@factiii/auth 0.1.0

package/dist/index.d.mts

@@ -0,0 +1,1061 @@
+import * as http from 'http';
+import * as SuperJSON from 'superjson';
+import SuperJSON__default from 'superjson';
+import * as _prisma_client from '@prisma/client';
+import { PrismaClient } from '@prisma/client';
+import * as _trpc_server from '@trpc/server';
+import * as zod from 'zod';
+import { CreateHTTPContextOptions } from '@trpc/server/adapters/standalone';
+import { S as SchemaExtensions, A as AuthHooks } from './hooks-B4Kl294A.mjs';
+export { C as ChangePasswordInput, L as LoginInput, a as LogoutInput, O as OAuthLoginInput, R as ResetPasswordInput, b as SignupInput, T as TwoFaVerifyInput, V as VerifyEmailInput, c as biometricVerifySchema, d as changePasswordSchema, e as endAllSessionsSchema, l as loginSchema, f as logoutSchema, o as oAuthLoginSchema, g as otpLoginRequestSchema, h as otpLoginVerifySchema, r as requestPasswordResetSchema, i as resetPasswordSchema, s as signupSchema, t as twoFaResetSchema, j as twoFaSetupSchema, k as twoFaVerifySchema, v as verifyEmailSchema } from './hooks-B4Kl294A.mjs';
+import { SignOptions } from 'jsonwebtoken';
+
+//# sourceMappingURL=TRPCError.d.ts.map
+//#endregion
+//#region src/vendor/standard-schema-v1/spec.d.ts
+/**
+ *
+ * @see https://github.com/standard-schema/standard-schema/blob/main/packages/spec/src/index.ts
+ */
+/** The Standard Schema interface. */
+interface StandardSchemaV1<Input = unknown, Output = Input> {
+  /** The Standard Schema properties. */
+  readonly '~standard': StandardSchemaV1.Props<Input, Output>;
+}
+declare namespace StandardSchemaV1 {
+  /** The Standard Schema properties interface. */
+  interface Props<Input = unknown, Output = Input> {
+    /** The version number of the standard. */
+    readonly version: 1;
+    /** The vendor name of the schema library. */
+    readonly vendor: string;
+    /** Validates unknown input values. */
+    readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
+    /** Inferred types associated with the schema. */
+    readonly types?: Types<Input, Output> | undefined;
+  }
+  /** The result interface of the validate function. */
+  type Result<Output> = SuccessResult<Output> | FailureResult;
+  /** The result interface if validation succeeds. */
+  interface SuccessResult<Output> {
+    /** The typed output value. */
+    readonly value: Output;
+    /** The non-existent issues. */
+    readonly issues?: undefined;
+  }
+  /** The result interface if validation fails. */
+  interface FailureResult {
+    /** The issues of failed validation. */
+    readonly issues: ReadonlyArray<Issue>;
+  }
+  /** The issue interface of the failure output. */
+  interface Issue {
+    /** The error message of the issue. */
+    readonly message: string;
+    /** The path of the issue, if any. */
+    readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+  }
+  /** The path segment interface of the issue. */
+  interface PathSegment {
+    /** The key representing a path segment. */
+    readonly key: PropertyKey;
+  }
+  /** The Standard Schema types interface. */
+  interface Types<Input = unknown, Output = Input> {
+    /** The input type of the schema. */
+    readonly input: Input;
+    /** The output type of the schema. */
+    readonly output: Output;
+  }
+  /** Infers the input type of a Standard Schema. */
+  type InferInput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['input'];
+  /** Infers the output type of a Standard Schema. */
+  type InferOutput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['output'];
+}
+//# sourceMappingURL=spec.d.ts.map
+//#endregion
+//#region src/unstable-core-do-not-import/parser.d.ts
+type ParserZodEsque<TInput, TParsedInput> = {
+  _input: TInput;
+  _output: TParsedInput;
+};
+type ParserValibotEsque<TInput, TParsedInput> = {
+  schema: {
+    _types?: {
+      input: TInput;
+      output: TParsedInput;
+    };
+  };
+};
+type ParserArkTypeEsque<TInput, TParsedInput> = {
+  inferIn: TInput;
+  infer: TParsedInput;
+};
+type ParserStandardSchemaEsque<TInput, TParsedInput> = StandardSchemaV1<TInput, TParsedInput>;
+type ParserMyZodEsque<TInput> = {
+  parse: (input: any) => TInput;
+};
+type ParserSuperstructEsque<TInput> = {
+  create: (input: unknown) => TInput;
+};
+type ParserCustomValidatorEsque<TInput> = (input: unknown) => Promise<TInput> | TInput;
+type ParserYupEsque<TInput> = {
+  validateSync: (input: unknown) => TInput;
+};
+type ParserScaleEsque<TInput> = {
+  assert(value: unknown): asserts value is TInput;
+};
+type ParserWithoutInput<TInput> = ParserCustomValidatorEsque<TInput> | ParserMyZodEsque<TInput> | ParserScaleEsque<TInput> | ParserSuperstructEsque<TInput> | ParserYupEsque<TInput>;
+type ParserWithInputOutput<TInput, TParsedInput> = ParserZodEsque<TInput, TParsedInput> | ParserValibotEsque<TInput, TParsedInput> | ParserArkTypeEsque<TInput, TParsedInput> | ParserStandardSchemaEsque<TInput, TParsedInput>;
+type Parser = ParserWithInputOutput<any, any> | ParserWithoutInput<any>;
+type inferParser<TParser extends Parser> = TParser extends ParserStandardSchemaEsque<infer $TIn, infer $TOut> ? {
+  in: $TIn;
+  out: $TOut;
+} : TParser extends ParserWithInputOutput<infer $TIn, infer $TOut> ? {
+  in: $TIn;
+  out: $TOut;
+} : TParser extends ParserWithoutInput<infer $InOut> ? {
+  in: $InOut;
+  out: $InOut;
+} : never;//# sourceMappingURL=unstable-core-do-not-import.d-1RewV6pM.d.mts.map
+
+/**
+ * Email service adapter interface
+ * Implement this interface to integrate your email service
+ */
+interface EmailAdapter {
+    /**
+     * Send email verification email with OTP code
+     */
+    sendVerificationEmail(email: string, code: string): Promise<void>;
+    /**
+     * Send password reset email with token/link
+     */
+    sendPasswordResetEmail(email: string, token: string): Promise<void>;
+    /**
+     * Send OTP for passwordless login or 2FA reset
+     */
+    sendOTPEmail(email: string, otp: number): Promise<void>;
+    /**
+     * Send login notification to existing devices
+     */
+    sendLoginNotification?(email: string, browserName: string, ip?: string): Promise<void>;
+}
+/**
+ * No-op email adapter as default
+ */
+declare function createNoopEmailAdapter(): EmailAdapter;
+/**
+ * Console email adapter for development - logs emails to console
+ */
+declare function createConsoleEmailAdapter(): EmailAdapter;
+
+/**
+ * JWT payload structure
+ */
+interface JwtPayload {
+    id: number;
+    userId: number;
+    verifiedHumanAt: Date | null;
+    exp?: number;
+    iat?: number;
+}
+/**
+ * Credentials returned after successful authentication
+ */
+interface AuthCredentials {
+    accessToken: string;
+    refreshToken: string;
+}
+/**
+ * Cookie settings for auth tokens
+ */
+interface CookieSettings {
+    secure: boolean;
+    sameSite: 'Strict' | 'Lax' | 'None';
+    domain?: string;
+    httpOnly: boolean;
+    accessTokenPath: string;
+    refreshTokenPath: string;
+    maxAge: number;
+}
+
+type OAuthProvider = 'GOOGLE' | 'APPLE';
+interface OAuthResult {
+    email: string;
+    oauthId: string;
+}
+/**
+ * OAuth keys configuration for Google and Apple providers
+ */
+interface OAuthKeys {
+    google?: {
+        clientId: string;
+        clientSecret?: string;
+        iosClientId?: string;
+    };
+    apple?: {
+        clientId: string;
+        iosClientId?: string;
+    };
+}
+/**
+ * OAuth verification error
+ */
+declare class OAuthVerificationError extends Error {
+    readonly statusCode: number;
+    constructor(message: string, statusCode?: number);
+}
+/**
+ * Creates an OAuth token verifier with the provided keys
+ * @param keys OAuth provider keys configuration
+ * @returns A function to verify OAuth tokens
+ */
+declare function createOAuthVerifier(keys: OAuthKeys): (provider: OAuthProvider, token: string, extra?: {
+    email?: string;
+}) => Promise<OAuthResult>;
+
+/**
+ * Token and OTP expiry settings
+ */
+interface TokenSettings {
+    /** Access token expiry (e.g., '5m', '1h') */
+    accessTokenExpiry: string;
+    /** Password reset token expiry in ms (default: 1 hour) */
+    passwordResetExpiryMs: number;
+    /** OTP validity window in ms (default: 15 minutes) */
+    otpValidityMs: number;
+}
+/**
+ * Feature flags for optional auth features
+ */
+interface AuthFeatures {
+    /** Enable two-factor authentication */
+    twoFa?: boolean;
+    /** OAuth providers configuration */
+    oauth?: {
+        google?: boolean;
+        apple?: boolean;
+    };
+    /** Enable biometric verification */
+    biometric?: boolean;
+    /** Enable email verification */
+    emailVerification?: boolean;
+    /** Enable password reset via email */
+    passwordReset?: boolean;
+    /** Enable OTP-based login */
+    otpLogin?: boolean;
+}
+interface AuthConfig<TExtensions extends SchemaExtensions = {}> {
+    /**
+     * Prisma client instance with required models
+     */
+    prisma: PrismaClient;
+    /**
+     * Secret keys for JWT signing
+     */
+    secrets: {
+        jwt: string;
+    };
+    /**
+     * Email service adapter for sending verification/reset emails
+     */
+    emailService?: EmailAdapter;
+    /**
+     * Lifecycle hooks for business logic
+     * Receives extended input types based on schemaExtensions
+     */
+    hooks?: AuthHooks<TExtensions>;
+    /**
+     * Feature flags
+     */
+    features?: AuthFeatures;
+    /**
+     * Token expiry settings
+     */
+    tokenSettings?: TokenSettings;
+    /**
+     * Cookie configuration
+     */
+    cookieSettings?: Partial<CookieSettings>;
+    /**
+     * OAuth keys for Google and Apple providers
+     * Required if OAuth is enabled
+     */
+    oauthKeys?: OAuthKeys;
+    /**
+     * Username generator for OAuth signups
+     * Defaults to a simple email-based generator
+     */
+    generateUsername?: () => string;
+    /**
+     * Cookie storage keys
+     */
+    storageKeys?: {
+        accessToken: string;
+        refreshToken: string;
+    };
+    /**
+     * Schema extensions for adding custom fields to auth inputs
+     * Extensions are merged with base schemas and validated automatically
+     * Custom fields are then available in hooks with proper typing
+     */
+    schemaExtensions?: TExtensions;
+}
+
+declare function createAuthGuard(config: AuthConfig, t: TrpcBuilder): _trpc_server.TRPCMiddlewareBuilder<TrpcContext, Meta, {
+    userId: number;
+    socketId: string | null;
+    sessionId: number;
+    refreshToken: string | undefined;
+    headers: http.IncomingHttpHeaders;
+    res: http.ServerResponse<http.IncomingMessage>;
+    ip: string | undefined;
+}, unknown>;
+
+/**
+ * Default token settings
+ */
+declare const defaultTokenSettings: TokenSettings;
+/**
+ * Default cookie settings
+ */
+declare const defaultCookieSettings: CookieSettings;
+/**
+ * Default storage keys
+ */
+declare const defaultStorageKeys: {
+    accessToken: string;
+    refreshToken: string;
+};
+/**
+ * Create a fully resolved auth config with defaults applied
+ */
+declare function createAuthConfig(config: AuthConfig): Required<Omit<AuthConfig, 'hooks' | 'oauthKeys' | 'schemaExtensions'>> & AuthConfig;
+type ResolvedAuthConfig = ReturnType<typeof createAuthConfig>;
+/**
+ * Default auth config (requires prisma and secrets to be provided)
+ */
+declare const defaultAuthConfig: {
+    features: AuthFeatures;
+    tokenSettings: TokenSettings;
+    cookieSettings: CookieSettings;
+    storageKeys: {
+        accessToken: string;
+        refreshToken: string;
+    };
+};
+
+declare function createTrpcBuilder(config: ResolvedAuthConfig): _trpc_server.TRPCRootObject<TrpcContext, Meta, {
+    transformer: typeof SuperJSON__default;
+    errorFormatter: (opts: {
+        error: _trpc_server.TRPCError;
+        type: _trpc_server.ProcedureType | "unknown";
+        path: string | undefined;
+        input: unknown;
+        ctx: TrpcContext | undefined;
+        shape: _trpc_server.TRPCDefaultErrorShape;
+    }) => {
+        message: string;
+        data: {
+            zodError: zod.typeToFlattenedError<any, string> | null;
+            code: _trpc_server.TRPC_ERROR_CODE_KEY;
+            httpStatus: number;
+            path?: string;
+        };
+        code: _trpc_server.TRPC_ERROR_CODE_NUMBER;
+    };
+}, {
+    ctx: TrpcContext;
+    meta: Meta;
+    errorShape: {
+        message: string;
+        data: {
+            zodError: zod.typeToFlattenedError<any, string> | null;
+            code: _trpc_server.TRPC_ERROR_CODE_KEY;
+            httpStatus: number;
+            path?: string;
+        };
+        code: _trpc_server.TRPC_ERROR_CODE_NUMBER;
+    };
+    transformer: true;
+}>;
+
+type TrpcBuilder = ReturnType<typeof createTrpcBuilder>;
+type Meta = {
+    authRequired?: boolean;
+    adminRequired?: boolean;
+    ignoreExpiration?: boolean;
+};
+interface TrpcContext {
+    userId: number | null;
+    sessionId: number | null;
+    refreshToken: string | null;
+    socketId: string | null;
+    headers: CreateHTTPContextOptions['req']['headers'];
+    res: CreateHTTPContextOptions['res'];
+    ip?: string;
+}
+
+declare function createAuthRouter<TExtensions extends SchemaExtensions = {}>(config: AuthConfig<TExtensions>): {
+    router: _trpc_server.TRPCBuiltRouter<{
+        ctx: TrpcContext;
+        meta: Meta;
+        errorShape: {
+            message: string;
+            data: {
+                zodError: zod.typeToFlattenedError<any, string> | null;
+                code: _trpc_server.TRPC_ERROR_CODE_KEY;
+                httpStatus: number;
+                path?: string;
+            };
+            code: _trpc_server.TRPC_ERROR_CODE_NUMBER;
+        };
+        transformer: true;
+    }, _trpc_server.TRPCDecorateCreateRouterOptions<{
+        auth: _trpc_server.TRPCBuiltRouter<{
+            ctx: TrpcContext;
+            meta: Meta;
+            errorShape: {
+                message: string;
+                data: {
+                    zodError: zod.typeToFlattenedError<any, string> | null;
+                    code: _trpc_server.TRPC_ERROR_CODE_KEY;
+                    httpStatus: number;
+                    path?: string;
+                };
+                code: _trpc_server.TRPC_ERROR_CODE_NUMBER;
+            };
+            transformer: true;
+        }, _trpc_server.TRPCDecorateCreateRouterOptions<{
+            sendVerificationEmail: _trpc_server.TRPCMutationProcedure<{
+                input: void;
+                output: {
+                    message: string;
+                    emailSent: boolean;
+                };
+                meta: Meta;
+            }>;
+            verifyEmail: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    code: string;
+                };
+                output: {
+                    success: boolean;
+                    message: string;
+                };
+                meta: Meta;
+            }>;
+            getVerificationStatus: _trpc_server.TRPCQueryProcedure<{
+                input: void;
+                output: {
+                    email: string;
+                    status: _prisma_client.$Enums.EmailVerificationStatus;
+                    isVerified: boolean;
+                };
+                meta: Meta;
+            }>;
+            verifyBiometric: _trpc_server.TRPCMutationProcedure<{
+                input: {};
+                output: {
+                    success: boolean;
+                    verifiedAt: Date;
+                };
+                meta: Meta;
+            }>;
+            getBiometricStatus: _trpc_server.TRPCQueryProcedure<{
+                input: void;
+                output: {
+                    verifiedHumanAt: Date | null;
+                    isVerified: boolean;
+                    isExpired: boolean;
+                    requiresVerification: boolean;
+                };
+                meta: Meta;
+            }>;
+            enableTwofa: _trpc_server.TRPCMutationProcedure<{
+                input: void;
+                output: {
+                    secret: string;
+                };
+                meta: Meta;
+            }>;
+            disableTwofa: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    password: string;
+                };
+                output: {
+                    disabled: boolean;
+                };
+                meta: Meta;
+            }>;
+            getTwofaSecret: _trpc_server.TRPCQueryProcedure<{
+                input: {
+                    pushCode: string;
+                };
+                output: {
+                    secret: string;
+                };
+                meta: Meta;
+            }>;
+            twoFaReset: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    username: string;
+                    password: string;
+                };
+                output: {
+                    success: boolean;
+                };
+                meta: Meta;
+            }>;
+            twoFaResetVerify: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    username: string;
+                    code: number;
+                };
+                output: {
+                    success: boolean;
+                    message: string;
+                };
+                meta: Meta;
+            }>;
+            registerPushToken: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    pushToken: string;
+                };
+                output: {
+                    registered: boolean;
+                };
+                meta: Meta;
+            }>;
+            deregisterPushToken: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    pushToken: string;
+                };
+                output: {
+                    deregistered: boolean;
+                };
+                meta: Meta;
+            }>;
+            oAuthLogin: _trpc_server.TRPCMutationProcedure<{
+                input: inferParser<[TExtensions["oauth"]] extends [zod.AnyZodObject] ? zod.ZodObject<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                } & TExtensions["oauth"]["shape"], "strip", zod.ZodTypeAny, zod.objectUtil.addQuestionMarks<zod.baseObjectOutputType<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                } & TExtensions["oauth"]["shape"]>, any> extends infer T ? { [k in keyof T]: T[k]; } : never, zod.baseObjectInputType<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                } & TExtensions["oauth"]["shape"]> extends infer T_1 ? { [k_1 in keyof T_1]: T_1[k_1]; } : never> : zod.ZodObject<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                }, "strip", zod.ZodTypeAny, {
+                    idToken: string;
+                    provider: "GOOGLE" | "APPLE";
+                    user?: {
+                        email?: string | undefined;
+                    } | undefined;
+                }, {
+                    idToken: string;
+                    provider: "GOOGLE" | "APPLE";
+                    user?: {
+                        email?: string | undefined;
+                    } | undefined;
+                }>>["in"] extends infer T_2 ? T_2 extends inferParser<[TExtensions["oauth"]] extends [zod.AnyZodObject] ? zod.ZodObject<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                } & TExtensions["oauth"]["shape"], "strip", zod.ZodTypeAny, zod.objectUtil.addQuestionMarks<zod.baseObjectOutputType<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                } & TExtensions["oauth"]["shape"]>, any> extends infer T_3 ? { [k in keyof T_3]: T_3[k]; } : never, zod.baseObjectInputType<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                } & TExtensions["oauth"]["shape"]> extends infer T_4 ? { [k_1 in keyof T_4]: T_4[k_1]; } : never> : zod.ZodObject<{
+                    idToken: zod.ZodString;
+                    user: zod.ZodOptional<zod.ZodObject<{
+                        email: zod.ZodOptional<zod.ZodString>;
+                    }, "strip", zod.ZodTypeAny, {
+                        email?: string | undefined;
+                    }, {
+                        email?: string | undefined;
+                    }>>;
+                    provider: zod.ZodEnum<["GOOGLE", "APPLE"]>;
+                }, "strip", zod.ZodTypeAny, {
+                    idToken: string;
+                    provider: "GOOGLE" | "APPLE";
+                    user?: {
+                        email?: string | undefined;
+                    } | undefined;
+                }, {
+                    idToken: string;
+                    provider: "GOOGLE" | "APPLE";
+                    user?: {
+                        email?: string | undefined;
+                    } | undefined;
+                }>>["in"] ? T_2 extends _trpc_server.TRPCUnsetMarker ? void : T_2 : never : never;
+                output: {
+                    success: boolean;
+                    user: {
+                        id: number;
+                        email: string;
+                        username: string;
+                    };
+                };
+                meta: Meta;
+            }>;
+            register: _trpc_server.TRPCMutationProcedure<{
+                input: inferParser<[TExtensions["signup"]] extends [zod.AnyZodObject] ? zod.ZodObject<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                } & TExtensions["signup"]["shape"], "strip", zod.ZodTypeAny, zod.objectUtil.addQuestionMarks<zod.baseObjectOutputType<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                } & TExtensions["signup"]["shape"]>, any> extends infer T_5 ? { [k_2 in keyof T_5]: T_5[k_2]; } : never, zod.baseObjectInputType<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                } & TExtensions["signup"]["shape"]> extends infer T_6 ? { [k_3 in keyof T_6]: T_6[k_3]; } : never> : zod.ZodObject<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                }, "strip", zod.ZodTypeAny, {
+                    username: string;
+                    email: string;
+                    password: string;
+                }, {
+                    username: string;
+                    email: string;
+                    password: string;
+                }>>["in"] extends infer T_7 ? T_7 extends inferParser<[TExtensions["signup"]] extends [zod.AnyZodObject] ? zod.ZodObject<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                } & TExtensions["signup"]["shape"], "strip", zod.ZodTypeAny, zod.objectUtil.addQuestionMarks<zod.baseObjectOutputType<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                } & TExtensions["signup"]["shape"]>, any> extends infer T_8 ? { [k_2 in keyof T_8]: T_8[k_2]; } : never, zod.baseObjectInputType<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                } & TExtensions["signup"]["shape"]> extends infer T_9 ? { [k_3 in keyof T_9]: T_9[k_3]; } : never> : zod.ZodObject<{
+                    username: zod.ZodString;
+                    email: zod.ZodString;
+                    password: zod.ZodString;
+                }, "strip", zod.ZodTypeAny, {
+                    username: string;
+                    email: string;
+                    password: string;
+                }, {
+                    username: string;
+                    email: string;
+                    password: string;
+                }>>["in"] ? T_7 extends _trpc_server.TRPCUnsetMarker ? void : T_7 : never : never;
+                output: {
+                    success: boolean;
+                    user: {
+                        id: number;
+                        email: string;
+                        username: string;
+                    };
+                };
+                meta: Meta;
+            }>;
+            login: _trpc_server.TRPCMutationProcedure<{
+                input: inferParser<[TExtensions["login"]] extends [zod.AnyZodObject] ? zod.ZodObject<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                } & TExtensions["login"]["shape"], "strip", zod.ZodTypeAny, zod.objectUtil.addQuestionMarks<zod.baseObjectOutputType<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                } & TExtensions["login"]["shape"]>, any> extends infer T_10 ? { [k_4 in keyof T_10]: T_10[k_4]; } : never, zod.baseObjectInputType<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                } & TExtensions["login"]["shape"]> extends infer T_11 ? { [k_5 in keyof T_11]: T_11[k_5]; } : never> : zod.ZodObject<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                }, "strip", zod.ZodTypeAny, {
+                    username: string;
+                    password: string;
+                    code?: string | undefined;
+                }, {
+                    username: string;
+                    password: string;
+                    code?: string | undefined;
+                }>>["in"] extends infer T_12 ? T_12 extends inferParser<[TExtensions["login"]] extends [zod.AnyZodObject] ? zod.ZodObject<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                } & TExtensions["login"]["shape"], "strip", zod.ZodTypeAny, zod.objectUtil.addQuestionMarks<zod.baseObjectOutputType<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                } & TExtensions["login"]["shape"]>, any> extends infer T_13 ? { [k_4 in keyof T_13]: T_13[k_4]; } : never, zod.baseObjectInputType<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                } & TExtensions["login"]["shape"]> extends infer T_14 ? { [k_5 in keyof T_14]: T_14[k_5]; } : never> : zod.ZodObject<{
+                    username: zod.ZodString;
+                    password: zod.ZodString;
+                    code: zod.ZodOptional<zod.ZodString>;
+                }, "strip", zod.ZodTypeAny, {
+                    username: string;
+                    password: string;
+                    code?: string | undefined;
+                }, {
+                    username: string;
+                    password: string;
+                    code?: string | undefined;
+                }>>["in"] ? T_12 extends _trpc_server.TRPCUnsetMarker ? void : T_12 : never : never;
+                output: {
+                    success: boolean;
+                    user: {
+                        id: number;
+                        email: string;
+                        username: string;
+                    };
+                };
+                meta: Meta;
+            }>;
+            logout: _trpc_server.TRPCMutationProcedure<{
+                input: void;
+                output: {
+                    success: boolean;
+                };
+                meta: Meta;
+            }>;
+            refresh: _trpc_server.TRPCQueryProcedure<{
+                input: void;
+                output: {
+                    success: boolean;
+                };
+                meta: Meta;
+            }>;
+            endAllSessions: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    skipCurrentSession?: boolean | undefined;
+                };
+                output: {
+                    success: boolean;
+                    revokedCount: number;
+                };
+                meta: Meta;
+            }>;
+            changePassword: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    currentPassword: string;
+                    newPassword: string;
+                };
+                output: {
+                    success: boolean;
+                    message: string;
+                };
+                meta: Meta;
+            }>;
+            sendPasswordResetEmail: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    email: string;
+                };
+                output: {
+                    message: string;
+                };
+                meta: Meta;
+            }>;
+            checkPasswordReset: _trpc_server.TRPCQueryProcedure<{
+                input: {
+                    token: string;
+                };
+                output: {
+                    valid: boolean;
+                };
+                meta: Meta;
+            }>;
+            resetPassword: _trpc_server.TRPCMutationProcedure<{
+                input: {
+                    password: string;
+                    token: string;
+                };
+                output: {
+                    message: string;
+                };
+                meta: Meta;
+            }>;
+        }>>;
+    }>>;
+    t: _trpc_server.TRPCRootObject<TrpcContext, Meta, {
+        transformer: typeof SuperJSON.default;
+        errorFormatter: (opts: {
+            error: _trpc_server.TRPCError;
+            type: _trpc_server.ProcedureType | "unknown";
+            path: string | undefined;
+            input: unknown;
+            ctx: TrpcContext | undefined;
+            shape: _trpc_server.TRPCDefaultErrorShape;
+        }) => {
+            message: string;
+            data: {
+                zodError: zod.typeToFlattenedError<any, string> | null;
+                code: _trpc_server.TRPC_ERROR_CODE_KEY;
+                httpStatus: number;
+                path?: string;
+            };
+            code: _trpc_server.TRPC_ERROR_CODE_NUMBER;
+        };
+    }, {
+        ctx: TrpcContext;
+        meta: Meta;
+        errorShape: {
+            message: string;
+            data: {
+                zodError: zod.typeToFlattenedError<any, string> | null;
+                code: _trpc_server.TRPC_ERROR_CODE_KEY;
+                httpStatus: number;
+                path?: string;
+            };
+            code: _trpc_server.TRPC_ERROR_CODE_NUMBER;
+        };
+        transformer: true;
+    }>;
+    procedure: _trpc_server.TRPCProcedureBuilder<TrpcContext, Meta, {
+        sessionId: number;
+        userId: number;
+        refreshToken: string | undefined;
+        socketId: string | null;
+        headers: http.IncomingHttpHeaders;
+        res: http.ServerResponse<http.IncomingMessage>;
+        ip: string | undefined;
+    }, _trpc_server.TRPCUnsetMarker, _trpc_server.TRPCUnsetMarker, _trpc_server.TRPCUnsetMarker, _trpc_server.TRPCUnsetMarker, false>;
+    authProcedure: _trpc_server.TRPCProcedureBuilder<TrpcContext, Meta, {
+        sessionId: number;
+        userId: number;
+        refreshToken: string | undefined;
+        socketId: string | null;
+        headers: http.IncomingHttpHeaders;
+        res: http.ServerResponse<http.IncomingMessage>;
+        ip: string | undefined;
+    }, _trpc_server.TRPCUnsetMarker, _trpc_server.TRPCUnsetMarker, _trpc_server.TRPCUnsetMarker, _trpc_server.TRPCUnsetMarker, false>;
+    createContext: ({ req, res }: CreateHTTPContextOptions) => TrpcContext;
+};
+type AuthRouter<TExtensions extends SchemaExtensions = {}> = ReturnType<typeof createAuthRouter<TExtensions>>;
+
+/**
+ * Detect browser/platform from user agent string
+ * @param userAgent - User agent string from request headers
+ * @returns Detected browser name
+ */
+declare function detectBrowser(userAgent: string): string;
+/**
+ * Check if the user agent indicates a mobile device
+ * @param userAgent - User agent string
+ * @returns True if mobile device
+ */
+declare function isMobileDevice(userAgent: string): boolean;
+/**
+ * Check if the user agent indicates a native app
+ * @param userAgent - User agent string
+ * @returns True if native app
+ */
+declare function isNativeApp(userAgent: string): boolean;
+
+/**
+ * Default storage keys for auth cookies
+ */
+declare const DEFAULT_STORAGE_KEYS: {
+    ACCESS_TOKEN: string;
+    REFRESH_TOKEN: string;
+};
+/**
+ * Parse auth tokens from cookie header
+ * @param cookieHeader - Raw cookie header string
+ * @param storageKeys - Custom storage keys (optional)
+ * @returns Parsed tokens
+ */
+declare function parseAuthCookies(cookieHeader: string | undefined, storageKeys?: {
+    accessToken: string;
+    refreshToken: string;
+}): {
+    accessToken?: string;
+    refreshToken?: string;
+};
+/**
+ * Set auth cookies on response
+ * @param res - HTTP response object
+ * @param credentials - Access and refresh tokens
+ * @param settings - Cookie settings
+ * @param storageKeys - Storage key names
+ */
+declare function setAuthCookies(res: CreateHTTPContextOptions['res'], credentials: Partial<AuthCredentials>, settings: Partial<CookieSettings>, storageKeys?: {
+    accessToken: string;
+    refreshToken: string;
+}): void;
+/**
+ * Clear auth cookies (for logout)
+ * @param res - HTTP response object
+ * @param settings - Cookie settings
+ * @param storageKeys - Storage key names
+ */
+declare function clearAuthCookies(res: CreateHTTPContextOptions['res'], settings: Partial<CookieSettings>, storageKeys?: {
+    accessToken: string;
+    refreshToken: string;
+}): void;
+
+/**
+ * Options for creating access tokens
+ */
+interface CreateTokenOptions {
+    secret: string;
+    expiresIn: SignOptions['expiresIn'];
+}
+/**
+ * Options for verifying access tokens
+ */
+interface VerifyTokenOptions {
+    secret: string;
+    ignoreExpiration?: boolean;
+}
+/**
+ * Create a JWT access token
+ * @param payload - Token payload containing session and user info
+ * @param options - Token creation options
+ * @returns Signed JWT token
+ */
+declare function createAccessToken(payload: Omit<JwtPayload, 'exp' | 'iat'>, options: CreateTokenOptions): string;
+/**
+ * Verify and decode a JWT access token
+ * @param token - JWT token to verify
+ * @param options - Verification options
+ * @returns Decoded token payload
+ * @throws Error if token is invalid or expired
+ */
+declare function verifyAccessToken(token: string, options: VerifyTokenOptions): JwtPayload;
+/**
+ * Decode a JWT token without verification
+ * @param token - JWT token to decode
+ * @returns Decoded payload or null if invalid
+ */
+declare function decodeToken(token: string): JwtPayload | null;
+/**
+ * Check if a token error is an expiration error
+ */
+declare function isTokenExpiredError(error: unknown): boolean;
+/**
+ * Check if a token error is a validation error
+ */
+declare function isTokenInvalidError(error: unknown): boolean;
+
+/**
+ * Hash a plain text password
+ * @param password - Plain text password
+ * @param saltRounds - Number of salt rounds (default: 10)
+ * @returns Hashed password
+ */
+declare function hashPassword(password: string, saltRounds?: number): Promise<string>;
+/**
+ * Compare a plain text password with a hashed password
+ * @param password - Plain text password
+ * @param hashedPassword - Hashed password to compare against
+ * @returns True if passwords match
+ */
+declare function comparePassword(password: string, hashedPassword: string): Promise<boolean>;
+/**
+ * Check if a password meets minimum requirements
+ * @param password - Password to validate
+ * @param minLength - Minimum length (default: 6)
+ * @returns Validation result with error message if invalid
+ */
+declare function validatePasswordStrength(password: string, minLength?: number): {
+    valid: boolean;
+    error?: string;
+};
+
+/**
+ * Generate a random TOTP secret
+ * @param length - Length of the secret (default: 16)
+ * @returns Base32 encoded secret
+ */
+declare function generateTotpSecret(length?: number): string;
+/**
+ * Clean a Base32 string by removing invalid characters
+ * @param input - Input string to clean
+ * @returns Cleaned Base32 string
+ */
+declare function cleanBase32String(input: string): string;
+/**
+ * Generate a TOTP code from a secret
+ * @param secret - Base32 encoded secret
+ * @returns Current TOTP code
+ */
+declare function generateTotpCode(secret: string): Promise<string>;
+/**
+ * Verify a TOTP code against a secret
+ * @param code - TOTP code to verify
+ * @param secret - Base32 encoded secret
+ * @param window - Number of time steps to check before/after current (default: 1)
+ * @returns True if code is valid
+ */
+declare function verifyTotp(code: string, secret: string): Promise<boolean>;
+/**
+ * Generate a random OTP code (for email-based verification)
+ * @param min - Minimum value (default: 100000)
+ * @param max - Maximum value (default: 999999)
+ * @returns Random 6-digit OTP
+ */
+declare function generateOtp(min?: number, max?: number): number;
+
+export { type AuthConfig, type AuthFeatures, AuthHooks, type AuthRouter, DEFAULT_STORAGE_KEYS, type EmailAdapter, type OAuthKeys, type OAuthProvider, type OAuthResult, OAuthVerificationError, SchemaExtensions, type TokenSettings, type TrpcContext, cleanBase32String, clearAuthCookies, comparePassword, createAccessToken, createAuthConfig, createAuthGuard, createAuthRouter, createConsoleEmailAdapter, createNoopEmailAdapter, createOAuthVerifier, decodeToken, defaultAuthConfig, defaultCookieSettings, defaultStorageKeys, defaultTokenSettings, detectBrowser, generateOtp, generateTotpCode, generateTotpSecret, hashPassword, isMobileDevice, isNativeApp, isTokenExpiredError, isTokenInvalidError, parseAuthCookies, setAuthCookies, validatePasswordStrength, verifyAccessToken, verifyTotp };