+                    public: "public";
+                    pairwise: "pairwise";
+                }>>;
+                dpop_bound_access_tokens: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                resources: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                skip_consent: import("zod").ZodOptional<import("zod").ZodNever>;
+            }, import("zod/v4/core").$strip>;
+            errorCodesByField: {
+                redirect_uris: "invalid_redirect_uri";
+                post_logout_redirect_uris: "invalid_redirect_uri";
+                software_statement: "invalid_software_statement";
+                resources: "invalid_target";
+            };
+            defaultError: "invalid_client_metadata";
+            metadata: {
+                noStore: boolean;
+                openapi: {
+                    description: string;
+                    responses: {
+                        "201": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret_expires_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            user_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id_issued_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_name: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            logo_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            contacts: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            tos_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            policy_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_version: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_statement: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            post_logout_redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            backchannel_logout_uri: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                            backchannel_logout_session_required: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            token_endpoint_auth_method: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            grant_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            response_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                description: string;
+                                            };
+                                            application_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            resources: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            disabled: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientRegistrationResponse>;
+        adminCreateOAuthClient: import("better-call").StrictEndpoint<"/admin/oauth2/create-client", {
+            method: "POST";
+            body: import("zod").ZodObject<{
+                redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                scope: import("zod").ZodOptional<import("zod").ZodString>;
+                client_name: import("zod").ZodOptional<import("zod").ZodString>;
+                client_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                logo_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                contacts: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                tos_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                policy_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                software_id: import("zod").ZodOptional<import("zod").ZodString>;
+                software_version: import("zod").ZodOptional<import("zod").ZodString>;
+                software_statement: import("zod").ZodOptional<import("zod").ZodString>;
+                post_logout_redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                backchannel_logout_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                backchannel_logout_session_required: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                token_endpoint_auth_method: import("zod").ZodOptional<import("zod").ZodString>;
+                application_type: import("zod").ZodOptional<import("zod").ZodEnum<{
+                    web: "web";
+                    native: "native";
+                }>>;
+                jwks: import("zod").ZodOptional<import("zod").ZodObject<{
+                    keys: import("zod").ZodArray<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+                }, import("zod/v4/core").$strip>>;
+                jwks_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                grant_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                client_credentials_scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                resources: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                response_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
+                    code: "code";
+                }>>>;
+                client_secret_expires_at: import("zod").ZodDefault<import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodNumber]>>>;
+                skip_consent: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                enable_end_session: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                require_pkce: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                dpop_bound_access_tokens: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                subject_type: import("zod").ZodOptional<import("zod").ZodEnum<{
+                    public: "public";
+                    pairwise: "pairwise";
+                }>>;
+                metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                noStore: boolean;
+                SERVER_ONLY: true;
+                openapi: {
+                    description: string;
+                    responses: {
+                        "201": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret_expires_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_credentials_scopes: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            user_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id_issued_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_name: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            logo_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            contacts: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            tos_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            policy_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_version: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_statement: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            token_endpoint_auth_method: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            grant_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            response_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                description: string;
+                                            };
+                                            application_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            resources: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            disabled: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            require_pkce: {
+                                                type: string;
+                                                description: string;
+                                                default: boolean;
+                                            };
+                                            metadata: {
+                                                type: string;
+                                                additionalProperties: boolean;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientAdministrativeResponse>;
+        createOAuthClient: import("better-call").StrictEndpoint<"/oauth2/create-client", {
+            method: "POST";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: import("zod").ZodObject<{
+                redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                scope: import("zod").ZodOptional<import("zod").ZodString>;
+                client_name: import("zod").ZodOptional<import("zod").ZodString>;
+                client_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                logo_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                contacts: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                tos_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                policy_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                software_id: import("zod").ZodOptional<import("zod").ZodString>;
+                software_version: import("zod").ZodOptional<import("zod").ZodString>;
+                software_statement: import("zod").ZodOptional<import("zod").ZodString>;
+                post_logout_redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                backchannel_logout_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                backchannel_logout_session_required: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                token_endpoint_auth_method: import("zod").ZodOptional<import("zod").ZodString>;
+                application_type: import("zod").ZodOptional<import("zod").ZodEnum<{
+                    web: "web";
+                    native: "native";
+                }>>;
+                jwks: import("zod").ZodOptional<import("zod").ZodObject<{
+                    keys: import("zod").ZodArray<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+                }, import("zod/v4/core").$strip>>;
+                jwks_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                grant_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                response_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
+                    code: "code";
+                }>>>;
+                dpop_bound_access_tokens: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                noStore: boolean;
+                openapi: {
+                    description: string;
+                    responses: {
+                        "201": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret_expires_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            user_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id_issued_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_name: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            logo_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            contacts: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            tos_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            policy_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_version: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_statement: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            token_endpoint_auth_method: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            grant_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            response_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                description: string;
+                                            };
+                                            application_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            resources: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            disabled: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            metadata: {
+                                                type: string;
+                                                additionalProperties: boolean;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientRegistrationResponse>;
+        getOAuthClient: import("better-call").StrictEndpoint<"/oauth2/get-client", {
+            method: "GET";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            query: import("zod").ZodObject<{
+                client_id: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        getOAuthClientPublic: import("better-call").StrictEndpoint<"/oauth2/public-client", {
+            method: "GET";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            query: import("zod").ZodObject<{
+                client_id: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        getOAuthClientPublicPrelogin: import("better-call").StrictEndpoint<"/oauth2/public-client-prelogin", {
+            method: "POST";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>[];
+            body: import("zod").ZodObject<{
+                client_id: import("zod").ZodString;
+                oauth_query: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        getOAuthClients: import("better-call").StrictEndpoint<"/oauth2/get-clients", {
+            method: "GET";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient[] | null>;
+        adminUpdateOAuthClient: import("better-call").StrictEndpoint<"/admin/oauth2/update-client", {
+            method: "PATCH";
+            body: import("zod").ZodObject<{
+                client_id: import("zod").ZodString;
+                update: import("zod").ZodObject<{
+                    redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                    scope: import("zod").ZodOptional<import("zod").ZodString>;
+                    client_name: import("zod").ZodOptional<import("zod").ZodString>;
+                    client_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    logo_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    contacts: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    tos_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    policy_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    software_id: import("zod").ZodOptional<import("zod").ZodString>;
+                    software_version: import("zod").ZodOptional<import("zod").ZodString>;
+                    software_statement: import("zod").ZodOptional<import("zod").ZodString>;
+                    post_logout_redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                    backchannel_logout_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                    backchannel_logout_session_required: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    application_type: import("zod").ZodOptional<import("zod").ZodEnum<{
+                        web: "web";
+                        native: "native";
+                    }>>;
+                    grant_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    client_credentials_scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    response_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
+                        code: "code";
+                    }>>>;
+                    client_secret_expires_at: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodString, import("zod").ZodNumber]>>;
+                    skip_consent: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    enable_end_session: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    disabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    dpop_bound_access_tokens: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+                }, import("zod/v4/core").$strip>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientAdministrativeResponse>;
+        updateOAuthClient: import("better-call").StrictEndpoint<"/oauth2/update-client", {
+            method: "POST";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: import("zod").ZodObject<{
+                client_id: import("zod").ZodString;
+                update: import("zod").ZodObject<{
+                    redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                    scope: import("zod").ZodOptional<import("zod").ZodString>;
+                    client_name: import("zod").ZodOptional<import("zod").ZodString>;
+                    client_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    logo_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    contacts: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    tos_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    policy_uri: import("zod").ZodOptional<import("zod").ZodString>;
+                    software_id: import("zod").ZodOptional<import("zod").ZodString>;
+                    software_version: import("zod").ZodOptional<import("zod").ZodString>;
+                    software_statement: import("zod").ZodOptional<import("zod").ZodString>;
+                    post_logout_redirect_uris: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodURL>>;
+                    backchannel_logout_uri: import("zod").ZodOptional<import("zod").ZodURL>;
+                    backchannel_logout_session_required: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                    application_type: import("zod").ZodOptional<import("zod").ZodEnum<{
+                        web: "web";
+                        native: "native";
+                    }>>;
+                    grant_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
+                    response_types: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
+                        code: "code";
+                    }>>>;
+                }, import("zod/v4/core").$strip>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientRegistrationResponse>;
+        rotateClientSecret: import("better-call").StrictEndpoint<"/oauth2/client/rotate-secret", {
+            method: "POST";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: import("zod").ZodObject<{
+                client_id: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                noStore: boolean;
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        deleteOAuthClient: import("better-call").StrictEndpoint<"/oauth2/delete-client", {
+            method: "POST";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: import("zod").ZodObject<{
+                client_id: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, void>;
+        getOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/get-consent", {
+            method: "GET";
+            query: import("zod").ZodObject<{
+                id: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>;
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthConsent<import("@better-auth/oauth-provider").Scope[]>>;
+        getOAuthConsents: import("better-call").StrictEndpoint<"/oauth2/get-consents", {
+            method: "GET";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthConsent<import("@better-auth/oauth-provider").Scope[]>[]>;
+        updateOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/update-consent", {
+            method: "POST";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: import("zod").ZodObject<{
+                id: import("zod").ZodString;
+                update: import("zod").ZodObject<{
+                    scopes: import("zod").ZodArray<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthConsent<import("@better-auth/oauth-provider").Scope[]> | null>;
+        deleteOAuthConsent: import("better-call").StrictEndpoint<"/oauth2/delete-consent", {
+            method: "POST";
+            use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: import("zod").ZodObject<{
+                id: import("zod").ZodString;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, void>;
+        adminCreateOAuthResource: import("better-call").StrictEndpoint<"/admin/oauth2/resources", {
+            method: "POST";
+            body: import("zod").ZodObject<{
+                identifier: import("zod").ZodNonOptional<import("zod").ZodOptional<import("zod").ZodString>>;
+                name: import("zod").ZodOptional<import("zod").ZodString>;
+                accessTokenTtl: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+                refreshTokenTtl: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+                signingAlgorithm: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodEnum<{
+                    RS256: "RS256";
+                    PS256: "PS256";
+                    ES256: "ES256";
+                    ES512: "ES512";
+                    EdDSA: "EdDSA";
+                }>>>;
+                signingKeyId: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+                allowedScopes: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodString>>>;
+                customClaims: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>;
+                dpopBoundAccessTokensRequired: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                disabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                metadata: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource>;
+        adminListOAuthResources: import("better-call").StrictEndpoint<"/admin/oauth2/resources", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource[]>;
+        adminGetOAuthResource: import("better-call").StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource>;
+        adminUpdateOAuthResource: import("better-call").StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+            method: "PATCH";
+            body: import("zod").ZodObject<{
+                identifier: import("zod").ZodOptional<import("zod").ZodString>;
+                name: import("zod").ZodOptional<import("zod").ZodString>;
+                accessTokenTtl: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+                refreshTokenTtl: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+                signingAlgorithm: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodEnum<{
+                    RS256: "RS256";
+                    PS256: "PS256";
+                    ES256: "ES256";
+                    ES512: "ES512";
+                    EdDSA: "EdDSA";
+                }>>>;
+                signingKeyId: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+                allowedScopes: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodArray<import("zod").ZodString>>>;
+                customClaims: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>;
+                dpopBoundAccessTokensRequired: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                disabled: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                metadata: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>>;
+            }, import("zod/v4/core").$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource>;
+        adminDeleteOAuthResource: import("better-call").StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+            method: "DELETE";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            deleted: boolean;
+        }>;
+        adminLinkClientResource: import("better-call").StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+            method: "POST";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            linked: boolean;
+        }>;
+        adminUnlinkClientResource: import("better-call").StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+            method: "DELETE";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            unlinked: boolean;
+        }>;
+    };
+    schema: {
+        oauthClient: {
+            modelName: string;
+            fields: {
+                clientId: {
+                    type: "string";
+                    unique: true;
+                    required: true;
+                };
+                clientSecret: {
+                    type: "string";
+                    required: false;
+                };
+                clientDiscoveryId: {
+                    type: "string";
+                    required: false;
+                };
+                disabled: {
+                    type: "boolean";
+                    defaultValue: false;
+                    required: false;
+                };
+                skipConsent: {
+                    type: "boolean";
+                    required: false;
+                };
+                enableEndSession: {
+                    type: "boolean";
+                    required: false;
+                };
+                subjectType: {
+                    type: "string";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: false;
+                };
+                clientCredentialsScopes: {
+                    type: "string[]";
+                    required: false;
+                    defaultValue: never[];
+                };
+                userId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                createdAt: {
+                    type: "date";
+                    required: false;
+                };
+                updatedAt: {
+                    type: "date";
+                    required: false;
+                };
+                name: {
+                    type: "string";
+                    required: false;
+                };
+                uri: {
+                    type: "string";
+                    required: false;
+                };
+                icon: {
+                    type: "string";
+                    required: false;
+                };
+                contacts: {
+                    type: "string[]";
+                    required: false;
+                };
+                tos: {
+                    type: "string";
+                    required: false;
+                };
+                policy: {
+                    type: "string";
+                    required: false;
+                };
+                softwareId: {
+                    type: "string";
+                    required: false;
+                };
+                softwareVersion: {
+                    type: "string";
+                    required: false;
+                };
+                softwareStatement: {
+                    type: "string";
+                    required: false;
+                };
+                redirectUris: {
+                    type: "string[]";
+                    required: true;
+                };
+                postLogoutRedirectUris: {
+                    type: "string[]";
+                    required: false;
+                };
+                backchannelLogoutUri: {
+                    type: "string";
+                    required: false;
+                };
+                backchannelLogoutSessionRequired: {
+                    type: "boolean";
+                    required: false;
+                };
+                tokenEndpointAuthMethod: {
+                    type: "string";
+                    required: false;
+                };
+                applicationType: {
+                    type: "string";
+                    required: false;
+                };
+                jwks: {
+                    type: "string";
+                    required: false;
+                };
+                jwksUri: {
+                    type: "string";
+                    required: false;
+                };
+                grantTypes: {
+                    type: "string[]";
+                    required: false;
+                };
+                responseTypes: {
+                    type: "string[]";
+                    required: false;
+                };
+                requirePKCE: {
+                    type: "boolean";
+                    required: false;
+                };
+                dpopBoundAccessTokens: {
+                    type: "boolean";
+                    required: false;
+                    defaultValue: false;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                metadata: {
+                    type: "json";
+                    required: false;
+                };
+            };
+        };
+        oauthResource: {
+            modelName: string;
+            fields: {
+                identifier: {
+                    type: "string";
+                    required: true;
+                    unique: true;
+                };
+                name: {
+                    type: "string";
+                    required: true;
+                };
+                accessTokenTtl: {
+                    type: "number";
+                    required: false;
+                };
+                refreshTokenTtl: {
+                    type: "number";
+                    required: false;
+                };
+                signingAlgorithm: {
+                    type: "string";
+                    required: false;
+                };
+                signingKeyId: {
+                    type: "string";
+                    required: false;
+                };
+                allowedScopes: {
+                    type: "string[]";
+                    required: false;
+                };
+                customClaims: {
+                    type: "json";
+                    required: false;
+                };
+                dpopBoundAccessTokensRequired: {
+                    type: "boolean";
+                    required: false;
+                    defaultValue: false;
+                };
+                disabled: {
+                    type: "boolean";
+                    required: false;
+                    defaultValue: false;
+                };
+                createdAt: {
+                    type: "date";
+                    required: false;
+                };
+                updatedAt: {
+                    type: "date";
+                    required: false;
+                };
+                policyVersion: {
+                    type: "number";
+                    required: false;
+                    defaultValue: number;
+                };
+                metadata: {
+                    type: "json";
+                    required: false;
+                };
+            };
+        };
+        oauthClientResource: {
+            modelName: string;
+            fields: {
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "cascade";
+                    };
+                    index: true;
+                };
+                resourceId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "cascade";
+                    };
+                    index: true;
+                };
+                metadata: {
+                    type: "json";
+                    required: false;
+                };
+                createdAt: {
+                    type: "date";
+                    required: false;
+                };
+            };
+            indexes: {
+                fields: [string, string];
+                unique: true;
+            }[];
+        };
+        oauthRefreshToken: {
+            fields: {
+                token: {
+                    type: "string";
+                    required: true;
+                    unique: true;
+                };
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                sessionId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "set null";
+                    };
+                    index: true;
+                };
+                userId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                authorizationCodeId: {
+                    type: "string";
+                    required: false;
+                    index: true;
+                };
+                resources: {
+                    type: "string[]";
+                    required: false;
+                };
+                requestedUserInfoClaims: {
+                    type: "string[]";
+                    required: false;
+                };
+                expiresAt: {
+                    type: "date";
+                };
+                createdAt: {
+                    type: "date";
+                };
+                revoked: {
+                    type: "date";
+                    required: false;
+                };
+                rotatedAt: {
+                    type: "date";
+                    required: false;
+                };
+                rotationReplayResponse: {
+                    type: "string";
+                    required: false;
+                };
+                rotationReplayExpiresAt: {
+                    type: "date";
+                    required: false;
+                };
+                authTime: {
+                    type: "date";
+                    required: false;
+                };
+                confirmation: {
+                    type: "json";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: true;
+                };
+            };
+        };
+        oauthAccessToken: {
+            modelName: string;
+            fields: {
+                token: {
+                    type: "string";
+                    unique: true;
+                };
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                sessionId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "set null";
+                    };
+                    index: true;
+                };
+                userId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                authorizationCodeId: {
+                    type: "string";
+                    required: false;
+                    index: true;
+                };
+                resources: {
+                    type: "string[]";
+                    required: false;
+                };
+                requestedUserInfoClaims: {
+                    type: "string[]";
+                    required: false;
+                };
+                refreshId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                expiresAt: {
+                    type: "date";
+                };
+                createdAt: {
+                    type: "date";
+                };
+                revoked: {
+                    type: "date";
+                    required: false;
+                };
+                confirmation: {
+                    type: "json";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: true;
+                };
+            };
+        };
+        oauthConsent: {
+            modelName: string;
+            fields: {
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                userId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                resources: {
+                    type: "string[]";
+                    required: false;
+                };
+                requestedUserInfoClaims: {
+                    type: "string[]";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: true;
+                };
+                createdAt: {
+                    type: "date";
+                };
+                updatedAt: {
+                    type: "date";
+                };
+            };
+        };
+        oauthClientAssertion: {
+            modelName: string;
+            fields: {
+                expiresAt: {
+                    type: "date";
+                    required: true;
+                };
+            };
+        };
+    };
+    rateLimit: ({
+        pathMatcher: (path: string) => path is "/oauth2/token";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/authorize";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/introspect";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/revoke";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/register";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/userinfo";
+        window: number;
+        max: number;
+    })[];
+})[];
+export declare namespace plugins {
+    type Options = {
+        /**
+         * Returns whether the authorization of the app with `clientId` needs the account step, which
+         * the `/choose-account` page shows. Absent, no authorization shows it.
+         */
+        accountStep?: ((options: {
+            clientId: string;
+            headers: Headers;
+            sessionId: string;
+            userId: string;
+        }) => Promise<boolean>) | undefined;
+        /** Tempo ID's origin, such as `https://id.tempo.xyz`. */
+        baseURL: string;
+        /**
+         * Takes the key authorization held for the app with `clientId`, the PKCE challenge
+         * `codeChallenge`, and the code's user, as `PendingKey.take` does. Absent, a code's redemption returns no key.
+         */
+        pendingKey?: ((options: {
+            clientId: string;
+            codeChallenge: string;
+            userId: string;
+        }) => Promise<PendingKey.PendingKey | undefined>) | undefined;
+    };
+}
+/**
+ * Removes the app with `clientId`, with its consents, tokens, and realms. Throws `NotFoundError`
+ * when no app has it.
+ */
+export declare function remove(db: Realm.Database, options: remove.Options): Promise<App>;
+export declare namespace remove {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+    };
+}
+/**
+ * Replaces the client secret of the app with `clientId`, and returns the app with the new secret.
+ * The earlier secret stops working at once.
+ *
+ * Throws `NotFoundError` when no app has the client ID, `PublicError` when the app has no client
+ * secret, and `InvalidError` for an invalid `clientSecret` or one that matches the current secret.
+ */
+export declare function rotateSecret(db: Realm.Database, options: rotateSecret.Options): Promise<{
+    app: App;
+    clientSecret: string;
+}>;
+export declare namespace rotateSecret {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+        /** The new client secret, such as the one that another deployment issued. Defaults to a new secret. */
+        clientSecret?: string | undefined;
+    };
+}
+/**
+ * Updates the app with `clientId`, and returns it. A value left out stays.
+ *
+ * Throws `NotFoundError` when no app has the client ID, and `InvalidError` for an invalid name or
+ * redirect URI.
+ */
+export declare function update(db: Realm.Database, options: update.Options): Promise<App>;
+export declare namespace update {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+        /** The display name. */
+        name?: string | undefined;
+        /** Every URI that `GET /oauth2/end-session` may return to. They replace the earlier ones, and none clears them. */
+        postLogoutRedirectUris?: readonly string[] | undefined;
+        /** Every URI that the app returns to. They replace the earlier ones. */
+        redirectUris?: readonly string[] | undefined;
+        /** Whether the app holds the `tempo-id:sign` scope. */
+        sign?: boolean | undefined;
+        /** Whether a request without a key skips the approval page. */
+        skipConsent?: boolean | undefined;
+    };
+}
+//# sourceMappingURL=Apps.d.ts.map