@syncello/auth 2.5.1 → 3.2.0

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 export { ColumnDefinition, ColumnType, EnumDefinition, EnumName, IndexDefinition, SCHEMA_VERSION, TableDefinition, TableName, enums, tableNames, tables } from './schema/index.js';
-import { PgTableWithColumns, PgTable } from 'drizzle-orm/pg-core';
+import { PgTableWithColumns } from 'drizzle-orm/pg-core';
 import * as hono from 'hono';
 import { Context } from 'hono';
 import { InferInsertModel, InferSelectModel } from 'drizzle-orm';
+import * as hono_types from 'hono/types';
 import { OpenAPIHono } from '@hono/zod-openapi';
 import * as hono_utils_types from 'hono/utils/types';
 import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
@@ -67,33 +68,8 @@ declare function validatePasswordWithBreachCheck(password: string, checkBreaches
 
 type DrizzleDB$2 = any;
 
-type SessionsTable = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        userId: any;
-        expiresAt: any;
-        createdAt: any;
-        lastActiveAt: any;
-        fingerprint: any;
-        ipAddress: any;
-    };
-    dialect: 'pg';
-}>;
-type UsersTable$4 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        email: any;
-        emailVerified: any;
-        sessionVersion: any;
-        createdAt: any;
-        updatedAt: any;
-    };
-    dialect: 'pg';
-}>;
+type SessionsTable = PgTableWithColumns<any>;
+type UsersTable$4 = PgTableWithColumns<any>;
 interface SessionTables {
     sessions: SessionsTable;
     users: UsersTable$4;
@@ -193,9 +169,15 @@ declare const AUTH_DEFAULTS: {
 };
 
 /**
- * Base type for auth tables - any Postgres table
+ * Base type for auth tables.
+ *
+ * The library is schema-agnostic: consumers inject their own Drizzle tables,
+ * so the concrete column types are not known at compile time within the
+ * library. `PgTableWithColumns<any>` keeps column access available (e.g.
+ * `schema.users.email`) and stays assignable to the column-specific table
+ * types declared by the core modules.
  */
-type AuthTable = PgTable;
+type AuthTable = PgTableWithColumns<any>;
 /**
  * Schema interface that consumers must provide.
  * Each property must be a Drizzle PgTable with the expected columns.
@@ -233,14 +215,19 @@ type InferSession<TSchema extends AuthSchema> = InferSelectModel<TSchema['sessio
 type InferNewSession<TSchema extends AuthSchema> = InferInsertModel<TSchema['sessions']>;
 /**
  * Database interface - accepts any Drizzle Postgres database.
+ *
  * Uses duck typing for flexibility across different Drizzle configurations.
+ * Because the consumer's concrete schema is injected at runtime, the query
+ * builder chains cannot be statically typed against specific tables here; the
+ * methods are intentionally permissive and rely on the consumer's real Drizzle
+ * instance for correctness.
  */
 interface AuthDatabase {
-    select: <T extends PgTable>(from?: T) => unknown;
-    insert: <T extends PgTable>(into: T) => unknown;
-    update: <T extends PgTable>(table: T) => unknown;
-    delete: <T extends PgTable>(from: T) => unknown;
-    query: Record<string, unknown>;
+    select: (...args: any[]) => any;
+    insert: (...args: any[]) => any;
+    update: (...args: any[]) => any;
+    delete: (...args: any[]) => any;
+    query: Record<string, any>;
 }
 /**
  * Configuration for createAuth
@@ -334,6 +321,51 @@ declare function createAuthMiddleware<TEnv = Record<string, unknown>>(auth: Auth
  */
 declare function getAuthContext<TEnv = Record<string, unknown>>(c: Context): AuthContext<TEnv>;
 
+/**
+ * Email adapter interface for provider abstraction
+ * Allows for provider abstraction (currently Resend)
+ */
+interface EmailSendOptions {
+    from: string;
+    to: string;
+    subject: string;
+    html: string;
+    text?: string;
+    tags?: Record<string, string>;
+}
+interface EmailSendResult {
+    success: boolean;
+    emailId?: string;
+    error?: string;
+}
+interface EmailAdapter {
+    /**
+     * Send an email through the provider
+     */
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+    /**
+     * Provider name for logging
+     */
+    readonly providerName: string;
+}
+/**
+ * Structural type for the Cloudflare Email Service `send_email` Workers binding.
+ * Defined locally so consumers do not need a specific @cloudflare/workers-types
+ * version that includes Email Service (beta) types.
+ */
+interface SendEmailBinding {
+    send(message: {
+        to: string;
+        from: string;
+        subject: string;
+        html?: string;
+        text?: string;
+        headers?: Record<string, string>;
+    }): Promise<{
+        messageId: string;
+    }>;
+}
+
 /**
  * Environment variables available in Cloudflare Workers
  */
@@ -343,8 +375,11 @@ type Env = {
     SESSION_SECRET: string;
     PASSWORD_PEPPER_V1: string;
     PASSWORD_PEPPER_V2?: string;
+    EMAIL_PROVIDER?: 'resend' | 'cloudflare';
+    EMAIL_FROM?: string;
     RESEND_API_KEY?: string;
     RESEND_WEBHOOK_SECRET?: string;
+    EMAIL?: SendEmailBinding;
     DB: {
         connectionString: string;
     };
@@ -426,16 +461,7 @@ declare function generateFingerprint(request: Request): Promise<string>;
 declare function getClientIp(request: Request): string;
 
 type DrizzleDB$1 = any;
-type UsersTable$3 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        lockedUntil: any;
-        failedLoginCount: any;
-    };
-    dialect: 'pg';
-}>;
+type UsersTable$3 = PgTableWithColumns<any>;
 interface AccountLockoutTables {
     users: UsersTable$3;
 }
@@ -485,31 +511,8 @@ declare function getMinutesUntilUnlock(unlockAt: number): number;
 declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, environment?: 'development' | 'staging' | 'production'): Promise<boolean>;
 
 type DrizzleDB = any;
-type UsersTable$2 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        email: any;
-        hashedPassword: any;
-        updatedAt: any;
-    };
-    dialect: 'pg';
-}>;
-type EmailChangeTokensTable = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        userId: any;
-        newEmail: any;
-        tokenHash: any;
-        cancelTokenHash: any;
-        expiresAt: any;
-        createdAt: any;
-    };
-    dialect: 'pg';
-}>;
+type UsersTable$2 = PgTableWithColumns<any>;
+type EmailChangeTokensTable = PgTableWithColumns<any>;
 interface EmailChangeTables {
     users: UsersTable$2;
     emailChangeTokens: EmailChangeTokensTable;
@@ -850,10 +853,1354 @@ declare const requireVerifiedEmail: hono.MiddlewareHandler<{
     Variables: Variables;
 }, string, {}, Response>;
 
-declare const auth: OpenAPIHono<{
+declare const authRoutes: OpenAPIHono<{
     Bindings: Env;
     Variables: Variables;
-}, {}, "/">;
+}, hono_types.MergeSchemaPath<{
+    "/:provider/authorize": {
+        $get: {
+            input: {
+                param: {
+                    provider: "google" | "microsoft";
+                };
+            } & {
+                query: {
+                    redirect?: string | undefined;
+                    invitationToken?: string | undefined;
+                    code_challenge?: string | undefined;
+                    code_challenge_method?: "S256" | undefined;
+                    redirect_uri?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 302;
+        };
+    };
+} & {
+    "/:provider/callback": {
+        $get: {
+            input: {
+                param: {
+                    provider: "google" | "microsoft";
+                };
+            } & {
+                query: {
+                    code?: string | undefined;
+                    state?: string | undefined;
+                    error?: string | undefined;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: 302;
+        };
+    };
+} & {
+    "/complete": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                message: string;
+                redirect: string;
+                user: {
+                    id: string;
+                    email: string;
+                    emailVerified: boolean;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/oauth"> & hono_types.MergeSchemaPath<{
+    "/status": {
+        $get: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                enabled: boolean;
+                methods: ("email" | "totp")[];
+                backupCodesRemaining: number;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/totp/setup": {
+        $post: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {};
+            output: {
+                secret: string;
+                qrCodeUri: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/totp/verify": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 500;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                success: boolean;
+                backupCodes?: string[] | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/totp/disable": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                success: boolean;
+                sessionInvalidated?: boolean | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/email/setup": {
+        $post: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {};
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/email/verify": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                };
+            };
+            output: {
+                success: boolean;
+                backupCodes?: string[] | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/email/send-code": {
+        $post: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {};
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/email/disable": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                success: boolean;
+                sessionInvalidated?: boolean | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/trusted-devices": {
+        $get: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                devices: {
+                    id: string;
+                    deviceName: string;
+                    deviceType: "desktop" | "mobile" | "tablet";
+                    ipAddress: string;
+                    lastUsedAt: number;
+                    createdAt: number;
+                }[];
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/trusted-devices/:id": {
+        $delete: {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {
+                param: {
+                    id: string;
+                };
+            };
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/backup-codes/regenerate": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                };
+            };
+            output: {
+                success: boolean;
+                backupCodes: string[];
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/challenge": {
+        $post: {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                    rememberDevice?: boolean | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                    rememberDevice?: boolean | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {
+                json: {
+                    code: string;
+                    method: "email" | "totp" | "backup";
+                    rememberDevice?: boolean | undefined;
+                };
+            };
+            output: {
+                user: {
+                    id: string;
+                    email: string;
+                    name: string | null;
+                };
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/challenge/resend": {
+        $post: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {};
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/2fa"> & {
+    "/signup": {
+        $post: {
+            input: {
+                json: {
+                    email: string;
+                    password?: string | undefined;
+                    name?: string | undefined;
+                    turnstileToken?: string | undefined;
+                    oauthToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    email: string;
+                    password?: string | undefined;
+                    name?: string | undefined;
+                    turnstileToken?: string | undefined;
+                    oauthToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 409;
+        } | {
+            input: {
+                json: {
+                    email: string;
+                    password?: string | undefined;
+                    name?: string | undefined;
+                    turnstileToken?: string | undefined;
+                    oauthToken?: string | undefined;
+                };
+            };
+            output: {
+                user: {
+                    id: string;
+                    email: string;
+                    name: string | null;
+                    emailVerified: boolean;
+                    avatarUrl?: string | null | undefined;
+                    theme?: "light" | "dark" | "system" | null | undefined;
+                    timezone?: string | null | undefined;
+                    createdAt?: string | undefined;
+                };
+                redirect: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/login": {
+        $post: {
+            input: {
+                json: {
+                    email: string;
+                    password: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    email: string;
+                    password: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    email: string;
+                    password: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 429;
+        } | {
+            input: {
+                json: {
+                    email: string;
+                    password: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                user?: {
+                    id: string;
+                    email: string;
+                    name: string | null;
+                    emailVerified: boolean;
+                    avatarUrl?: string | null | undefined;
+                    theme?: "light" | "dark" | "system" | null | undefined;
+                    timezone?: string | null | undefined;
+                    createdAt?: string | undefined;
+                } | undefined;
+                redirect?: string | undefined;
+                requires2fa?: boolean | undefined;
+                methods?: ("email" | "totp")[] | undefined;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/logout": {
+        $post: {
+            input: {};
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/me": {
+        $get: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 404;
+        } | {
+            input: {};
+            output: {
+                user: {
+                    id: string;
+                    email: string;
+                    name: string | null;
+                    emailVerified: boolean;
+                    avatarUrl?: string | null | undefined;
+                    theme?: "light" | "dark" | "system" | null | undefined;
+                    timezone?: string | null | undefined;
+                    createdAt?: string | undefined;
+                };
+                twoFactorEnabled: boolean;
+                twoFactorMethods: ("email" | "totp")[];
+                emailBounced: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/verify-email": {
+        $post: {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                success: boolean;
+                redirect: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/forgot-password": {
+        $post: {
+            input: {
+                json: {
+                    email: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    email: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/reset-password": {
+        $post: {
+            input: {
+                json: {
+                    token: string;
+                    password: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                    password: string;
+                    turnstileToken?: string | undefined;
+                };
+            };
+            output: {
+                success: boolean;
+                redirect: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/change-password": {
+        $post: {
+            input: {
+                json: {
+                    currentPassword: string;
+                    newPassword: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    currentPassword: string;
+                    newPassword: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    currentPassword: string;
+                    newPassword: string;
+                };
+            };
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/heartbeat": {
+        $post: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                success: boolean;
+                timestamp: number;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/change-email": {
+        $post: {
+            input: {
+                json: {
+                    password: string;
+                    newEmail: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    password: string;
+                    newEmail: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    password: string;
+                    newEmail: string;
+                };
+            };
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/confirm-email-change": {
+        $post: {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/cancel-email-change": {
+        $post: {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    token: string;
+                };
+            };
+            output: {
+                success: boolean;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/account": {
+        $delete: {
+            input: {
+                json: {
+                    password: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    password: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    password: string;
+                };
+            };
+            output: {
+                message: string;
+                purgeAt: string;
+                recoveryWindowDays: number;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/refresh": {
+        $post: {
+            input: {
+                json: {
+                    refreshToken: string;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    refreshToken: string;
+                };
+            };
+            output: {
+                accessToken: string;
+                expiresIn: number;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/resend-verification": {
+        $post: {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 401;
+        } | {
+            input: {};
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 429;
+        } | {
+            input: {};
+            output: {
+                success: boolean;
+                message: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/">;
 
 /**
  * RFC 9457 Problem Details interface
@@ -1181,39 +2528,15 @@ interface ResendWebhookPayload {
 }
 
 /**
- * Email adapter interface for provider abstraction
- * Allows for provider abstraction (currently Resend)
- */
-interface EmailSendOptions {
-    from: string;
-    to: string;
-    subject: string;
-    html: string;
-    text?: string;
-    tags?: Record<string, string>;
-}
-interface EmailSendResult {
-    success: boolean;
-    emailId?: string;
-    error?: string;
-}
-interface EmailAdapter {
-    /**
-     * Send an email through the provider
-     */
-    send(options: EmailSendOptions): Promise<EmailSendResult>;
-    /**
-     * Provider name for logging
-     */
-    readonly providerName: string;
-}
-
-/**
- * Create the Resend email adapter
+ * Create the configured email adapter.
  *
- * @param env - Environment variables
- * @returns ResendAdapter instance
- * @throws Error if RESEND_API_KEY is missing
+ * Provider is selected by EMAIL_PROVIDER (defaults to 'resend' for backward
+ * compatibility):
+ * - 'resend': requires RESEND_API_KEY
+ * - 'cloudflare': requires the EMAIL send_email Workers binding; dry-runs
+ *   (logs instead of sending) outside production/staging
+ *
+ * @throws Error if the selected provider's configuration is missing
  */
 declare function createEmailAdapter(env: Env): EmailAdapter;
 
@@ -1228,6 +2551,26 @@ declare class ResendAdapter implements EmailAdapter {
     send(options: EmailSendOptions): Promise<EmailSendResult>;
 }
 
+/**
+ * Cloudflare Email Service adapter
+ * Sends through the Workers `send_email` binding. Cloudflare manages bounce and
+ * complaint suppression at the account level; a send to a suppressed address is
+ * rejected with error code E_RECIPIENT_SUPPRESSED.
+ *
+ * In dry-run mode (any environment other than production/staging) it logs the
+ * email and reports success without sending: Cloudflare has no test inbox and
+ * real bounces damage sender reputation.
+ */
+declare class CloudflareEmailAdapter implements EmailAdapter {
+    private readonly binding;
+    private readonly options;
+    readonly providerName = "cloudflare";
+    constructor(binding: SendEmailBinding, options: {
+        dryRun: boolean;
+    });
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+}
+
 type UsersTable$1 = PgTableWithColumns<any>;
 declare class EmailService {
     private adapter;
@@ -1247,31 +2590,31 @@ declare class EmailService {
     /**
      * Send verification email
      */
-    sendVerificationEmail(data: VerificationEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendVerificationEmail(data: VerificationEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send password reset email
      */
-    sendPasswordResetEmail(data: PasswordResetEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendPasswordResetEmail(data: PasswordResetEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send email change confirmation email (to new email address)
      */
-    sendEmailChangeConfirmation(data: EmailChangeConfirmationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendEmailChangeConfirmation(data: EmailChangeConfirmationData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send email change notification email (to old email address)
      */
-    sendEmailChangeNotification(data: EmailChangeNotificationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendEmailChangeNotification(data: EmailChangeNotificationData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA verification code email
      */
-    send2faCodeEmail(data: TwoFactorCodeEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faCodeEmail(data: TwoFactorCodeEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA enabled confirmation email
      */
-    send2faEnabledEmail(data: TwoFactorEnabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faEnabledEmail(data: TwoFactorEnabledEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA disabled notification email
      */
-    send2faDisabledEmail(data: TwoFactorDisabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faDisabledEmail(data: TwoFactorDisabledEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
 }
 
 /**
@@ -1336,4 +2679,4 @@ declare function calculateBounceRate(db: PostgresJsDatabase<Record<string, unkno
  */
 declare function calculateComplaintRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
 
-export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, type DeviceType, type EmailAdapter, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, auth as authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };
+export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };