@absolutejs/auth 0.65.1 → 0.65.2

package/dist/vc/openid4vp.d.ts

@@ -0,0 +1,82 @@
+import { type SigningKey } from '../oidc/keys';
+export type PresentationResponseInput = {
+    requestId: string;
+    vpToken: string;
+};
+export type PresentationRequest = {
+    clientId: string;
+    createdAt: number;
+    expectedIssuerPublicJwk: JsonWebKey;
+    expiresAt: number;
+    nonce: string;
+    requestedClaims: string[];
+    requestId: string;
+    responseUri: string;
+    state: string | undefined;
+};
+export type PresentationRequestStore = {
+    consumeRequest: (requestId: string) => Promise<PresentationRequest | undefined>;
+    getRequest: (requestId: string) => Promise<PresentationRequest | undefined>;
+    saveRequest: (request: PresentationRequest) => Promise<void>;
+};
+export type Vp4Config = {
+    clientSigningKey: SigningKey;
+    defaultExpectedIssuerPublicJwk: JsonWebKey;
+    getResponseUri: (requestId: string) => string;
+    requestStore: PresentationRequestStore;
+    requestTtlMs?: number;
+    statusListResolver?: (uri: string) => Promise<string | undefined>;
+    statusListPublicJwk?: JsonWebKey;
+};
+export type CreatePresentationRequestInput = {
+    clientId: string;
+    now?: number;
+    requestedClaims: string[];
+    state?: string;
+};
+export declare const createPresentationRequest: ({ config, getRequestUri, input, issuer }: {
+    config: Vp4Config;
+    getRequestUri: (requestId: string) => string;
+    input: CreatePresentationRequestInput;
+    issuer: string;
+}) => Promise<{
+    nonce: string;
+    request: PresentationRequest;
+    requestObject: string;
+    requestUri: string;
+}>;
+export type VerifiedPresentation = {
+    disclosedClaims: Record<string, unknown>;
+    holderJwk: JsonWebKey | undefined;
+    missingClaims: string[];
+    protectedClaims: Record<string, unknown>;
+    requestId: string;
+    statusValid: boolean;
+};
+export type PresentationVerifyError = 'expired_request' | 'invalid_holder_binding' | 'invalid_signature' | 'missing_claims' | 'revoked_credential' | 'unknown_request';
+export type PresentationVerifyResult = {
+    error: PresentationVerifyError;
+    ok: false;
+} | {
+    ok: true;
+    verified: VerifiedPresentation;
+};
+export declare const verifyPresentationResponse: ({ config, input, now }: {
+    config: Vp4Config;
+    input: PresentationResponseInput;
+    now?: number;
+}) => Promise<{
+    error: PresentationVerifyError;
+    ok: false;
+} | {
+    ok: true;
+    verified: VerifiedPresentation;
+}>;
+export declare const buildHolderKeyBindingJwt: ({ audience, holderKey, nonce, now, sdHash }: {
+    audience: string;
+    holderKey: SigningKey;
+    nonce: string;
+    now?: number;
+    sdHash?: string;
+}) => Promise<string>;
+export declare const parsePresentationToken: (vpToken: string) => import("./sdJwt").ParsedSdJwtVc;

package/dist/vc/postgresVcStores.d.ts

@@ -0,0 +1,300 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { CredentialNonceStore, CredentialOfferStore } from '../oidc/vci';
+import type { PresentationRequestStore } from './openid4vp';
+export declare const vcCredentialNoncesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_vc_credential_nonces";
+    schema: undefined;
+    columns: {
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_nonces", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_vc_credential_nonces";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        nonce_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_nonces", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_credential_nonces";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const vcCredentialOffersTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_vc_credential_offers";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_offers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_credential_offers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        configuration_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_offers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_credential_offers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_offers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_vc_credential_offers";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_offers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_vc_credential_offers";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        pre_authorized_code_hash: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_offers", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_credential_offers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        redeemed: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_offers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>, {
+            name: string;
+            tableName: "auth_vc_credential_offers";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_credential_offers", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_credential_offers";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const vcPresentationRequestsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_vc_presentation_requests";
+    schema: undefined;
+    columns: {
+        client_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expected_issuer_jwk_json: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, JsonWebKey>>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "object json";
+            data: JsonWebKey;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expires_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        nonce: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        request_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        requested_claims: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, string[]>>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "object json";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        response_uri: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        state: import("drizzle-orm/pg-core").PgBuildColumn<"auth_vc_presentation_requests", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_vc_presentation_requests";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonCredentialNonceStore: (databaseUrl: string) => CredentialNonceStore;
+export declare const createNeonCredentialOfferStore: (databaseUrl: string) => CredentialOfferStore;
+export declare const createNeonPresentationRequestStore: (databaseUrl: string) => PresentationRequestStore;
+export declare const createPostgresCredentialNonceStore: <DB extends AnyPgDatabase>(database: DB) => CredentialNonceStore;
+export declare const createPostgresCredentialOfferStore: <DB extends AnyPgDatabase>(database: DB) => CredentialOfferStore;
+export declare const createPostgresPresentationRequestStore: <DB extends AnyPgDatabase>(database: DB) => PresentationRequestStore;

package/dist/vc/sdJwt.d.ts

@@ -0,0 +1,37 @@
+import { type SigningKey } from '../oidc/keys';
+declare const toBase64Url: (bytes: ArrayBuffer | Uint8Array) => string;
+declare const fromBase64Url: (value: string) => Uint8Array<ArrayBuffer>;
+export type SdDisclosure = {
+    claimName: string;
+    claimValue: unknown;
+    encoded: string;
+    salt: string;
+};
+export type SdJwtVcIssueInput = {
+    base: Record<string, unknown>;
+    holderJwk?: JsonWebKey;
+    selective: Record<string, unknown>;
+    signingKey: SigningKey;
+};
+export declare const issueSdJwtVc: (input: SdJwtVcIssueInput) => Promise<string>;
+export type ParsedSdJwtVc = {
+    disclosures: string[];
+    jwt: string;
+    keyBindingJwt: string | undefined;
+};
+export declare const parseSdJwtVc: (token: string) => ParsedSdJwtVc;
+export declare const presentSdJwtVc: (parsed: ParsedSdJwtVc, selectedClaims: string[], keyBindingJwt?: string) => string;
+export type VerifiedSdJwtVc = {
+    cnf: {
+        jwk: JsonWebKey;
+    } | undefined;
+    disclosedClaims: Record<string, unknown>;
+    keyBindingJwt: string | undefined;
+    protectedClaims: Record<string, unknown>;
+};
+export type SdJwtVcVerifyInput = {
+    issuerPublicJwk: JsonWebKey;
+    token: string;
+};
+export declare const verifySdJwtVc: (input: SdJwtVcVerifyInput) => Promise<VerifiedSdJwtVc | undefined>;
+export { fromBase64Url, toBase64Url };

package/dist/vc/statusList.d.ts

@@ -0,0 +1,29 @@
+import { type SigningKey } from '../oidc/keys';
+declare const STATUS_LIST_TYP = "statuslist+jwt";
+declare const STATUS_LIST_SUB_TYP = "application/statuslist+jwt";
+export type StatusListBits = Uint8Array;
+export declare const createStatusList: (size?: number) => Uint8Array<ArrayBuffer>;
+export declare const getCredentialStatus: (bits: StatusListBits, idx: number) => 1 | 0 | undefined;
+export declare const setCredentialStatus: (bits: StatusListBits, idx: number, value: 0 | 1) => StatusListBits;
+export declare const buildStatusClaim: (idx: number, uri: string) => {
+    status_list: {
+        idx: number;
+        uri: string;
+    };
+};
+export declare const signStatusList: ({ bits, issuer, listUri, now, signingKey, ttlSeconds }: {
+    bits: StatusListBits;
+    issuer: string;
+    listUri: string;
+    now?: number;
+    signingKey: SigningKey;
+    ttlSeconds?: number;
+}) => Promise<string>;
+export declare const verifyStatusListJwt: ({ issuerPublicJwk, token }: {
+    issuerPublicJwk: JsonWebKey;
+    token: string;
+}) => Promise<{
+    bits: Uint8Array<ArrayBuffer>;
+    sub: string | undefined;
+} | undefined>;
+export { STATUS_LIST_SUB_TYP, STATUS_LIST_TYP };

package/dist/vc/statusListRoutes.d.ts

@@ -0,0 +1,63 @@
+import { Elysia } from 'elysia';
+import type { SigningKey } from '../oidc/keys';
+import { type StatusListBits } from './statusList';
+export declare const DEFAULT_STATUS_ROUTE = "/vc/status";
+export declare const statusListRoutes: ({ getStatusList, issuerUrl, signingKey, statusRoute, ttlSeconds }: {
+    getStatusList: (listId: string) => Promise<StatusListBits | undefined> | StatusListBits | undefined;
+    issuerUrl: string;
+    signingKey: SigningKey;
+    statusRoute?: string;
+    ttlSeconds?: number;
+}) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        ":listId": {
+            get: {
+                body: unknown;
+                params: {
+                    listId: string;
+                };
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/vc/vpRoutes.d.ts

@@ -0,0 +1,120 @@
+import { Elysia } from 'elysia';
+import { type VerifiedPresentation, type Vp4Config } from './openid4vp';
+export declare const DEFAULT_VP_ROUTE = "/vp";
+export declare const vpRoutes: ({ defaultClientId, issuerUrl, onVerifiedPresentation, vpConfig, vpRoute }: {
+    defaultClientId: string;
+    issuerUrl: string;
+    onVerifiedPresentation?: (context: {
+        verified: VerifiedPresentation;
+    }) => Promise<void> | void;
+    vpConfig: Vp4Config;
+    vpRoute?: string;
+}) => Elysia<"", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+}, {
+    [x: string]: {
+        authorize: {
+            post: {
+                body: {
+                    client_id?: string | undefined;
+                    state?: string | undefined;
+                    requested_claims: string[];
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        request: {
+            ":id": {
+                get: {
+                    body: unknown;
+                    params: {
+                        id: string;
+                    };
+                    query: unknown;
+                    headers: unknown;
+                    response: {
+                        200: Response;
+                        422: {
+                            type: "validation";
+                            on: string;
+                            summary?: string;
+                            message?: string;
+                            found?: unknown;
+                            property?: string;
+                            expected?: string;
+                        };
+                    };
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        response: {
+            post: {
+                body: {
+                    state?: string | undefined;
+                    presentation_submission?: unknown;
+                    vp_token: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: Response;
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}>;

package/dist/verification/types.d.ts

@@ -0,0 +1,58 @@
+/** Stable purposes let providers apply separate templates, limits, and audit policy. */
+export type VerificationPurpose = 'account_recovery' | 'mfa_challenge' | 'mfa_enrollment' | 'phone_change' | 'phone_signup' | 'step_up';
+export type VerificationChannel = 'call' | 'sms' | 'whatsapp';
+export type VerificationStartInput = {
+    channel: VerificationChannel;
+    /** Optional BCP-47 locale used for provider-managed message copy. */
+    locale?: string;
+    purpose: VerificationPurpose;
+    /** Provider-specific, non-secret rate-limit buckets (for example an IP hash). */
+    rateLimits?: Readonly<Record<string, string>>;
+    /** Stable application subject. Providers must not include it in message text. */
+    subject: string;
+    /** E.164 destination. */
+    to: string;
+    /** Stable tenant key used only for provider/service routing. */
+    tenant?: string;
+};
+export type VerificationStartResult = {
+    /** Provider reference safe for audit correlation (for example, a Twilio VE SID). */
+    reference: string;
+    /** Provider-authoritative expiry. Auth rejects checks after this time. */
+    expiresAt: number;
+};
+export type VerificationCheckStatus = 'approved' | 'canceled' | 'expired' | 'failed' | 'max_attempts_reached' | 'pending';
+export type VerificationCheckInput = VerificationStartInput & {
+    code: string;
+    /** Exact challenge reference returned by start(). */
+    reference: string;
+};
+export type VerificationCancelInput = VerificationStartInput & {
+    reference: string;
+};
+export type VerificationCheckResult = {
+    reference?: string;
+    status: VerificationCheckStatus;
+};
+export type VerificationProviderErrorKind = 'invalid_destination' | 'rate_limited' | 'unavailable';
+/** Normalized operational failures that auth routes can map safely to HTTP. */
+export declare class VerificationProviderError extends Error {
+    readonly kind: VerificationProviderErrorKind;
+    readonly provider: string;
+    constructor(input: {
+        cause?: unknown;
+        kind: VerificationProviderErrorKind;
+        message: string;
+        provider: string;
+    });
+}
+/**
+ * Provider-owned out-of-band challenge lifecycle. Implementations generate,
+ * deliver, rate-limit, and check codes; auth owns enrollment and session policy.
+ */
+export type VerificationProvider = {
+    readonly name: string;
+    cancel: (input: VerificationCancelInput) => Promise<void>;
+    check: (input: VerificationCheckInput) => Promise<VerificationCheckResult>;
+    start: (input: VerificationStartInput) => Promise<VerificationStartResult>;
+};