@syncello/auth 2.5.1

package/dist/index.d.cts

@@ -0,0 +1,1339 @@
+export { ColumnDefinition, ColumnType, EnumDefinition, EnumName, IndexDefinition, SCHEMA_VERSION, TableDefinition, TableName, enums, tableNames, tables } from './schema/index.cjs';
+import { PgTableWithColumns, PgTable } from 'drizzle-orm/pg-core';
+import * as hono from 'hono';
+import { Context } from 'hono';
+import { InferInsertModel, InferSelectModel } from 'drizzle-orm';
+import { OpenAPIHono } from '@hono/zod-openapi';
+import * as hono_utils_types from 'hono/utils/types';
+import { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+
+/**
+ * Hash a password using pepper-hardened bcrypt
+ * Flow: Normalize (NFKC) → HMAC-SHA256 (pepper) → Base64 → bcrypt
+ * @param password - Plain text password
+ * @param pepper - Secret pepper key (from env.PASSWORD_PEPPER_V1)
+ * @returns Hashed password
+ */
+declare function hashPassword(password: string, pepper: string): Promise<string>;
+/**
+ * Verify a password against its hash using pepper-hardened bcrypt
+ * @param password - Plain text password to verify
+ * @param hash - Stored bcrypt hash
+ * @param pepper - Secret pepper key (from env.PASSWORD_PEPPER_V1 or V2)
+ * @returns True if password matches
+ */
+declare function verifyPassword(password: string, hash: string, pepper: string): Promise<boolean>;
+/**
+ * Verify password with pepper rotation support
+ * Tries current pepper first, then falls back to previous pepper if provided
+ * @param password - Plain text password to verify
+ * @param hash - Stored bcrypt hash
+ * @param currentPepper - Current pepper (v1)
+ * @param previousPepper - Previous pepper (v2) for rotation support (optional)
+ * @returns Object with verification result and which pepper succeeded
+ */
+declare function verifyPasswordWithRotation(password: string, hash: string, currentPepper: string, previousPepper?: string): Promise<{
+    verified: boolean;
+    usedPreviousPepper: boolean;
+}>;
+/**
+ * Validate password meets security requirements
+ * OWASP 2024: Focus on length over complexity
+ * @param password - Password to validate
+ * @returns Validation result
+ */
+declare function validatePassword(password: string): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Check if password has been compromised using Have I Been Pwned API
+ * Uses k-anonymity model - only first 5 chars of SHA-1 hash are sent
+ * @param password - Password to check
+ * @returns True if password found in breach database
+ */
+declare function checkBreachedPassword(password: string): Promise<boolean>;
+/**
+ * Validate password with optional breach check
+ * @param password - Password to validate
+ * @param checkBreaches - Whether to check against HIBP database (default: true)
+ * @returns Validation result with optional breach warning
+ */
+declare function validatePasswordWithBreachCheck(password: string, checkBreaches?: boolean): Promise<{
+    valid: boolean;
+    error?: string;
+    warning?: string;
+}>;
+
+type DrizzleDB$2 = any;
+
+type SessionsTable = PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        id: any;
+        userId: any;
+        expiresAt: any;
+        createdAt: any;
+        lastActiveAt: any;
+        fingerprint: any;
+        ipAddress: any;
+    };
+    dialect: 'pg';
+}>;
+type UsersTable$4 = PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        id: any;
+        email: any;
+        emailVerified: any;
+        sessionVersion: any;
+        createdAt: any;
+        updatedAt: any;
+    };
+    dialect: 'pg';
+}>;
+interface SessionTables {
+    sessions: SessionsTable;
+    users: UsersTable$4;
+}
+interface SessionData {
+    user: {
+        id: string;
+        email: string;
+        emailVerified: boolean;
+        sessionVersion: number;
+        createdAt: Date;
+        updatedAt: Date;
+    };
+    session: {
+        id: string;
+        userId: string;
+        expiresAt: Date;
+        createdAt: Date;
+        lastActiveAt: Date | null;
+    };
+}
+/**
+ * Create a new session for a user
+ * @param db - Drizzle database instance
+ * @param tables - Session tables (sessions)
+ * @param userId - User ID
+ * @param fingerprint - Browser fingerprint (optional)
+ * @param ipAddress - Client IP address (optional)
+ * @param sessionTtlMs - Session TTL in milliseconds (optional)
+ * @returns Session ID
+ */
+declare function createSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, userId: string, fingerprint?: string, ipAddress?: string, sessionTtlMs?: number): Promise<string>;
+/**
+ * Validate a session and return user data
+ * @param db - Drizzle database instance
+ * @param tables - Session tables (sessions, users)
+ * @param sessionId - Session ID from cookie
+ * @param currentFingerprint - Current browser fingerprint (optional)
+ * @returns Session data or null if invalid
+ */
+declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string): Promise<SessionData | null>;
+/**
+ * Refresh session expiration (sliding window)
+ * @param db - Drizzle database instance
+ * @param tables - Session tables (sessions)
+ * @param sessionId - Session ID
+ * @param sessionTtlMs - Session TTL in milliseconds (optional)
+ */
+declare function refreshSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, sessionId: string, sessionTtlMs?: number): Promise<void>;
+/**
+ * Delete a session (logout)
+ * @param db - Drizzle database instance
+ * @param tables - Session tables (sessions)
+ * @param sessionId - Session ID
+ */
+declare function deleteSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, sessionId: string): Promise<void>;
+/**
+ * Delete all sessions for a user (logout all devices)
+ * @param db - Drizzle database instance
+ * @param tables - Session tables (sessions)
+ * @param userId - User ID
+ */
+declare function deleteAllUserSessions(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, userId: string): Promise<void>;
+/**
+ * Invalidate all sessions after password change
+ * @param db - Drizzle database instance
+ * @param tables - Session tables (sessions, users)
+ * @param userId - User ID
+ */
+declare function invalidateAllUserSessions(db: DrizzleDB$2, tables: SessionTables, userId: string): Promise<void>;
+
+/**
+ * Generate a cryptographically secure random token
+ * @param bytes - Number of bytes (default: 64 = 128 hex chars)
+ * @returns Hex-encoded token
+ */
+declare function generateSecureToken(bytes?: number): string;
+/**
+ * Hash a token using SHA-256 for storage
+ * NEVER store tokens in plain text - always hash first
+ * @param token - Token to hash
+ * @returns SHA-256 hash as hex string
+ */
+declare function hashToken(token: string): Promise<string>;
+
+/**
+ * Centralized auth configuration
+ * All hardcoded auth values should be defined here with env var overrides
+ */
+declare const AUTH_DEFAULTS: {
+    readonly SESSION_TTL_DAYS: 7;
+    readonly LOCKOUT_DURATION_MINUTES: 30;
+    readonly LOCKOUT_MAX_ATTEMPTS: 5;
+    readonly PASSWORD_RESET_TTL_MINUTES: 15;
+    readonly TWO_FACTOR_CHALLENGE_TTL_SECONDS: 300;
+    readonly APP_NAME: "App";
+};
+
+/**
+ * Base type for auth tables - any Postgres table
+ */
+type AuthTable = PgTable;
+/**
+ * Schema interface that consumers must provide.
+ * Each property must be a Drizzle PgTable with the expected columns.
+ * The CLI generates these tables in the consumer's project.
+ */
+interface AuthSchema {
+    users: AuthTable;
+    sessions: AuthTable;
+    user2faMethods: AuthTable;
+    userBackupCodes: AuthTable;
+    userTrustedDevices: AuthTable;
+    emailVerificationTokens: AuthTable;
+    passwordResetTokens: AuthTable;
+    emailChangeTokens: AuthTable;
+    emailEvents: AuthTable;
+    failedLoginAttempts: AuthTable;
+    securityAuditLog: AuthTable;
+    oauthAccounts: AuthTable;
+}
+/**
+ * Infer model types from a consumer's schema.
+ * These utilities let consumers extract types from their specific tables.
+ *
+ * @example
+ * ```typescript
+ * import { createAuth, type InferUser } from '@syncello/auth';
+ *
+ * const auth = createAuth({ db, schema, getEnv });
+ * type User = InferUser<typeof auth.schema>;
+ * ```
+ */
+type InferUser<TSchema extends AuthSchema> = InferSelectModel<TSchema['users']>;
+type InferNewUser<TSchema extends AuthSchema> = InferInsertModel<TSchema['users']>;
+type InferSession<TSchema extends AuthSchema> = InferSelectModel<TSchema['sessions']>;
+type InferNewSession<TSchema extends AuthSchema> = InferInsertModel<TSchema['sessions']>;
+/**
+ * Database interface - accepts any Drizzle Postgres database.
+ * Uses duck typing for flexibility across different Drizzle configurations.
+ */
+interface AuthDatabase {
+    select: <T extends PgTable>(from?: T) => unknown;
+    insert: <T extends PgTable>(into: T) => unknown;
+    update: <T extends PgTable>(table: T) => unknown;
+    delete: <T extends PgTable>(from: T) => unknown;
+    query: Record<string, unknown>;
+}
+/**
+ * Configuration for createAuth
+ */
+interface AuthConfig<TEnv = Record<string, unknown>> {
+    /** Drizzle database instance */
+    db: AuthDatabase;
+    /** Schema tables from generated auth.ts */
+    schema: AuthSchema;
+    /** Environment variables accessor */
+    getEnv: (c: Context) => TEnv;
+}
+/**
+ * Auth context available in all auth operations.
+ * Preserves the TEnv generic for type-safe environment access.
+ */
+interface AuthContext<TEnv = Record<string, unknown>> {
+    db: AuthDatabase;
+    schema: AuthSchema;
+    env: TEnv;
+}
+/**
+ * Creates an auth instance with injected database and schema.
+ * This follows the adapter pattern - consumers pass their db/schema TO the library.
+ *
+ * @example
+ * ```typescript
+ * import { createAuth } from '@syncello/auth';
+ * import { db } from './db';
+ * import * as schema from './db/schema';
+ *
+ * const auth = createAuth({
+ *   db,
+ *   schema: {
+ *     users: schema.users,
+ *     sessions: schema.sessions,
+ *     user2faMethods: schema.user2faMethods,
+ *     userBackupCodes: schema.userBackupCodes,
+ *     userTrustedDevices: schema.userTrustedDevices,
+ *     emailVerificationTokens: schema.emailVerificationTokens,
+ *     passwordResetTokens: schema.passwordResetTokens,
+ *     emailChangeTokens: schema.emailChangeTokens,
+ *     emailEvents: schema.emailEvents,
+ *     failedLoginAttempts: schema.failedLoginAttempts,
+ *     securityAuditLog: schema.securityAuditLog,
+ *     oauthAccounts: schema.oauthAccounts,
+ *   },
+ *   getEnv: (c) => c.env,
+ * });
+ *
+ * // Use context in middleware/handlers
+ * const ctx = auth.getContext(c);
+ * const user = await ctx.db.query.users.findFirst(...);
+ * ```
+ */
+declare function createAuth<TEnv = Record<string, unknown>>(config: AuthConfig<TEnv>): {
+    db: AuthDatabase;
+    schema: AuthSchema;
+    getContext: (c: Context) => AuthContext<TEnv>;
+};
+type Auth<TEnv = Record<string, unknown>> = ReturnType<typeof createAuth<TEnv>>;
+/**
+ * Creates a middleware that injects AuthContext into the Hono context.
+ * Apply this middleware before mounting auth routes.
+ *
+ * @example
+ * ```typescript
+ * import { createAuth, createAuthMiddleware } from '@syncello/auth';
+ *
+ * const auth = createAuth({ db, schema, getEnv: (c) => c.env });
+ * const authMiddleware = createAuthMiddleware(auth);
+ *
+ * app.use('/api/auth/*', authMiddleware);
+ * app.route('/api/auth', authRoutes);
+ * ```
+ */
+declare function createAuthMiddleware<TEnv = Record<string, unknown>>(auth: Auth<TEnv>): (c: Context, next: () => Promise<void>) => Promise<void>;
+/**
+ * Helper to get AuthContext from Hono context.
+ * Use this in route handlers to access db, schema, and env.
+ *
+ * @example
+ * ```typescript
+ * import { getAuthContext } from '@syncello/auth';
+ *
+ * const handler = async (c) => {
+ *   const { db, schema, env } = getAuthContext(c);
+ *   const user = await db.select().from(schema.users).where(...);
+ * };
+ * ```
+ */
+declare function getAuthContext<TEnv = Record<string, unknown>>(c: Context): AuthContext<TEnv>;
+
+/**
+ * Environment variables available in Cloudflare Workers
+ */
+type Env = {
+    APP_URL: string;
+    APP_NAME?: string;
+    SESSION_SECRET: string;
+    PASSWORD_PEPPER_V1: string;
+    PASSWORD_PEPPER_V2?: string;
+    RESEND_API_KEY?: string;
+    RESEND_WEBHOOK_SECRET?: string;
+    DB: {
+        connectionString: string;
+    };
+    ENVIRONMENT?: 'development' | 'staging' | 'production';
+    CORS_ORIGINS?: string;
+    CORS_PAGES_PATTERN?: string;
+    COOKIE_DOMAIN?: string;
+    SESSION_TTL_DAYS?: string;
+    LOCKOUT_DURATION_MINUTES?: string;
+    LOCKOUT_MAX_ATTEMPTS?: string;
+    PASSWORD_RESET_TTL_MINUTES?: string;
+    TWO_FACTOR_CHALLENGE_TTL_SECONDS?: string;
+    SENTRY_DSN?: string;
+    CF_VERSION_METADATA?: {
+        id: string;
+        tag: string;
+        timestamp: string;
+    };
+    ENCRYPTION_KEY_V1: string;
+    ENCRYPTION_KEY_V2?: string;
+    ENCRYPTION_ACTIVE_KEY_VERSION: string;
+    TOTP_ENCRYPTION_KEY: string;
+    GOOGLE_CLIENT_ID?: string;
+    GOOGLE_CLIENT_SECRET?: string;
+    MICROSOFT_CLIENT_ID?: string;
+    MICROSOFT_CLIENT_SECRET?: string;
+    STRIPE_SECRET_KEY?: string;
+    STRIPE_WEBHOOK_SECRET?: string;
+    STRIPE_PRICE_BASIC?: string;
+    STRIPE_PRICE_PRO?: string;
+    RATE_LIMIT_KV: KVNamespace;
+    OAUTH_STATES: KVNamespace;
+    AVATARS: R2Bucket;
+    AVATARS_PUBLIC_URL?: string;
+    CACHE_KV?: KVNamespace;
+    TURNSTILE_SECRET_KEY: string;
+};
+/**
+ * Variables set by middleware and available in route handlers
+ */
+type Variables = {
+    db: AuthDatabase;
+    userId?: string;
+    requestId: string;
+    traceId: string;
+    spanId: string;
+    authContext?: AuthContext;
+};
+
+declare function getSessionCookieName(env?: {
+    ENVIRONMENT?: string;
+}): string;
+declare function setSessionCookie(sessionId: string, env?: {
+    ENVIRONMENT?: string;
+}): string;
+declare function clearSessionCookie(env?: {
+    ENVIRONMENT?: string;
+}): string;
+declare function getTrustedDeviceCookieName(env: Env): string;
+declare function setTrustedDeviceCookie(c: Context, env: Env, token: string): void;
+declare function clearTrustedDeviceCookie(c: Context, env: Env): void;
+declare function getChallengeCookieName(env: Env): string;
+declare function setChallengeCookie(c: Context, env: Env, token: string): void;
+declare function clearChallengeCookie(c: Context, env: Env): void;
+
+/**
+ * Generate a browser fingerprint from request headers
+ * Uses User-Agent and Accept-Language to create a stable identifier
+ * @param request - The incoming request
+ * @returns SHA-256 hash (first 32 characters)
+ */
+declare function generateFingerprint(request: Request): Promise<string>;
+/**
+ * Get client IP address from request headers
+ * Prioritizes Cloudflare's cf-connecting-ip, falls back to x-forwarded-for
+ * @param request - The incoming request
+ * @returns Client IP address or 'unknown'
+ */
+declare function getClientIp(request: Request): string;
+
+type DrizzleDB$1 = any;
+type UsersTable$3 = PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        id: any;
+        lockedUntil: any;
+        failedLoginCount: any;
+    };
+    dialect: 'pg';
+}>;
+interface AccountLockoutTables {
+    users: UsersTable$3;
+}
+/**
+ * Check if an account is currently locked
+ * @param db - Drizzle database instance
+ * @param tables - Account lockout tables (users)
+ * @param userId - User ID to check
+ * @returns Lock status and unlock time if locked
+ */
+declare function checkAccountLocked(db: DrizzleDB$1, tables: AccountLockoutTables, userId: string): Promise<{
+    isLocked: boolean;
+    unlockAt?: number;
+}>;
+/**
+ * Increment failed login attempts for a user
+ * Locks account after maxAttempts
+ * @param db - Drizzle database instance
+ * @param tables - Account lockout tables (users)
+ * @param userId - User ID
+ * @param maxAttempts - Maximum failed attempts before lockout
+ * @param lockoutDurationMs - Duration of lockout in milliseconds
+ */
+declare function incrementFailedAttempts(db: DrizzleDB$1, tables: AccountLockoutTables, userId: string, maxAttempts?: number, lockoutDurationMs?: number): Promise<void>;
+/**
+ * Clear account lockout and failed attempt counter
+ * Called after successful login
+ * @param db - Drizzle database instance
+ * @param tables - Account lockout tables (users)
+ * @param userId - User ID
+ */
+declare function clearAccountLockout(db: DrizzleDB$1, tables: AccountLockoutTables, userId: string): Promise<void>;
+/**
+ * Get minutes remaining until account unlock
+ * @param unlockAt - Unlock timestamp
+ * @returns Minutes remaining (rounded up)
+ */
+declare function getMinutesUntilUnlock(unlockAt: number): number;
+
+/**
+ * Verifies a Cloudflare Turnstile token server-side.
+ * Returns true if the token is valid, false otherwise.
+ *
+ * In staging/test environments, uses Cloudflare's test secret key that always passes.
+ * @see https://developers.cloudflare.com/turnstile/tutorials/excluding-turnstile-from-e2e-tests/
+ */
+declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, environment?: 'development' | 'staging' | 'production'): Promise<boolean>;
+
+type DrizzleDB = any;
+type UsersTable$2 = PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        id: any;
+        email: any;
+        hashedPassword: any;
+        updatedAt: any;
+    };
+    dialect: 'pg';
+}>;
+type EmailChangeTokensTable = PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        id: any;
+        userId: any;
+        newEmail: any;
+        tokenHash: any;
+        cancelTokenHash: any;
+        expiresAt: any;
+        createdAt: any;
+    };
+    dialect: 'pg';
+}>;
+interface EmailChangeTables {
+    users: UsersTable$2;
+    emailChangeTokens: EmailChangeTokensTable;
+}
+interface RequestEmailChangeParams {
+    userId: string;
+    password: string;
+    newEmail: string;
+    pepper: string;
+    db: DrizzleDB;
+    tables: EmailChangeTables;
+}
+interface RequestEmailChangeResult {
+    success: boolean;
+    error?: string;
+    confirmToken?: string;
+    cancelToken?: string;
+    oldEmail?: string;
+}
+/**
+ * Request an email change - validates password and creates tokens
+ */
+declare function requestEmailChange(params: RequestEmailChangeParams): Promise<RequestEmailChangeResult>;
+interface ConfirmEmailChangeParams {
+    token: string;
+    db: DrizzleDB;
+    tables: EmailChangeTables;
+}
+interface ConfirmEmailChangeResult {
+    success: boolean;
+    error?: string;
+}
+/**
+ * Confirm email change - validates token and updates email
+ */
+declare function confirmEmailChange(params: ConfirmEmailChangeParams): Promise<ConfirmEmailChangeResult>;
+interface CancelEmailChangeParams {
+    token: string;
+    db: DrizzleDB;
+    tables: Pick<EmailChangeTables, 'emailChangeTokens'>;
+}
+interface CancelEmailChangeResult {
+    success: boolean;
+    error?: string;
+}
+/**
+ * Cancel email change - validates cancel token and deletes pending change
+ */
+declare function cancelEmailChange(params: CancelEmailChangeParams): Promise<CancelEmailChangeResult>;
+
+/**
+ * Unified API Key utilities
+ *
+ * Keys use `syn_` prefix + 32 hex chars (36 total).
+ * Keys are hashed with SHA-256 for storage — never stored in retrievable form.
+ */
+/**
+ * Generate a new API key: syn_ + 32 random hex characters
+ */
+declare function generateApiKey(): string;
+/**
+ * Hash an API key using SHA-256 for secure storage/lookup
+ */
+declare function hashApiKey(key: string): Promise<string>;
+/**
+ * Extract display prefix from a key (first 12 chars: syn_ + 8 hex)
+ */
+declare function getKeyPrefix(key: string): string;
+/**
+ * Validate API key format: syn_ + 32 hex chars
+ */
+declare function isValidApiKeyFormat(key: string): boolean;
+
+/**
+ * Validate Origin header for state-changing requests
+ * Prevents CSRF attacks by ensuring requests come from same origin
+ *
+ * @param request - The incoming request
+ * @param allowedOrigins - List of allowed origins (e.g., ['https://app.example.com'])
+ * @returns True if valid, false if suspicious
+ */
+declare function validateOrigin(request: Request, allowedOrigins: string[], pagesPattern?: string): boolean;
+/**
+ * Get allowed origins from environment
+ */
+declare function getAllowedOrigins(appUrl: string): string[];
+/**
+ * Check if origin is a Cloudflare Pages preview URL for this project.
+ * Uses CORS_PAGES_PATTERN env var (e.g., "your-app.pages.dev") to match preview deployments.
+ * If no pattern is configured, returns false (no preview URLs allowed by default).
+ */
+declare function isCloudflarePreviewUrl(origin: string, pagesPattern?: string): boolean;
+/**
+ * Check if origin is a Capacitor mobile app
+ * Allows capacitor:// and ionic:// protocols used by iOS/Android apps
+ */
+declare function isCapacitorApp(origin: string): boolean;
+
+/**
+ * Mobile authentication utilities
+ * Implements PKCE (RFC 7636) for secure OAuth on native apps
+ */
+/**
+ * Generate a cryptographically random code verifier for PKCE
+ * @returns Code verifier string (43-128 chars, URL-safe)
+ */
+declare function generateCodeVerifier(): string;
+/**
+ * Generate S256 code challenge from verifier
+ * @param verifier - Code verifier string
+ * @returns Base64URL-encoded SHA256 hash
+ */
+declare function generateCodeChallenge(verifier: string): Promise<string>;
+/**
+ * Verify that a code verifier matches a code challenge
+ * @param verifier - The code verifier from the token request
+ * @param challenge - The code challenge from the authorization request
+ * @returns True if verifier hashes to challenge
+ */
+declare function verifyCodeChallenge(verifier: string, challenge: string): Promise<boolean>;
+/**
+ * Check if a URI is a deep link (custom scheme)
+ * Deep links are used by native mobile apps for OAuth callbacks
+ * @param uri - The redirect URI to check
+ * @returns True if URI uses a custom scheme (not http/https)
+ */
+declare function isDeepLinkUri(uri: string): boolean;
+
+/**
+ * TOTP (Time-based One-Time Password) utilities
+ * RFC 6238 compliant with replay prevention
+ */
+/**
+ * Get current TOTP counter (time step)
+ */
+declare function getTotpCounter(): number;
+/**
+ * Generate a cryptographically secure TOTP secret
+ * @returns Base32-encoded 20-byte secret (32 characters)
+ */
+declare function generateTotpSecret(): string;
+/**
+ * Generate the otpauth:// URI for QR code scanning
+ * @param secret - Base32-encoded TOTP secret
+ * @param email - User's email address
+ * @param issuer - Application name shown in authenticator apps (default: AUTH_DEFAULTS.APP_NAME)
+ */
+declare function generateQrCodeUri(secret: string, email: string, issuer?: string): string;
+type TotpVerifyResult = {
+    valid: true;
+    counter: number;
+} | {
+    valid: false;
+    counter?: undefined;
+};
+/**
+ * Verify a TOTP code with replay prevention
+ * @param secret - Base32-encoded TOTP secret
+ * @param code - 6-digit TOTP code from user
+ * @param lastCounter - Last accepted counter (null if first verification)
+ * @returns Verification result with counter if valid
+ */
+declare function verifyTotpCode(secret: string, code: string, lastCounter: number | null): TotpVerifyResult;
+/**
+ * Encrypt a TOTP secret using AES-256-GCM
+ */
+declare function encryptTotpSecret(secret: string, keyHex: string): Promise<string>;
+/**
+ * Decrypt a TOTP secret using AES-256-GCM
+ */
+declare function decryptTotpSecret(encrypted: string, keyHex: string): Promise<string>;
+
+/**
+ * Backup codes for 2FA recovery
+ * Uses bcrypt for NIST SP 800-63B compliance (secrets < 112 bits)
+ */
+/**
+ * Generate backup codes
+ * @param count - Number of codes to generate (default: 10)
+ * @returns Array of 8-character backup codes
+ */
+declare function generateBackupCodes(count?: number): string[];
+/**
+ * Format a backup code for display (XXXX-XXXX)
+ */
+declare function formatBackupCode(code: string): string;
+/**
+ * Normalize user input for comparison
+ */
+declare function normalizeBackupCode(input: string): string;
+/**
+ * Hash a backup code using bcrypt (NIST compliant)
+ */
+declare function hashBackupCode(code: string): Promise<string>;
+/**
+ * Verify a backup code against a stored bcrypt hash
+ */
+declare function verifyBackupCode(code: string, storedHash: string): Promise<boolean>;
+
+/**
+ * Trusted device management for 2FA "Remember this device" feature
+ */
+/** Trusted device cookie TTL: 30 days in milliseconds */
+declare const TRUSTED_DEVICE_TTL_MS: number;
+/** Trusted device cookie base name */
+declare const TRUSTED_DEVICE_COOKIE_BASE = "trusted_device";
+type DeviceType = 'desktop' | 'mobile' | 'tablet';
+/**
+ * Parse User-Agent to get a human-readable device name
+ */
+declare function parseDeviceName(userAgent: string): string;
+/**
+ * Parse User-Agent to determine device type (desktop, mobile, or tablet)
+ */
+declare function parseDeviceType(userAgent: string): DeviceType;
+/**
+ * Create a new trusted device token
+ */
+declare function createDeviceToken(): {
+    token: string;
+    expiresAt: number;
+};
+/**
+ * Validate a trusted device token for a user
+ * Returns true if the token is valid and not expired
+ */
+declare function validateTrustedDevice(db: any, userTrustedDevicesTable: any, userId: string, tokenHash: string): Promise<boolean>;
+
+/**
+ * 2FA Challenge token management with KV helpers
+ */
+/** Challenge token TTL: 5 minutes */
+declare const CHALLENGE_TTL_MS: number;
+/** Max attempts before challenge is invalidated */
+declare const MAX_CHALLENGE_ATTEMPTS = 5;
+interface ChallengePayload {
+    userId: string;
+    methods: ('totp' | 'email')[];
+    invitationToken: string | null;
+    expiresAt: number;
+    attempts: number;
+    createdAt: number;
+}
+type ValidationResult = {
+    valid: true;
+} | {
+    valid: false;
+    reason: 'expired' | 'max_attempts' | 'invalid';
+};
+/**
+ * Create a new challenge token with full context
+ */
+declare function createChallengeToken(userId: string, methods: ('totp' | 'email')[], invitationToken: string | null): {
+    token: string;
+    payload: ChallengePayload;
+};
+/**
+ * Validate a challenge payload
+ */
+declare function validateChallengePayload(payload: ChallengePayload): ValidationResult;
+/**
+ * Store a challenge token in KV
+ */
+declare function storeChallengeToken(kv: KVNamespace, token: string, payload: ChallengePayload): Promise<void>;
+/**
+ * Retrieve a challenge token from KV
+ */
+declare function retrieveChallengeToken(kv: KVNamespace, token: string): Promise<ChallengePayload | null>;
+/**
+ * Update challenge attempts in KV
+ */
+declare function updateChallengeAttempts(kv: KVNamespace, token: string, payload: ChallengePayload): Promise<void>;
+/**
+ * Delete a challenge token from KV
+ */
+declare function deleteChallengeToken(kv: KVNamespace, token: string): Promise<void>;
+
+/**
+ * Auth middleware - ensures user is authenticated
+ * Sets userId in context if session is valid
+ */
+declare const requireAuth: hono.MiddlewareHandler<{
+    Bindings: Env;
+    Variables: Variables;
+}, string, {}, Response>;
+/**
+ * Optional auth middleware - sets userId if session exists, continues either way
+ */
+declare const optionalAuth: hono.MiddlewareHandler<{
+    Bindings: Env;
+    Variables: Variables;
+}, string, {}, Response>;
+
+/**
+ * CSRF middleware - validates Origin header for state-changing requests
+ * Prevents CSRF attacks by ensuring requests come from allowed origins
+ */
+declare const csrf: hono.MiddlewareHandler<{
+    Bindings: Env;
+    Variables: Variables;
+}, string, {}, Response>;
+
+type RateLimitConfig = {
+    identifier: (c: Context<{
+        Bindings: Env;
+        Variables: Variables;
+    }>) => Promise<string> | string;
+    action: string;
+    maxAttempts: number;
+    windowMs: number;
+};
+/**
+ * Rate limit middleware factory
+ * Uses KV-backed rate limiting (check + increment) to avoid database hits.
+ *
+ * Sets standard rate limit headers on all responses:
+ * - X-RateLimit-Limit: Maximum requests allowed in window
+ * - X-RateLimit-Remaining: Requests remaining in current window
+ * - X-RateLimit-Reset: Unix timestamp when the window resets
+ *
+ * On 429 responses, also sets:
+ * - Retry-After: Seconds until the rate limit resets
+ *
+ * @param config - Rate limit configuration
+ * @returns Middleware that enforces rate limits
+ */
+declare const rateLimit: (config: RateLimitConfig) => hono.MiddlewareHandler<{
+    Bindings: Env;
+    Variables: Variables;
+}, string, {}, Response>;
+
+/**
+ * Middleware that requires the authenticated user to have a verified email.
+ * Must be used AFTER requireAuth middleware.
+ */
+declare const requireVerifiedEmail: hono.MiddlewareHandler<{
+    Bindings: Env;
+    Variables: Variables;
+}, string, {}, Response>;
+
+declare const auth: OpenAPIHono<{
+    Bindings: Env;
+    Variables: Variables;
+}, {}, "/">;
+
+/**
+ * RFC 9457 Problem Details interface
+ * All fields are optional per spec, but we require type/title/status for consistency
+ */
+interface ProblemDetails {
+    /** URI identifying the problem type (defaults to about:blank) */
+    type: string;
+    /** Short, human-readable summary of the problem type */
+    title: string;
+    /** HTTP status code */
+    status: number;
+    /** Human-readable explanation specific to this occurrence */
+    detail?: string;
+    /** URI identifying the specific occurrence of the problem */
+    instance?: string;
+    /** OpenTelemetry trace ID (32-char hex) for distributed tracing */
+    traceId?: string;
+    /** Request ID from X-Request-ID header for correlation */
+    requestId?: string;
+    /** Additional extension members (validation errors, etc.) */
+    [key: string]: unknown;
+}
+/**
+ * Common problem types for the API
+ * Using relative URIs - update these to point to your documentation
+ */
+declare const ProblemTypes: {
+    readonly BAD_REQUEST: "/errors/bad-request";
+    readonly UNAUTHORIZED: "/errors/unauthorized";
+    readonly FORBIDDEN: "/errors/forbidden";
+    readonly NOT_FOUND: "/errors/not-found";
+    readonly CONFLICT: "/errors/conflict";
+    readonly GONE: "/errors/gone";
+    readonly VALIDATION_ERROR: "/errors/validation-error";
+    readonly RATE_LIMIT_EXCEEDED: "/errors/rate-limit-exceeded";
+    readonly INTERNAL_ERROR: "/errors/internal-error";
+    readonly SERVICE_UNAVAILABLE: "/errors/service-unavailable";
+};
+/**
+ * Generate a trace ID in OpenTelemetry format (32-character hex string)
+ * Uses Web Crypto API for cryptographically secure randomness
+ */
+declare function generateTraceId(): string;
+/**
+ * Create a Problem Details object with automatic traceId and requestId
+ */
+declare function createProblemDetails(type: string, title: string, status: number, options?: {
+    detail?: string;
+    instance?: string;
+    traceId?: string;
+    requestId?: string;
+    extensions?: Record<string, unknown>;
+}): ProblemDetails;
+/**
+ * Return a Problem Details JSON response from a Hono context
+ * Sets the correct Content-Type header (application/problem+json)
+ */
+declare function problemJson(c: Context, problem: ProblemDetails): Response & hono.TypedResponse<{
+    [x: string]: hono_utils_types.JSONValue;
+    type: string;
+    title: string;
+    status: number;
+    detail?: string | undefined;
+    instance?: string | undefined;
+    traceId?: string | undefined;
+    requestId?: string | undefined;
+}, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+/**
+ * Helper function to return common problem types
+ */
+declare const problems: {
+    /**
+     * 400 Bad Request - Generic client error
+     */
+    badRequest(c: Context, detail?: string): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 400 Bad Request - Validation errors with field-specific details
+     */
+    validationError(c: Context, detail: string, errors?: Array<{
+        field: string;
+        message: string;
+    }>): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 401 Unauthorized - Authentication required
+     */
+    unauthorized(c: Context, detail?: string): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 403 Forbidden - Insufficient permissions
+     */
+    forbidden(c: Context, detail?: string): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 404 Not Found
+     */
+    notFound(c: Context, detail?: string): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 409 Conflict - Resource conflict (e.g., duplicate email)
+     */
+    conflict(c: Context, detail: string): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 410 Gone - Resource is no longer available
+     */
+    gone(c: Context, detail?: string): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 429 Too Many Requests - Rate limit exceeded
+     */
+    rateLimitExceeded(c: Context, retryAfter?: number): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 500 Internal Server Error - Generic server error
+     * SECURITY: Never include error details or stack traces
+     */
+    internalError(c: Context, error?: Error): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    /**
+     * 503 Service Unavailable - Service is temporarily unavailable
+     */
+    serviceUnavailable(c: Context, detail?: string): Response & hono.TypedResponse<{
+        [x: string]: hono_utils_types.JSONValue;
+        type: string;
+        title: string;
+        status: number;
+        detail?: string | undefined;
+        instance?: string | undefined;
+        traceId?: string | undefined;
+        requestId?: string | undefined;
+    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+};
+
+/**
+ * Lightweight structured logger for Cloudflare Workers
+ *
+ * Passes objects directly to console methods for proper field indexing.
+ * Workers Logs automatically extracts and indexes object properties.
+ *
+ * @see https://developers.cloudflare.com/workers/observability/logs/
+ */
+type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+interface LogMetadata {
+    [key: string]: unknown;
+}
+/**
+ * Base logger that outputs structured JSON
+ */
+declare class Logger {
+    private minLevel;
+    private isSilent;
+    constructor(minLevel?: LogLevel);
+    private shouldLog;
+    private log;
+    debug(message: string, meta?: LogMetadata): void;
+    info(message: string, meta?: LogMetadata): void;
+    warn(message: string, meta?: LogMetadata): void;
+    error(message: string, meta?: LogMetadata): void;
+    /**
+     * Set minimum log level
+     */
+    setLevel(level: LogLevel): void;
+    /**
+     * Enable/disable silent mode
+     * Silent mode suppresses all log output (useful for tests)
+     */
+    setSilent(silent: boolean): void;
+}
+declare const logger: Logger;
+/**
+ * Log error with full context
+ * Fields are automatically indexed in Workers Logs
+ */
+declare function logError(error: Error | unknown, context?: LogMetadata): void;
+/**
+ * Log security event
+ */
+declare function logSecurityEvent(event: string, severity: 'low' | 'medium' | 'high' | 'critical', metadata?: LogMetadata): void;
+
+/**
+ * Email service types for Resend email provider integration
+ */
+interface EmailTemplate {
+    to: string;
+    subject: string;
+    html: string;
+    text?: string;
+    tags?: Record<string, string>;
+}
+interface VerificationEmailData {
+    email: string;
+    token: string;
+    verificationUrl: string;
+    firstName?: string;
+}
+interface PasswordResetEmailData {
+    email: string;
+    token: string;
+    resetUrl: string;
+}
+interface EmailChangeConfirmationData {
+    newEmail: string;
+    confirmUrl: string;
+}
+interface EmailChangeNotificationData {
+    oldEmail: string;
+    newEmail: string;
+    cancelUrl: string;
+}
+interface TwoFactorCodeEmailData {
+    email: string;
+    firstName: string | null;
+    code: string;
+}
+interface TwoFactorEnabledEmailData {
+    email: string;
+    firstName: string | null;
+    method: 'totp' | 'email';
+}
+interface TwoFactorDisabledEmailData {
+    email: string;
+    firstName: string | null;
+}
+type EmailType = 'verification' | 'password_reset' | 'email_change_confirmation' | 'email_change_notification' | '2fa_code' | '2fa_enabled' | '2fa_disabled';
+interface SendEmailResult {
+    success: boolean;
+    emailId?: string;
+    error?: string;
+}
+type ResendEventType = 'email.sent' | 'email.delivered' | 'email.delivery_delayed' | 'email.complained' | 'email.bounced' | 'email.opened' | 'email.clicked' | 'email.failed';
+interface ResendWebhookPayload {
+    type: ResendEventType;
+    created_at: string;
+    data: {
+        email_id: string;
+        from: string;
+        to: string[];
+        subject: string;
+        created_at: string;
+        tags?: Record<string, string>;
+        bounce?: {
+            message: string;
+            subType: string;
+            type: 'Permanent' | 'Transient';
+        };
+        failed?: {
+            reason: string;
+        };
+    };
+}
+
+/**
+ * Email adapter interface for provider abstraction
+ * Allows for provider abstraction (currently Resend)
+ */
+interface EmailSendOptions {
+    from: string;
+    to: string;
+    subject: string;
+    html: string;
+    text?: string;
+    tags?: Record<string, string>;
+}
+interface EmailSendResult {
+    success: boolean;
+    emailId?: string;
+    error?: string;
+}
+interface EmailAdapter {
+    /**
+     * Send an email through the provider
+     */
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+    /**
+     * Provider name for logging
+     */
+    readonly providerName: string;
+}
+
+/**
+ * Create the Resend email adapter
+ *
+ * @param env - Environment variables
+ * @returns ResendAdapter instance
+ * @throws Error if RESEND_API_KEY is missing
+ */
+declare function createEmailAdapter(env: Env): EmailAdapter;
+
+/**
+ * Resend email adapter
+ * Wraps the Resend SDK for sending transactional emails
+ */
+declare class ResendAdapter implements EmailAdapter {
+    private client;
+    readonly providerName = "resend";
+    constructor(apiKey: string);
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+}
+
+type UsersTable$1 = PgTableWithColumns<any>;
+declare class EmailService {
+    private adapter;
+    private env;
+    private get fromAddress();
+    constructor(env: Env, adapter?: EmailAdapter);
+    /**
+     * Check if email address has bounced or complained
+     */
+    private shouldBlockEmail;
+    /**
+     * Get recipient email based on environment
+     * - Production & Staging: Use real email (verified domain on Resend)
+     * - Local/Dev/Test: Use Resend test address to avoid sending real emails
+     */
+    getRecipientEmail(userEmail: string, emailType: EmailType): string;
+    /**
+     * Send verification email
+     */
+    sendVerificationEmail(data: VerificationEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    /**
+     * Send password reset email
+     */
+    sendPasswordResetEmail(data: PasswordResetEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    /**
+     * Send email change confirmation email (to new email address)
+     */
+    sendEmailChangeConfirmation(data: EmailChangeConfirmationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    /**
+     * Send email change notification email (to old email address)
+     */
+    sendEmailChangeNotification(data: EmailChangeNotificationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    /**
+     * Send 2FA verification code email
+     */
+    send2faCodeEmail(data: TwoFactorCodeEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    /**
+     * Send 2FA enabled confirmation email
+     */
+    send2faEnabledEmail(data: TwoFactorEnabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    /**
+     * Send 2FA disabled notification email
+     */
+    send2faDisabledEmail(data: TwoFactorDisabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+}
+
+/**
+ * Extract base URL from a full URL (e.g., https://flow.example.com/verify?token=xxx → https://flow.example.com)
+ */
+declare function extractAppUrl(url: string): string;
+/**
+ * Generate email verification email
+ */
+declare function generateVerificationEmail(data: VerificationEmailData, appName?: string, configuredAppUrl?: string): EmailTemplate;
+/**
+ * Generate password reset email
+ */
+declare function generatePasswordResetEmail(data: PasswordResetEmailData, appName?: string, configuredAppUrl?: string): EmailTemplate;
+/**
+ * Generate email change confirmation email (sent to NEW email)
+ */
+declare function generateEmailChangeConfirmation(data: EmailChangeConfirmationData, appName?: string, configuredAppUrl?: string): EmailTemplate;
+/**
+ * Generate email change notification email (sent to OLD email)
+ */
+declare function generateEmailChangeNotification(data: EmailChangeNotificationData, appName?: string, configuredAppUrl?: string): EmailTemplate;
+/**
+ * Generate 2FA verification code email
+ */
+declare function generate2faCodeEmail(data: TwoFactorCodeEmailData, appName?: string, appUrl?: string): EmailTemplate;
+/**
+ * Generate 2FA enabled confirmation email
+ */
+declare function generate2faEnabledEmail(data: TwoFactorEnabledEmailData, appName?: string, appUrl?: string): EmailTemplate;
+/**
+ * Generate 2FA disabled notification email
+ */
+declare function generate2faDisabledEmail(data: TwoFactorDisabledEmailData, appName?: string, appUrl?: string): EmailTemplate;
+
+type EmailEventsTable$1 = PgTableWithColumns<any>;
+type UsersTable = PgTableWithColumns<any>;
+/**
+ * Handle Resend webhook event
+ * Processes email delivery events and updates database accordingly
+ */
+declare function handleWebhookEvent(payload: ResendWebhookPayload, db: PostgresJsDatabase<Record<string, unknown>>, tables: {
+    emailEvents: EmailEventsTable$1;
+    users: UsersTable;
+}): Promise<void>;
+
+/**
+ * Verify Resend webhook signature using svix
+ * Resend uses svix for webhook signing
+ */
+declare function verifyWebhookSignature(payload: string, signature: string, secret: string): boolean;
+
+type EmailEventsTable = PgTableWithColumns<any>;
+/**
+ * Calculate bounce rate for monitoring
+ * Returns percentage of emails that bounced out of total sent
+ */
+declare function calculateBounceRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
+/**
+ * Calculate complaint rate for monitoring
+ * Returns percentage of emails marked as spam out of total sent
+ */
+declare function calculateComplaintRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
+
+export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, type DeviceType, type EmailAdapter, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, auth as authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };