@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/internal/Apps.d.ts

@@ -0,0 +1,3169 @@
+import type { ClientMetadataResourceFetch } from '@better-auth/oauth-provider';
+import { z } from 'zod';
+import type * as Cache from './Cache.js';
+import type * as PendingKey from './PendingKey.js';
+import type * as Realm from './Realm.js';
+/** Another app already has the client ID. */
+export declare class ExistsError extends Error {
+    readonly name = "Apps.ExistsError";
+    constructor(options: {
+        clientId: string;
+    });
+}
+/** A name, a redirect URI, or another value of an app is not valid. */
+export declare class InvalidError extends Error {
+    readonly name = "Apps.InvalidError";
+}
+/** No OAuth app has the client ID. */
+export declare class NotFoundError extends Error {
+    readonly name = "Apps.NotFoundError";
+    constructor(options: {
+        clientId: string;
+    });
+}
+/** The app redeems codes with PKCE alone, so it has no client secret to rotate. */
+export declare class PublicError extends Error {
+    readonly name = "Apps.PublicError";
+    constructor(options: {
+        clientId: string;
+    });
+}
+/** An OAuth app, as `tempo-id admin apps` returns it. */
+export type App = {
+    /** Sent as `client_id`. */
+    clientId: string;
+    /** When the app was created. */
+    createdAt: Date | null;
+    /** Whether the app signs in through the device grant, as a CLI does. */
+    device: boolean;
+    /** Whether `tempo-id admin apps` registered the app, which then skips consent for keyless requests. */
+    firstParty: boolean;
+    /** The logo as a `data:` URL. Only an app with an origin client ID has one. */
+    logo: string | null;
+    /** The display name on the approval page. */
+    name: string | null;
+    /** The URIs that `GET /oauth2/end-session` may return to. */
+    postLogoutRedirectUris: readonly string[];
+    /** The URIs that the app returns to. */
+    redirectUris: readonly string[];
+    /** Whether the app holds a client secret for its backend. */
+    secret: boolean;
+    /** Whether the app holds the `tempo-id:sign` scope. */
+    sign: boolean;
+    /** `web` for a browser app or a backend, and `native` for a mobile app. */
+    type: 'native' | 'web';
+};
+/** The grant type of the device grant (RFC 8628 §3.4). */
+export declare const deviceGrant = "urn:ietf:params:oauth:grant-type:device_code";
+/** Lets an app bind its own challenge, and request unknown key calls headlessly. */
+export declare const signScope = "tempo-id:sign";
+/** Returns whether `clientSecret` matches the enabled app, which selects a rate limit's app. */
+export declare function authenticate(db: Realm.Database, options: authenticate.Options): Promise<boolean>;
+export declare namespace authenticate {
+    type Options = {
+        /** The client ID that the request names. */
+        clientId: string;
+        /** The client secret that the request sends. */
+        clientSecret: string;
+    };
+}
+/**
+ * Registers an app, and returns it with its client secret, which appears only here. Throws
+ * `InvalidError` for an invalid value, and `ExistsError` for a client ID in use.
+ */
+export declare function create(db: Realm.Database, options: create.Options): Promise<{
+    app: App;
+    clientSecret?: string;
+}>;
+export declare namespace create {
+    type Options = {
+        /** Another deployment's client ID to keep. Defaults to 32 random letters. */
+        clientId?: string | undefined;
+        /** Another deployment's client secret to keep. Implies `secret`. */
+        clientSecret?: string | undefined;
+        /** Whether the app signs in through the device grant. Defaults to `false`. */
+        device?: boolean | undefined;
+        /** The display name on the approval page. */
+        name: string;
+        /** The URIs that `GET /oauth2/end-session` may return to. Defaults to none. */
+        postLogoutRedirectUris?: readonly string[] | undefined;
+        /** The URIs that the app returns to, in every environment. A device app may have none. */
+        redirectUris?: readonly string[] | undefined;
+        /** Whether the app receives a new client secret. Defaults to `false`. */
+        secret?: boolean | undefined;
+        /** Whether the app holds the `tempo-id:sign` scope. Defaults to `false`. */
+        sign?: boolean | undefined;
+        /** The application type. Defaults to `web`. */
+        type?: App['type'] | undefined;
+    };
+}
+/**
+ * Returns the fetch of third-party apps' metadata documents, through `fetcher`. It refuses
+ * redirects, since a document must sit at its client ID's URL.
+ */
+export declare function fetchMetadata(fetcher?: fetchMetadata.Fetcher): ClientMetadataResourceFetch;
+export declare namespace fetchMetadata {
+    /** The global scope or a service binding. */
+    type Fetcher = {
+        /** Fetches the request. */
+        fetch: (request: Request) => Promise<Response>;
+    };
+}
+/** Returns the enabled first-party apps with a redirect URI at `origin`. */
+export declare function firstPartyOrigin(db: Realm.Database, options: firstPartyOrigin.Options): Promise<readonly App[]>;
+export declare namespace firstPartyOrigin {
+    type Options = {
+        /** The request's `Origin`. */
+        origin: string;
+    };
+}
+/**
+ * Returns the app with `clientId`. Throws `NotFoundError` if it is unknown, or disabled with
+ * `enabled`.
+ */
+export declare function get(db: Realm.Database, options: get.Options): Promise<App>;
+export declare namespace get {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+        /** Whether a disabled app counts as no app. Defaults to `false`. */
+        enabled?: boolean | undefined;
+    };
+}
+/** Returns the SHA-256 hash of a client secret as unpadded base64url, as the row holds it. */
+export declare function hashSecret(secret: string): Promise<string>;
+/** Returns every registered app, oldest first, without third-party apps. */
+export declare function list(db: Realm.Database): Promise<readonly App[]>;
+/** Returns the Better Auth plugins that serve OAuth apps: the JWT plugin and the OAuth provider. */
+export declare function plugins(options: plugins.Options): ({
+    id: "jwt";
+    version: string;
+    options: NoInfer<{
+        adapter: {
+            getJwks: (ctx: import("better-auth").GenericEndpointContext) => Promise<import("better-auth/plugins/jwt").Jwk[]>;
+        };
+        disableSettingJwtHeader: true;
+        jwks: {
+            gracePeriod: number;
+            jwksPath: string;
+            keyPairConfig: {
+                alg: 'RS256';
+                modulusLength: number;
+            };
+        };
+        jwt: {
+            issuer: string;
+        };
+    }>;
+    init(ctx: import("better-auth").AuthContext): {
+        context: {
+            sessionConfig: {
+                cookieCacheSigner: import("better-auth").CookieCacheSigner;
+                updateAge: number;
+                expiresIn: number;
+                freshAge: number;
+                cookieRefreshCache: false | {
+                    enabled: true;
+                    updateAge: number;
+                };
+            };
+        };
+    } | undefined;
+    endpoints: {
+        getJwks: import("better-auth").StrictEndpoint<string, {
+            method: "GET";
+            metadata: {
+                openapi: {
+                    operationId: string;
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            keys: {
+                                                type: string;
+                                                description: string;
+                                                items: {
+                                                    type: string;
+                                                    properties: {
+                                                        kid: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        kty: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        alg: {
+                                                            type: string;
+                                                            description: string;
+                                                        };
+                                                        use: {
+                                                            type: string;
+                                                            description: string;
+                                                            enum: string[];
+                                                            nullable: boolean;
+                                                        };
+                                                        n: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        e: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        crv: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        x: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                        y: {
+                                                            type: string;
+                                                            description: string;
+                                                            nullable: boolean;
+                                                        };
+                                                    };
+                                                    required: string[];
+                                                };
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("better-auth").JSONWebKeySet>;
+        getToken: import("better-auth").StrictEndpoint<"/token", {
+            method: "GET";
+            requireHeaders: true;
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    operationId: string;
+                    description: string;
+                    responses: {
+                        200: {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            token: {
+                                                type: string;
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            token: string;
+        }>;
+        signJWT: import("better-auth").StrictEndpoint<string, {
+            method: "POST";
+            metadata: {
+                $Infer: {
+                    body: {
+                        payload: import("better-auth").JWTPayload;
+                        overrideOptions?: import("better-auth/plugins/jwt").JwtOptions | undefined;
+                    };
+                };
+            };
+            body: z.ZodObject<{
+                payload: z.ZodRecord<z.ZodString, z.ZodAny>;
+                overrideOptions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+            }, z.core.$strip>;
+        }, {
+            token: string;
+        }>;
+        verifyJWT: import("better-auth").StrictEndpoint<string, {
+            method: "POST";
+            metadata: {
+                $Infer: {
+                    body: {
+                        token: string;
+                        issuer?: string;
+                    };
+                    response: {
+                        payload: {
+                            sub: string;
+                            aud: string;
+                            [key: string]: any;
+                        } | null;
+                    };
+                };
+            };
+            body: z.ZodObject<{
+                token: z.ZodString;
+                issuer: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        }, {
+            payload: (import("better-auth").JWTPayload & Required<Pick<import("better-auth").JWTPayload, "sub" | "aud">>) | null;
+        }>;
+    };
+    hooks: {
+        after: {
+            matcher(context: import("better-auth").HookEndpointContext): boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        }[];
+    };
+    schema: {
+        jwks: {
+            fields: {
+                publicKey: {
+                    type: "string";
+                    required: true;
+                };
+                privateKey: {
+                    type: "string";
+                    required: true;
+                };
+                createdAt: {
+                    type: "date";
+                    required: true;
+                };
+                expiresAt: {
+                    type: "date";
+                    required: false;
+                };
+                alg: {
+                    type: "string";
+                    required: false;
+                };
+                crv: {
+                    type: "string";
+                    required: false;
+                };
+            };
+        };
+    };
+} | {
+    id: "oauth-provider";
+    version: string;
+    options: NoInfer<{
+        allowDynamicClientRegistration: false;
+        cachedResources: Set<string>;
+        cachedTrustedClients: Set<string> & {
+            has: () => true;
+        };
+        clientRegistrationDefaultScopes: ("email" | "offline_access" | "openid" | "profile")[];
+        consentPage: string;
+        customIdTokenClaims: (info: {
+            user: {
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+            } & Record<string, unknown>;
+            scopes: import("@better-auth/oauth-provider").Scope[];
+            metadata?: Record<string, any>;
+        }) => {
+            email: string;
+            email_verified: boolean;
+        } | {
+            email?: never;
+            email_verified?: never;
+        };
+        enforcePerClientResources: false;
+        extensions: {
+            clientDiscovery: ({
+                id: string;
+                fetchClientMetadataResource?: ClientMetadataResourceFetch;
+                discoveryMetadata?: Record<string, unknown>;
+                matches: (clientId: string) => boolean;
+                resolve: (ctx: import("better-auth").GenericEndpointContext, clientId: string, existing: import("@better-auth/oauth-provider").SchemaClient<import("@better-auth/oauth-provider").Scope[]> | null) => Promise<import("@better-auth/oauth-provider").SchemaClient<import("@better-auth/oauth-provider").Scope[]> | null>;
+            } | {
+                id: string;
+                matches: typeof originId;
+                resolve: (ctx: import("better-auth").GenericEndpointContext, clientId: string, existing: import("@better-auth/oauth-provider").SchemaClient<import("@better-auth/oauth-provider").Scope[]> | null) => Promise<import("@better-auth/oauth-provider").SchemaClient<import("@better-auth/oauth-provider").Scope[]>>;
+            })[];
+        }[];
+        loginPage: string;
+        postLogin?: {
+            consentReferenceId: () => undefined;
+            page: string;
+            shouldRedirect: (context: {
+                headers: Headers;
+                session: {
+                    id: string;
+                };
+                user: {
+                    id: string;
+                };
+            }) => Promise<boolean>;
+        };
+        customTokenResponseFields?: (info: {
+            grantType: string;
+            user?: {
+                id: string;
+            } | null | undefined;
+            verificationValue?: {
+                query: {
+                    client_id: string;
+                    code_challenge?: string | undefined;
+                    key_authorization?: unknown;
+                };
+            };
+        }) => Promise<{
+            account?: never;
+            key_authorization?: never;
+        } | {
+            account: `0x${string}`;
+            key_authorization: import("ox/tempo/KeyAuthorization").Rpc;
+        }>;
+        resources: {
+            accessTokenTtl: number;
+            identifier: string;
+            name: string;
+        }[];
+        scopes: ("email" | "offline_access" | "openid" | "profile")[];
+        storeClientSecret: {
+            hash: typeof hashSecret;
+        };
+    }>;
+    onRequest: (request: Request, ctx: import("better-auth").AuthContext) => Promise<{
+        response: Response;
+    } | {
+        request: Request;
+    } | void>;
+    init: (ctx: import("better-auth").AuthContext) => Promise<{
+        options: {
+            databaseHooks: {
+                session: {
+                    delete: {
+                        before(session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, unknown>, hookCtx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+                        after(session: {
+                            id: string;
+                            createdAt: Date;
+                            updatedAt: Date;
+                            userId: string;
+                            expiresAt: Date;
+                            token: string;
+                            ipAddress?: string | null | undefined;
+                            userAgent?: string | null | undefined;
+                        } & Record<string, unknown>, hookCtx: import("better-auth").GenericEndpointContext | null): Promise<void>;
+                    };
+                };
+            };
+        };
+    }>;
+    hooks: {
+        before: {
+            matcher(ctx: import("better-auth").HookEndpointContext): any;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+        }[];
+        after: {
+            matcher(ctx: import("better-auth").HookEndpointContext): boolean;
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                redirect: true;
+                url: string;
+            } | undefined>>;
+        }[];
+    };
+    endpoints: {
+        getOAuthServerConfig: import("better-auth").StrictEndpoint<"/.well-known/oauth-authorization-server", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").AuthServerMetadata>;
+        getOpenIdConfig: import("better-auth").StrictEndpoint<"/.well-known/openid-configuration", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            jwks_uri?: string | undefined;
+            userinfo_endpoint: string;
+            acr_values_supported?: string[] | undefined;
+            subject_types_supported: ("public" | "pairwise")[];
+            claims_supported: string[];
+            claims_parameter_supported?: boolean | undefined;
+            end_session_endpoint: string;
+            request_parameter_supported?: boolean | undefined;
+            request_uri_parameter_supported?: boolean | undefined;
+            prompt_values_supported: import("@better-auth/oauth-provider").Prompt[];
+            issuer: string;
+            authorization_endpoint: string;
+            token_endpoint: string;
+            registration_endpoint?: string | undefined;
+            scopes_supported?: string[] | undefined;
+            response_types_supported: "code"[];
+            response_modes_supported: "query"[];
+            grant_types_supported: import("@better-auth/oauth-provider").GrantType[];
+            token_endpoint_auth_methods_supported?: import("@better-auth/oauth-provider").TokenEndpointAuthMethod[] | undefined;
+            token_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+            service_documentation?: string | undefined;
+            ui_locales_supported?: string[] | undefined;
+            op_policy_uri?: string | undefined;
+            op_tos_uri?: string | undefined;
+            revocation_endpoint?: string | undefined;
+            revocation_endpoint_auth_methods_supported?: import("@better-auth/oauth-provider").TokenEndpointAuthMethod[] | undefined;
+            revocation_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+            introspection_endpoint?: string | undefined;
+            introspection_endpoint_auth_methods_supported?: import("@better-auth/oauth-provider").TokenEndpointAuthMethod[] | undefined;
+            introspection_endpoint_auth_signing_alg_values_supported?: import("better-auth").PrivateKeyJwtSigningAlgorithm[] | undefined;
+            code_challenge_methods_supported: "S256"[];
+            authorization_response_iss_parameter_supported?: boolean | undefined;
+            client_id_metadata_document_supported?: boolean | undefined;
+            backchannel_logout_supported?: boolean | undefined;
+            backchannel_logout_session_supported?: boolean | undefined;
+            dpop_signing_alg_values_supported?: import("better-auth/plugins/jwt").JWSAlgorithms[] | undefined;
+            frontchannel_logout_supported?: boolean | undefined;
+            frontchannel_logout_session_supported?: boolean | undefined;
+            id_token_signing_alg_values_supported: import("better-auth/plugins/jwt").JWSAlgorithms[] | ["HS256"];
+        }>;
+        oauth2Authorize: import("better-auth").StrictEndpoint<"/oauth2/authorize", {
+            method: ("GET" | "POST")[];
+            body: z.ZodObject<{}, z.core.$loose>;
+            redirectOnError: import("@better-auth/oauth-provider").OAuthRedirectOnError<import("better-auth").GenericEndpointContext, {
+                redirect: true;
+                url: string;
+            }>;
+            metadata: {
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    parameters: ({
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "string";
+                            format?: undefined;
+                            minimum?: undefined;
+                            items?: undefined;
+                        };
+                        description: string;
+                    } | {
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "string";
+                            format: string;
+                            minimum?: undefined;
+                            items?: undefined;
+                        };
+                        description: string;
+                    } | {
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "integer";
+                            minimum: number;
+                            format?: undefined;
+                            items?: undefined;
+                        };
+                        description: string;
+                    } | {
+                        name: string;
+                        in: "query";
+                        required: false;
+                        schema: {
+                            type: "array";
+                            items: {
+                                type: "string";
+                            };
+                            format?: undefined;
+                            minimum?: undefined;
+                        };
+                        description: string;
+                    })[];
+                    responses: {
+                        "302": {
+                            description: string;
+                            headers: {
+                                Location: {
+                                    description: string;
+                                    schema: {
+                                        type: string;
+                                        format: string;
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            state: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            redirect: true;
+            url: string;
+        }>;
+        oauth2Consent: import("better-auth").StrictEndpoint<"/oauth2/consent", {
+            method: "POST";
+            body: z.ZodObject<{
+                accept: z.ZodBoolean;
+                scope: z.ZodOptional<z.ZodString>;
+                claims: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+                reference_id: z.ZodOptional<z.ZodString>;
+                oauth_query: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            redirect: {
+                                                type: string;
+                                                description: string;
+                                                enum: boolean[];
+                                            };
+                                            url: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            redirect: true;
+            url: string;
+        } | {
+            redirect: boolean;
+            url: string;
+        }>;
+        oauth2Continue: import("better-auth").StrictEndpoint<"/oauth2/continue", {
+            method: "POST";
+            body: z.ZodObject<{
+                selected: z.ZodOptional<z.ZodBoolean>;
+                created: z.ZodOptional<z.ZodBoolean>;
+                postLogin: z.ZodOptional<z.ZodBoolean>;
+                oauth_query: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            redirect: {
+                                                type: string;
+                                                description: string;
+                                                enum: boolean[];
+                                            };
+                                            url: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            redirect: true;
+            url: string;
+        }>;
+        oauth2Token: import("better-auth").StrictEndpoint<"/oauth2/token", {
+            method: "POST";
+            formParams: {
+                repeatable: string[];
+            };
+            body: z.ZodObject<{
+                grant_type: z.ZodString;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                client_assertion: z.ZodOptional<z.ZodString>;
+                client_assertion_type: z.ZodOptional<z.ZodString>;
+                code: z.ZodOptional<z.ZodString>;
+                code_verifier: z.ZodOptional<z.ZodString>;
+                redirect_uri: z.ZodOptional<z.ZodURL>;
+                refresh_token: z.ZodOptional<z.ZodString>;
+                resource: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+                scope: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>;
+            errorCodesByField: {
+                grant_type: {
+                    missing: "invalid_request";
+                    invalid: "unsupported_grant_type";
+                };
+                resource: {
+                    invalid: "invalid_target";
+                };
+            };
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    parameters: {
+                        name: string;
+                        in: "header";
+                        required: false;
+                        schema: {
+                            type: "string";
+                        };
+                        description: string;
+                    }[];
+                    requestBody: {
+                        required: boolean;
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object";
+                                    properties: {
+                                        grant_type: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_id: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_secret: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        code: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        code_verifier: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        redirect_uri: {
+                                            type: string;
+                                            format: string;
+                                            description: string;
+                                        };
+                                        refresh_token: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        resource: {
+                                            oneOf: ({
+                                                type: string;
+                                                description: string;
+                                                items?: undefined;
+                                            } | {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            })[];
+                                            description: string;
+                                        };
+                                        scope: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            access_token: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            token_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            expires_in: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            refresh_token: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            id_token: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            error_uri: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            expires_in: number;
+            access_token: string;
+            expires_at: number;
+            token_type: import("@better-auth/oauth-provider").TokenType;
+            refresh_token: string | undefined;
+            scope: string;
+            id_token: string | undefined;
+        }>;
+        oauth2Introspect: import("better-auth").StrictEndpoint<"/oauth2/introspect", {
+            method: "POST";
+            formParams: {};
+            body: z.ZodObject<{
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                client_assertion: z.ZodOptional<z.ZodString>;
+                client_assertion_type: z.ZodOptional<z.ZodString>;
+                token: z.ZodString;
+                token_type_hint: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    requestBody: {
+                        required: boolean;
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object";
+                                    properties: {
+                                        client_id: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_secret: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token_type_hint: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            active: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            username: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            token_type: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            exp: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            iat: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            nbf: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            sub: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            aud: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            iss: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            jti: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            error_uri: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("better-auth").JWTPayload>;
+        oauth2Revoke: import("better-auth").StrictEndpoint<"/oauth2/revoke", {
+            method: "POST";
+            formParams: {};
+            body: z.ZodObject<{
+                client_id: z.ZodOptional<z.ZodString>;
+                client_secret: z.ZodOptional<z.ZodString>;
+                client_assertion: z.ZodOptional<z.ZodString>;
+                client_assertion_type: z.ZodOptional<z.ZodString>;
+                token: z.ZodString;
+                token_type_hint: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            metadata: {
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    requestBody: {
+                        required: boolean;
+                        content: {
+                            "application/json": {
+                                schema: {
+                                    type: "object";
+                                    properties: {
+                                        client_id: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        client_secret: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        token_type_hint: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        description: string;
+                                    };
+                                };
+                            };
+                        };
+                        "400": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                            error_uri: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, null>;
+        oauth2UserInfo: import("better-auth").StrictEndpoint<"/oauth2/userinfo", {
+            method: ("GET" | "POST")[];
+            body: z.ZodOptional<z.ZodObject<{
+                access_token: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                openapi: {
+                    description: string;
+                    security: ({
+                        bearerAuth: never[];
+                        OAuth2?: undefined;
+                    } | {
+                        OAuth2: string[];
+                        bearerAuth?: undefined;
+                    })[];
+                    parameters: {
+                        name: string;
+                        in: "header";
+                        required: false;
+                        schema: {
+                            type: "string";
+                        };
+                        description: string;
+                    }[];
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            sub: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            email: {
+                                                type: string;
+                                                format: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            name: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            picture: {
+                                                type: string;
+                                                format: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            given_name: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            family_name: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                            email_verified: {
+                                                type: string;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "401": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                        "403": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            error: {
+                                                type: string;
+                                            };
+                                            error_description: {
+                                                type: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, {
+            sub: unknown;
+        }>;
+        oauth2EndSession: import("better-auth").StrictEndpoint<"/oauth2/end-session", {
+            method: ("GET" | "POST")[];
+            body: z.ZodOptional<z.ZodObject<{
+                id_token_hint: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                post_logout_redirect_uri: z.ZodOptional<z.ZodURL>;
+                state: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            query: z.ZodOptional<z.ZodObject<{
+                id_token_hint: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                post_logout_redirect_uri: z.ZodOptional<z.ZodURL>;
+                state: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                $Infer: {
+                    body: {
+                        id_token_hint?: string;
+                        client_id?: string;
+                        post_logout_redirect_uri?: string;
+                        state?: string;
+                    } | {
+                        query: {
+                            id_token_hint?: string;
+                            client_id?: string;
+                            post_logout_redirect_uri?: string;
+                            state?: string;
+                        };
+                    };
+                    query: {
+                        id_token_hint?: string;
+                        client_id?: string;
+                        post_logout_redirect_uri?: string;
+                        state?: string;
+                    };
+                };
+                openapi: {
+                    description: string;
+                    responses: {
+                        "200": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            redirect_uri: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                            message: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                    };
+                                };
+                                "text/html": {
+                                    schema: {
+                                        type: "string";
+                                        description: string;
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, Response | {
+            redirect: true;
+            url: string;
+        } | null>;
+        oauth2EndSessionConfirmation: import("better-auth").StrictEndpoint<"/oauth2/end-session/confirm", {
+            method: "POST";
+            body: z.ZodObject<{
+                action: z.ZodLiteral<"confirm">;
+            }, z.core.$strip>;
+            metadata: {
+                noStore: boolean;
+                allowedMediaTypes: string[];
+                scope: "http";
+            };
+        }, Response | {
+            redirect: true;
+            url: string;
+        } | null>;
+        registerOAuthClient: import("better-auth").StrictEndpoint<"/oauth2/register", {
+            method: "POST";
+            body: z.ZodObject<{
+                redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                scope: z.ZodOptional<z.ZodString>;
+                client_name: z.ZodOptional<z.ZodString>;
+                client_uri: z.ZodOptional<z.ZodString>;
+                logo_uri: z.ZodOptional<z.ZodString>;
+                contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tos_uri: z.ZodOptional<z.ZodString>;
+                policy_uri: z.ZodOptional<z.ZodString>;
+                software_id: z.ZodOptional<z.ZodString>;
+                software_version: z.ZodOptional<z.ZodString>;
+                software_statement: z.ZodOptional<z.ZodString>;
+                post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+                backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                frontchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+                frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+                jwks: z.ZodOptional<z.ZodObject<{
+                    keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>>;
+                jwks_uri: z.ZodOptional<z.ZodString>;
+                grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    code: "code";
+                }>>>;
+                application_type: z.ZodOptional<z.ZodEnum<{
+                    web: "web";
+                    native: "native";
+                }>>;
+                subject_type: z.ZodOptional<z.ZodEnum<{
+                    public: "public";
+                    pairwise: "pairwise";
+                }>>;
+                dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+                resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                skip_consent: z.ZodOptional<z.ZodNever>;
+            }, z.core.$strip>;
+            errorCodesByField: {
+                redirect_uris: "invalid_redirect_uri";
+                post_logout_redirect_uris: "invalid_redirect_uri";
+                software_statement: "invalid_software_statement";
+                resources: "invalid_target";
+            };
+            defaultError: "invalid_client_metadata";
+            metadata: {
+                noStore: boolean;
+                openapi: {
+                    description: string;
+                    responses: {
+                        "201": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret_expires_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            user_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id_issued_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_name: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            logo_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            contacts: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            tos_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            policy_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_version: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_statement: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            post_logout_redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            backchannel_logout_uri: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                            backchannel_logout_session_required: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            frontchannel_logout_uri: {
+                                                type: string;
+                                                format: string;
+                                                description: string;
+                                            };
+                                            frontchannel_logout_session_required: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            token_endpoint_auth_method: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            grant_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            response_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                description: string;
+                                            };
+                                            application_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            resources: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            disabled: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientRegistrationResponse>;
+        adminCreateOAuthClient: import("better-auth").StrictEndpoint<"/admin/oauth2/create-client", {
+            method: "POST";
+            body: z.ZodObject<{
+                redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                scope: z.ZodOptional<z.ZodString>;
+                client_name: z.ZodOptional<z.ZodString>;
+                client_uri: z.ZodOptional<z.ZodString>;
+                logo_uri: z.ZodOptional<z.ZodString>;
+                contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tos_uri: z.ZodOptional<z.ZodString>;
+                policy_uri: z.ZodOptional<z.ZodString>;
+                software_id: z.ZodOptional<z.ZodString>;
+                software_version: z.ZodOptional<z.ZodString>;
+                software_statement: z.ZodOptional<z.ZodString>;
+                post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+                backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                frontchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+                frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+                application_type: z.ZodOptional<z.ZodEnum<{
+                    web: "web";
+                    native: "native";
+                }>>;
+                jwks: z.ZodOptional<z.ZodObject<{
+                    keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>>;
+                jwks_uri: z.ZodOptional<z.ZodString>;
+                grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                client_credentials_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    code: "code";
+                }>>>;
+                client_secret_expires_at: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+                skip_consent: z.ZodOptional<z.ZodBoolean>;
+                enable_end_session: z.ZodOptional<z.ZodBoolean>;
+                require_pkce: z.ZodOptional<z.ZodBoolean>;
+                dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+                subject_type: z.ZodOptional<z.ZodEnum<{
+                    public: "public";
+                    pairwise: "pairwise";
+                }>>;
+                metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strip>;
+            metadata: {
+                noStore: boolean;
+                SERVER_ONLY: true;
+                openapi: {
+                    description: string;
+                    responses: {
+                        "201": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret_expires_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_credentials_scopes: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            user_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id_issued_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_name: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            logo_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            contacts: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            tos_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            policy_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_version: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_statement: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            token_endpoint_auth_method: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            grant_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            response_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                description: string;
+                                            };
+                                            application_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            resources: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            disabled: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            require_pkce: {
+                                                type: string;
+                                                description: string;
+                                                default: boolean;
+                                            };
+                                            metadata: {
+                                                type: string;
+                                                additionalProperties: boolean;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientAdministrativeResponse>;
+        createOAuthClient: import("better-auth").StrictEndpoint<"/oauth2/create-client", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: z.ZodObject<{
+                redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                scope: z.ZodOptional<z.ZodString>;
+                client_name: z.ZodOptional<z.ZodString>;
+                client_uri: z.ZodOptional<z.ZodString>;
+                logo_uri: z.ZodOptional<z.ZodString>;
+                contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tos_uri: z.ZodOptional<z.ZodString>;
+                policy_uri: z.ZodOptional<z.ZodString>;
+                software_id: z.ZodOptional<z.ZodString>;
+                software_version: z.ZodOptional<z.ZodString>;
+                software_statement: z.ZodOptional<z.ZodString>;
+                post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                backchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+                backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                frontchannel_logout_uri: z.ZodOptional<z.ZodURL>;
+                frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                token_endpoint_auth_method: z.ZodOptional<z.ZodString>;
+                application_type: z.ZodOptional<z.ZodEnum<{
+                    web: "web";
+                    native: "native";
+                }>>;
+                jwks: z.ZodOptional<z.ZodObject<{
+                    keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>>;
+                jwks_uri: z.ZodOptional<z.ZodString>;
+                grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    code: "code";
+                }>>>;
+                dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>;
+            metadata: {
+                noStore: boolean;
+                openapi: {
+                    description: string;
+                    responses: {
+                        "201": {
+                            description: string;
+                            content: {
+                                "application/json": {
+                                    schema: {
+                                        type: "object";
+                                        properties: {
+                                            client_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_secret_expires_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            scope: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            user_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_id_issued_at: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_name: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            client_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            logo_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            contacts: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            tos_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            policy_uri: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_id: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_version: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            software_statement: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            redirect_uris: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            token_endpoint_auth_method: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            grant_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                };
+                                                description: string;
+                                            };
+                                            response_types: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                description: string;
+                                            };
+                                            application_type: {
+                                                type: string;
+                                                description: string;
+                                                enum: string[];
+                                            };
+                                            resources: {
+                                                type: string;
+                                                items: {
+                                                    type: string;
+                                                    format: string;
+                                                };
+                                                description: string;
+                                            };
+                                            disabled: {
+                                                type: string;
+                                                description: string;
+                                            };
+                                            metadata: {
+                                                type: string;
+                                                additionalProperties: boolean;
+                                                nullable: boolean;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientRegistrationResponse>;
+        getOAuthClient: import("better-auth").StrictEndpoint<"/oauth2/get-client", {
+            method: "GET";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            query: z.ZodObject<{
+                client_id: z.ZodString;
+            }, z.core.$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        getOAuthClientPublic: import("better-auth").StrictEndpoint<"/oauth2/public-client", {
+            method: "GET";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            query: z.ZodObject<{
+                client_id: z.ZodString;
+            }, z.core.$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        getOAuthClientPublicPrelogin: import("better-auth").StrictEndpoint<"/oauth2/public-client-prelogin", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>[];
+            body: z.ZodObject<{
+                client_id: z.ZodString;
+                oauth_query: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        getOAuthClients: import("better-auth").StrictEndpoint<"/oauth2/get-clients", {
+            method: "GET";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient[] | null>;
+        adminUpdateOAuthClient: import("better-auth").StrictEndpoint<"/admin/oauth2/update-client", {
+            method: "PATCH";
+            body: z.ZodObject<{
+                client_id: z.ZodString;
+                update: z.ZodObject<{
+                    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                    scope: z.ZodOptional<z.ZodString>;
+                    client_name: z.ZodOptional<z.ZodString>;
+                    client_uri: z.ZodOptional<z.ZodString>;
+                    logo_uri: z.ZodOptional<z.ZodString>;
+                    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    tos_uri: z.ZodOptional<z.ZodString>;
+                    policy_uri: z.ZodOptional<z.ZodString>;
+                    software_id: z.ZodOptional<z.ZodString>;
+                    software_version: z.ZodOptional<z.ZodString>;
+                    software_statement: z.ZodOptional<z.ZodString>;
+                    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                    backchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+                    backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                    frontchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+                    frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                    application_type: z.ZodOptional<z.ZodEnum<{
+                        web: "web";
+                        native: "native";
+                    }>>;
+                    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    client_credentials_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        code: "code";
+                    }>>>;
+                    client_secret_expires_at: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+                    skip_consent: z.ZodOptional<z.ZodBoolean>;
+                    enable_end_session: z.ZodOptional<z.ZodBoolean>;
+                    disabled: z.ZodOptional<z.ZodBoolean>;
+                    dpop_bound_access_tokens: z.ZodOptional<z.ZodBoolean>;
+                    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientAdministrativeResponse>;
+        updateOAuthClient: import("better-auth").StrictEndpoint<"/oauth2/update-client", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: z.ZodObject<{
+                client_id: z.ZodString;
+                update: z.ZodObject<{
+                    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                    scope: z.ZodOptional<z.ZodString>;
+                    client_name: z.ZodOptional<z.ZodString>;
+                    client_uri: z.ZodOptional<z.ZodString>;
+                    logo_uri: z.ZodOptional<z.ZodString>;
+                    contacts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    tos_uri: z.ZodOptional<z.ZodString>;
+                    policy_uri: z.ZodOptional<z.ZodString>;
+                    software_id: z.ZodOptional<z.ZodString>;
+                    software_version: z.ZodOptional<z.ZodString>;
+                    software_statement: z.ZodOptional<z.ZodString>;
+                    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+                    backchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+                    backchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                    frontchannel_logout_uri: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+                    frontchannel_logout_session_required: z.ZodOptional<z.ZodBoolean>;
+                    application_type: z.ZodOptional<z.ZodEnum<{
+                        web: "web";
+                        native: "native";
+                    }>>;
+                    grant_types: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    response_types: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        code: "code";
+                    }>>>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClientRegistrationResponse>;
+        rotateClientSecret: import("better-auth").StrictEndpoint<"/oauth2/client/rotate-secret", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: z.ZodObject<{
+                client_id: z.ZodString;
+            }, z.core.$strip>;
+            metadata: {
+                noStore: boolean;
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthClient>;
+        rotateClientKeys: import("better-auth").StrictEndpoint<"/oauth2/client/rotate-keys", {
+            method: "POST";
+            body: z.ZodObject<{
+                client_assertion: z.ZodString;
+                client_assertion_type: z.ZodString;
+                jwks: z.ZodObject<{
+                    keys: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            errorCodesByField: {
+                client_assertion: "invalid_client";
+                client_assertion_type: "invalid_client";
+                jwks: "invalid_client_metadata";
+            };
+            metadata: {
+                noStore: boolean;
+                openapi: {
+                    description: string;
+                };
+            };
+        }, {
+            client_id: string;
+            jwks: {
+                keys: Record<string, unknown>[];
+            };
+        }>;
+        deleteOAuthClient: import("better-auth").StrictEndpoint<"/oauth2/delete-client", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: z.ZodObject<{
+                client_id: z.ZodString;
+            }, z.core.$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, void>;
+        getOAuthConsent: import("better-auth").StrictEndpoint<"/oauth2/get-consent", {
+            method: "GET";
+            query: z.ZodObject<{
+                id: z.ZodString;
+            }, z.core.$strip>;
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthConsent<import("@better-auth/oauth-provider").Scope[]>>;
+        getOAuthConsents: import("better-auth").StrictEndpoint<"/oauth2/get-consents", {
+            method: "GET";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthConsent<import("@better-auth/oauth-provider").Scope[]>[]>;
+        updateOAuthConsent: import("better-auth").StrictEndpoint<"/oauth2/update-consent", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: z.ZodObject<{
+                id: z.ZodString;
+                update: z.ZodObject<{
+                    scopes: z.ZodArray<z.ZodString>;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, import("@better-auth/oauth-provider").OAuthConsent<import("@better-auth/oauth-provider").Scope[]> | null>;
+        deleteOAuthConsent: import("better-auth").StrictEndpoint<"/oauth2/delete-consent", {
+            method: "POST";
+            use: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<{
+                session: {
+                    session: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        userId: string;
+                        expiresAt: Date;
+                        token: string;
+                        ipAddress?: string | null | undefined;
+                        userAgent?: string | null | undefined;
+                    };
+                    user: Record<string, any> & {
+                        id: string;
+                        createdAt: Date;
+                        updatedAt: Date;
+                        email: string;
+                        emailVerified: boolean;
+                        name: string;
+                        image?: string | null | undefined;
+                    };
+                };
+            }>>[];
+            body: z.ZodObject<{
+                id: z.ZodString;
+            }, z.core.$strip>;
+            metadata: {
+                openapi: {
+                    description: string;
+                };
+            };
+        }, void>;
+        adminCreateOAuthResource: import("better-auth").StrictEndpoint<"/admin/oauth2/resources", {
+            method: "POST";
+            body: z.ZodObject<{
+                identifier: z.ZodNonOptional<z.ZodOptional<z.ZodString>>;
+                name: z.ZodOptional<z.ZodString>;
+                accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+                    RS256: "RS256";
+                    PS256: "PS256";
+                    ES256: "ES256";
+                    ES512: "ES512";
+                    EdDSA: "EdDSA";
+                }>>>;
+                signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+                customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+                dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+                disabled: z.ZodOptional<z.ZodBoolean>;
+                metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            }, z.core.$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource>;
+        adminListOAuthResources: import("better-auth").StrictEndpoint<"/admin/oauth2/resources", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource[]>;
+        adminGetOAuthResource: import("better-auth").StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+            method: "GET";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource>;
+        adminUpdateOAuthResource: import("better-auth").StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+            method: "PATCH";
+            body: z.ZodObject<{
+                identifier: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodString>;
+                accessTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                refreshTokenTtl: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                signingAlgorithm: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+                    RS256: "RS256";
+                    PS256: "PS256";
+                    ES256: "ES256";
+                    ES512: "ES512";
+                    EdDSA: "EdDSA";
+                }>>>;
+                signingKeyId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                allowedScopes: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+                customClaims: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+                dpopBoundAccessTokensRequired: z.ZodOptional<z.ZodBoolean>;
+                disabled: z.ZodOptional<z.ZodBoolean>;
+                metadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            }, z.core.$strip>;
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, import("@better-auth/oauth-provider").OAuthResource>;
+        adminDeleteOAuthResource: import("better-auth").StrictEndpoint<"/admin/oauth2/resources/:identifier", {
+            method: "DELETE";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            deleted: boolean;
+        }>;
+        adminLinkClientResource: import("better-auth").StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+            method: "POST";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            linked: boolean;
+        }>;
+        adminUnlinkClientResource: import("better-auth").StrictEndpoint<"/admin/oauth2/resources/:identifier/clients/:client_id", {
+            method: "DELETE";
+            metadata: {
+                SERVER_ONLY: true;
+            };
+        }, {
+            unlinked: boolean;
+        }>;
+    };
+    schema: {
+        oauthClient: {
+            modelName: string;
+            fields: {
+                clientId: {
+                    type: "string";
+                    unique: true;
+                    required: true;
+                };
+                clientSecret: {
+                    type: "string";
+                    required: false;
+                };
+                clientDiscoveryId: {
+                    type: "string";
+                    required: false;
+                };
+                disabled: {
+                    type: "boolean";
+                    defaultValue: false;
+                    required: false;
+                };
+                skipConsent: {
+                    type: "boolean";
+                    required: false;
+                };
+                enableEndSession: {
+                    type: "boolean";
+                    required: false;
+                };
+                subjectType: {
+                    type: "string";
+                    required: false;
+                };
+                sectorIdentifier: {
+                    type: "string";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: false;
+                };
+                clientCredentialsScopes: {
+                    type: "string[]";
+                    required: false;
+                    defaultValue: never[];
+                };
+                userId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                createdAt: {
+                    type: "date";
+                    required: false;
+                };
+                updatedAt: {
+                    type: "date";
+                    required: false;
+                };
+                name: {
+                    type: "string";
+                    required: false;
+                };
+                uri: {
+                    type: "string";
+                    required: false;
+                };
+                icon: {
+                    type: "string";
+                    required: false;
+                };
+                contacts: {
+                    type: "string[]";
+                    required: false;
+                };
+                tos: {
+                    type: "string";
+                    required: false;
+                };
+                policy: {
+                    type: "string";
+                    required: false;
+                };
+                softwareId: {
+                    type: "string";
+                    required: false;
+                };
+                softwareVersion: {
+                    type: "string";
+                    required: false;
+                };
+                softwareStatement: {
+                    type: "string";
+                    required: false;
+                };
+                redirectUris: {
+                    type: "string[]";
+                    required: true;
+                };
+                postLogoutRedirectUris: {
+                    type: "string[]";
+                    required: false;
+                };
+                backchannelLogoutUri: {
+                    type: "string";
+                    required: false;
+                };
+                backchannelLogoutSessionRequired: {
+                    type: "boolean";
+                    required: false;
+                };
+                frontchannelLogoutUri: {
+                    type: "string";
+                    required: false;
+                };
+                frontchannelLogoutSessionRequired: {
+                    type: "boolean";
+                    required: false;
+                };
+                tokenEndpointAuthMethod: {
+                    type: "string";
+                    required: false;
+                };
+                applicationType: {
+                    type: "string";
+                    required: false;
+                };
+                jwks: {
+                    type: "string";
+                    required: false;
+                };
+                jwksUri: {
+                    type: "string";
+                    required: false;
+                };
+                grantTypes: {
+                    type: "string[]";
+                    required: false;
+                };
+                responseTypes: {
+                    type: "string[]";
+                    required: false;
+                };
+                requirePKCE: {
+                    type: "boolean";
+                    required: false;
+                };
+                dpopBoundAccessTokens: {
+                    type: "boolean";
+                    required: false;
+                    defaultValue: false;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                metadata: {
+                    type: "json";
+                    required: false;
+                };
+            };
+        };
+        oauthResource: {
+            modelName: string;
+            fields: {
+                identifier: {
+                    type: "string";
+                    required: true;
+                    unique: true;
+                };
+                name: {
+                    type: "string";
+                    required: true;
+                };
+                accessTokenTtl: {
+                    type: "number";
+                    required: false;
+                };
+                refreshTokenTtl: {
+                    type: "number";
+                    required: false;
+                };
+                signingAlgorithm: {
+                    type: "string";
+                    required: false;
+                };
+                signingKeyId: {
+                    type: "string";
+                    required: false;
+                };
+                allowedScopes: {
+                    type: "string[]";
+                    required: false;
+                };
+                customClaims: {
+                    type: "json";
+                    required: false;
+                };
+                dpopBoundAccessTokensRequired: {
+                    type: "boolean";
+                    required: false;
+                    defaultValue: false;
+                };
+                disabled: {
+                    type: "boolean";
+                    required: false;
+                    defaultValue: false;
+                };
+                createdAt: {
+                    type: "date";
+                    required: false;
+                };
+                updatedAt: {
+                    type: "date";
+                    required: false;
+                };
+                policyVersion: {
+                    type: "number";
+                    required: false;
+                    defaultValue: number;
+                };
+                metadata: {
+                    type: "json";
+                    required: false;
+                };
+            };
+        };
+        oauthClientResource: {
+            modelName: string;
+            fields: {
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "cascade";
+                    };
+                    index: true;
+                };
+                resourceId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "cascade";
+                    };
+                    index: true;
+                };
+                metadata: {
+                    type: "json";
+                    required: false;
+                };
+                createdAt: {
+                    type: "date";
+                    required: false;
+                };
+            };
+            indexes: {
+                fields: [string, string];
+                unique: true;
+            }[];
+        };
+        oauthRefreshToken: {
+            fields: {
+                token: {
+                    type: "string";
+                    required: true;
+                    unique: true;
+                };
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                sessionId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "set null";
+                    };
+                    index: true;
+                };
+                userId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                authorizationCodeId: {
+                    type: "string";
+                    required: false;
+                    index: true;
+                };
+                resources: {
+                    type: "string[]";
+                    required: false;
+                };
+                requestedUserInfoClaims: {
+                    type: "string[]";
+                    required: false;
+                };
+                expiresAt: {
+                    type: "date";
+                };
+                createdAt: {
+                    type: "date";
+                };
+                revoked: {
+                    type: "date";
+                    required: false;
+                };
+                rotatedAt: {
+                    type: "date";
+                    required: false;
+                };
+                rotationReplayResponse: {
+                    type: "string";
+                    required: false;
+                };
+                rotationReplayExpiresAt: {
+                    type: "date";
+                    required: false;
+                };
+                authTime: {
+                    type: "date";
+                    required: false;
+                };
+                acr: {
+                    type: "string";
+                    required: false;
+                };
+                amr: {
+                    type: "string[]";
+                    required: false;
+                };
+                confirmation: {
+                    type: "json";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: true;
+                };
+            };
+        };
+        oauthAccessToken: {
+            modelName: string;
+            fields: {
+                token: {
+                    type: "string";
+                    unique: true;
+                };
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                sessionId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                        onDelete: "set null";
+                    };
+                    index: true;
+                };
+                userId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                authorizationCodeId: {
+                    type: "string";
+                    required: false;
+                    index: true;
+                };
+                resources: {
+                    type: "string[]";
+                    required: false;
+                };
+                requestedUserInfoClaims: {
+                    type: "string[]";
+                    required: false;
+                };
+                refreshId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                expiresAt: {
+                    type: "date";
+                };
+                createdAt: {
+                    type: "date";
+                };
+                revoked: {
+                    type: "date";
+                    required: false;
+                };
+                confirmation: {
+                    type: "json";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: true;
+                };
+            };
+        };
+        oauthConsent: {
+            modelName: string;
+            fields: {
+                clientId: {
+                    type: "string";
+                    required: true;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                userId: {
+                    type: "string";
+                    required: false;
+                    references: {
+                        model: string;
+                        field: string;
+                    };
+                    index: true;
+                };
+                referenceId: {
+                    type: "string";
+                    required: false;
+                };
+                resources: {
+                    type: "string[]";
+                    required: false;
+                };
+                requestedUserInfoClaims: {
+                    type: "string[]";
+                    required: false;
+                };
+                scopes: {
+                    type: "string[]";
+                    required: true;
+                };
+                createdAt: {
+                    type: "date";
+                };
+                updatedAt: {
+                    type: "date";
+                };
+            };
+        };
+        oauthClientAssertion: {
+            modelName: string;
+            fields: {
+                expiresAt: {
+                    type: "date";
+                    required: true;
+                };
+            };
+        };
+    };
+    rateLimit: ({
+        pathMatcher: (path: string) => path is "/oauth2/token";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/authorize";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/introspect";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/revoke";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/register";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/client/rotate-keys";
+        window: number;
+        max: number;
+    } | {
+        pathMatcher: (path: string) => path is "/oauth2/userinfo";
+        window: number;
+        max: number;
+    })[];
+} | {
+    hooks: {
+        after: {
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        }[];
+        before: {
+            handler: import("better-auth").Middleware<import("better-auth").MiddlewareOptions, (inputContext: import("better-auth").MiddlewareInputContext<import("better-auth").MiddlewareOptions>) => Promise<void>>;
+            matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        }[];
+    };
+    id: "tempo-id-authorize-session";
+    endpoints?: never;
+    init?: never;
+} | {
+    hooks?: never;
+    endpoints: {
+        resolveOAuthClient: import("better-auth").StrictEndpoint<string, {
+            body: z.ZodObject<{
+                client_id: z.ZodString;
+            }, z.core.$strip>;
+            method: "POST";
+        }, {
+            resolved: boolean;
+        }>;
+    };
+    id: "tempo-id-client-discovery";
+    init?: never;
+} | {
+    hooks?: never;
+    endpoints?: never;
+    id: "tempo-id-resource-seed";
+    init: (ctx: import("better-auth").AuthContext) => Promise<void>;
+})[];
+export declare namespace plugins {
+    type Options = {
+        /** Returns whether the app's authorization needs `/choose-account`. Absent, none does. */
+        accountStep?: ((options: {
+            clientId: string;
+            headers: Headers;
+            query: URLSearchParams;
+            sessionId: string;
+            userId: string;
+        }) => Promise<boolean>) | undefined;
+        /** Tempo ID's origin, which is `iss` and the one resource. */
+        baseURL: string;
+        /** The isolate's cache for the signing keys. Absent, nothing is cached. */
+        cache?: Cache.Cache | undefined;
+        /** Fetches third-party apps' metadata documents. Defaults to `fetchMetadata()`. */
+        metadataFetch?: ClientMetadataResourceFetch | undefined;
+        /** Takes a code's held key authorization, as `PendingKey.take` does. Absent, codes carry none. */
+        pendingKey?: ((options: {
+            clientId: string;
+            codeChallenge: string;
+            userId: string;
+        }) => Promise<PendingKey.PendingKey | undefined>) | undefined;
+    };
+}
+/**
+ * Removes the registered app with `clientId`, with its consents, tokens, and realms. Throws
+ * `NotFoundError` when no registered app has it.
+ */
+export declare function remove(db: Realm.Database, options: remove.Options): Promise<App>;
+export declare namespace remove {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+    };
+}
+/**
+ * Replaces the client secret of the app with `clientId`, and returns the app with the new secret.
+ * The earlier secret stops working at once. Throws `NotFoundError` for an unknown app,
+ * `PublicError` for an app without a secret, and `InvalidError` for an invalid or unchanged secret.
+ */
+export declare function rotateSecret(db: Realm.Database, options: rotateSecret.Options): Promise<{
+    app: App;
+    clientSecret: string;
+}>;
+export declare namespace rotateSecret {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+        /** Another deployment's client secret to keep. Defaults to a new secret. */
+        clientSecret?: string | undefined;
+    };
+}
+/** Returns whether `clientId` is a canonical `https` origin, such as `https://app.example`. */
+export declare function originId(clientId: string): boolean;
+/** Returns whether `clientId` names a third-party app: an `https` URL or origin. */
+export declare function thirdParty(clientId: string): boolean;
+/** Returns the third-party client IDs in `clientIds` without a row within `discoveryFreshness`. */
+export declare function stale(db: Realm.Database, options: stale.Options): Promise<readonly string[]>;
+export declare namespace stale {
+    type Options = {
+        /** The client IDs in the request's parameters or Basic credentials. */
+        clientIds: readonly string[];
+    };
+}
+/**
+ * Updates the registered app with `clientId`, and returns it. A value left out stays. Throws
+ * `NotFoundError` when no registered app has it, and `InvalidError` for an invalid value.
+ */
+export declare function update(db: Realm.Database, options: update.Options): Promise<App>;
+export declare namespace update {
+    type Options = {
+        /** The app's client ID. */
+        clientId: string;
+        /** The display name. */
+        name?: string | undefined;
+        /** Replaces the URIs that `GET /oauth2/end-session` may return to. An empty list clears them. */
+        postLogoutRedirectUris?: readonly string[] | undefined;
+        /** Replaces the URIs that the app returns to. */
+        redirectUris?: readonly string[] | undefined;
+        /** Whether the app holds the `tempo-id:sign` scope. */
+        sign?: boolean | undefined;
+    };
+}
+//# sourceMappingURL=Apps.d.ts.map