@syncello/auth 3.1.0 → 3.2.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 export { ColumnDefinition, ColumnType, EnumDefinition, EnumName, IndexDefinition, SCHEMA_VERSION, TableDefinition, TableName, enums, tableNames, tables } from './schema/index.cjs';
-import { PgTableWithColumns, PgTable } from 'drizzle-orm/pg-core';
+import { PgTableWithColumns } from 'drizzle-orm/pg-core';
 import * as hono from 'hono';
 import { Context } from 'hono';
 import { InferInsertModel, InferSelectModel } from 'drizzle-orm';
@@ -68,33 +68,8 @@ declare function validatePasswordWithBreachCheck(password: string, checkBreaches
 
 type DrizzleDB$2 = any;
 
-type SessionsTable = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        userId: any;
-        expiresAt: any;
-        createdAt: any;
-        lastActiveAt: any;
-        fingerprint: any;
-        ipAddress: any;
-    };
-    dialect: 'pg';
-}>;
-type UsersTable$4 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        email: any;
-        emailVerified: any;
-        sessionVersion: any;
-        createdAt: any;
-        updatedAt: any;
-    };
-    dialect: 'pg';
-}>;
+type SessionsTable = PgTableWithColumns<any>;
+type UsersTable$4 = PgTableWithColumns<any>;
 interface SessionTables {
     sessions: SessionsTable;
     users: UsersTable$4;
@@ -194,9 +169,15 @@ declare const AUTH_DEFAULTS: {
 };
 
 /**
- * Base type for auth tables - any Postgres table
+ * Base type for auth tables.
+ *
+ * The library is schema-agnostic: consumers inject their own Drizzle tables,
+ * so the concrete column types are not known at compile time within the
+ * library. `PgTableWithColumns<any>` keeps column access available (e.g.
+ * `schema.users.email`) and stays assignable to the column-specific table
+ * types declared by the core modules.
  */
-type AuthTable = PgTable;
+type AuthTable = PgTableWithColumns<any>;
 /**
  * Schema interface that consumers must provide.
  * Each property must be a Drizzle PgTable with the expected columns.
@@ -234,14 +215,19 @@ type InferSession<TSchema extends AuthSchema> = InferSelectModel<TSchema['sessio
 type InferNewSession<TSchema extends AuthSchema> = InferInsertModel<TSchema['sessions']>;
 /**
  * Database interface - accepts any Drizzle Postgres database.
+ *
  * Uses duck typing for flexibility across different Drizzle configurations.
+ * Because the consumer's concrete schema is injected at runtime, the query
+ * builder chains cannot be statically typed against specific tables here; the
+ * methods are intentionally permissive and rely on the consumer's real Drizzle
+ * instance for correctness.
  */
 interface AuthDatabase {
-    select: <T extends PgTable>(from?: T) => unknown;
-    insert: <T extends PgTable>(into: T) => unknown;
-    update: <T extends PgTable>(table: T) => unknown;
-    delete: <T extends PgTable>(from: T) => unknown;
-    query: Record<string, unknown>;
+    select: (...args: any[]) => any;
+    insert: (...args: any[]) => any;
+    update: (...args: any[]) => any;
+    delete: (...args: any[]) => any;
+    query: Record<string, any>;
 }
 /**
  * Configuration for createAuth
@@ -335,6 +321,51 @@ declare function createAuthMiddleware<TEnv = Record<string, unknown>>(auth: Auth
  */
 declare function getAuthContext<TEnv = Record<string, unknown>>(c: Context): AuthContext<TEnv>;
 
+/**
+ * Email adapter interface for provider abstraction
+ * Allows for provider abstraction (currently Resend)
+ */
+interface EmailSendOptions {
+    from: string;
+    to: string;
+    subject: string;
+    html: string;
+    text?: string;
+    tags?: Record<string, string>;
+}
+interface EmailSendResult {
+    success: boolean;
+    emailId?: string;
+    error?: string;
+}
+interface EmailAdapter {
+    /**
+     * Send an email through the provider
+     */
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+    /**
+     * Provider name for logging
+     */
+    readonly providerName: string;
+}
+/**
+ * Structural type for the Cloudflare Email Service `send_email` Workers binding.
+ * Defined locally so consumers do not need a specific @cloudflare/workers-types
+ * version that includes Email Service (beta) types.
+ */
+interface SendEmailBinding {
+    send(message: {
+        to: string;
+        from: string;
+        subject: string;
+        html?: string;
+        text?: string;
+        headers?: Record<string, string>;
+    }): Promise<{
+        messageId: string;
+    }>;
+}
+
 /**
  * Environment variables available in Cloudflare Workers
  */
@@ -344,8 +375,11 @@ type Env = {
     SESSION_SECRET: string;
     PASSWORD_PEPPER_V1: string;
     PASSWORD_PEPPER_V2?: string;
+    EMAIL_PROVIDER?: 'resend' | 'cloudflare';
+    EMAIL_FROM?: string;
     RESEND_API_KEY?: string;
     RESEND_WEBHOOK_SECRET?: string;
+    EMAIL?: SendEmailBinding;
     DB: {
         connectionString: string;
     };
@@ -427,16 +461,7 @@ declare function generateFingerprint(request: Request): Promise<string>;
 declare function getClientIp(request: Request): string;
 
 type DrizzleDB$1 = any;
-type UsersTable$3 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        lockedUntil: any;
-        failedLoginCount: any;
-    };
-    dialect: 'pg';
-}>;
+type UsersTable$3 = PgTableWithColumns<any>;
 interface AccountLockoutTables {
     users: UsersTable$3;
 }
@@ -486,31 +511,8 @@ declare function getMinutesUntilUnlock(unlockAt: number): number;
 declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, environment?: 'development' | 'staging' | 'production'): Promise<boolean>;
 
 type DrizzleDB = any;
-type UsersTable$2 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        email: any;
-        hashedPassword: any;
-        updatedAt: any;
-    };
-    dialect: 'pg';
-}>;
-type EmailChangeTokensTable = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        userId: any;
-        newEmail: any;
-        tokenHash: any;
-        cancelTokenHash: any;
-        expiresAt: any;
-        createdAt: any;
-    };
-    dialect: 'pg';
-}>;
+type UsersTable$2 = PgTableWithColumns<any>;
+type EmailChangeTokensTable = PgTableWithColumns<any>;
 interface EmailChangeTables {
     users: UsersTable$2;
     emailChangeTokens: EmailChangeTokensTable;
@@ -2526,39 +2528,15 @@ interface ResendWebhookPayload {
 }
 
 /**
- * Email adapter interface for provider abstraction
- * Allows for provider abstraction (currently Resend)
- */
-interface EmailSendOptions {
-    from: string;
-    to: string;
-    subject: string;
-    html: string;
-    text?: string;
-    tags?: Record<string, string>;
-}
-interface EmailSendResult {
-    success: boolean;
-    emailId?: string;
-    error?: string;
-}
-interface EmailAdapter {
-    /**
-     * Send an email through the provider
-     */
-    send(options: EmailSendOptions): Promise<EmailSendResult>;
-    /**
-     * Provider name for logging
-     */
-    readonly providerName: string;
-}
-
-/**
- * Create the Resend email adapter
+ * Create the configured email adapter.
  *
- * @param env - Environment variables
- * @returns ResendAdapter instance
- * @throws Error if RESEND_API_KEY is missing
+ * Provider is selected by EMAIL_PROVIDER (defaults to 'resend' for backward
+ * compatibility):
+ * - 'resend': requires RESEND_API_KEY
+ * - 'cloudflare': requires the EMAIL send_email Workers binding; dry-runs
+ *   (logs instead of sending) outside production/staging
+ *
+ * @throws Error if the selected provider's configuration is missing
  */
 declare function createEmailAdapter(env: Env): EmailAdapter;
 
@@ -2573,6 +2551,26 @@ declare class ResendAdapter implements EmailAdapter {
     send(options: EmailSendOptions): Promise<EmailSendResult>;
 }
 
+/**
+ * Cloudflare Email Service adapter
+ * Sends through the Workers `send_email` binding. Cloudflare manages bounce and
+ * complaint suppression at the account level; a send to a suppressed address is
+ * rejected with error code E_RECIPIENT_SUPPRESSED.
+ *
+ * In dry-run mode (any environment other than production/staging) it logs the
+ * email and reports success without sending: Cloudflare has no test inbox and
+ * real bounces damage sender reputation.
+ */
+declare class CloudflareEmailAdapter implements EmailAdapter {
+    private readonly binding;
+    private readonly options;
+    readonly providerName = "cloudflare";
+    constructor(binding: SendEmailBinding, options: {
+        dryRun: boolean;
+    });
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+}
+
 type UsersTable$1 = PgTableWithColumns<any>;
 declare class EmailService {
     private adapter;
@@ -2592,31 +2590,31 @@ declare class EmailService {
     /**
      * Send verification email
      */
-    sendVerificationEmail(data: VerificationEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendVerificationEmail(data: VerificationEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send password reset email
      */
-    sendPasswordResetEmail(data: PasswordResetEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendPasswordResetEmail(data: PasswordResetEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send email change confirmation email (to new email address)
      */
-    sendEmailChangeConfirmation(data: EmailChangeConfirmationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendEmailChangeConfirmation(data: EmailChangeConfirmationData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send email change notification email (to old email address)
      */
-    sendEmailChangeNotification(data: EmailChangeNotificationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendEmailChangeNotification(data: EmailChangeNotificationData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA verification code email
      */
-    send2faCodeEmail(data: TwoFactorCodeEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faCodeEmail(data: TwoFactorCodeEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA enabled confirmation email
      */
-    send2faEnabledEmail(data: TwoFactorEnabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faEnabledEmail(data: TwoFactorEnabledEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA disabled notification email
      */
-    send2faDisabledEmail(data: TwoFactorDisabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faDisabledEmail(data: TwoFactorDisabledEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
 }
 
 /**
@@ -2681,4 +2679,4 @@ declare function calculateBounceRate(db: PostgresJsDatabase<Record<string, unkno
  */
 declare function calculateComplaintRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
 
-export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, type DeviceType, type EmailAdapter, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };
+export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { ColumnDefinition, ColumnType, EnumDefinition, EnumName, IndexDefinition, SCHEMA_VERSION, TableDefinition, TableName, enums, tableNames, tables } from './schema/index.js';
-import { PgTableWithColumns, PgTable } from 'drizzle-orm/pg-core';
+import { PgTableWithColumns } from 'drizzle-orm/pg-core';
 import * as hono from 'hono';
 import { Context } from 'hono';
 import { InferInsertModel, InferSelectModel } from 'drizzle-orm';
@@ -68,33 +68,8 @@ declare function validatePasswordWithBreachCheck(password: string, checkBreaches
 
 type DrizzleDB$2 = any;
 
-type SessionsTable = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        userId: any;
-        expiresAt: any;
-        createdAt: any;
-        lastActiveAt: any;
-        fingerprint: any;
-        ipAddress: any;
-    };
-    dialect: 'pg';
-}>;
-type UsersTable$4 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        email: any;
-        emailVerified: any;
-        sessionVersion: any;
-        createdAt: any;
-        updatedAt: any;
-    };
-    dialect: 'pg';
-}>;
+type SessionsTable = PgTableWithColumns<any>;
+type UsersTable$4 = PgTableWithColumns<any>;
 interface SessionTables {
     sessions: SessionsTable;
     users: UsersTable$4;
@@ -194,9 +169,15 @@ declare const AUTH_DEFAULTS: {
 };
 
 /**
- * Base type for auth tables - any Postgres table
+ * Base type for auth tables.
+ *
+ * The library is schema-agnostic: consumers inject their own Drizzle tables,
+ * so the concrete column types are not known at compile time within the
+ * library. `PgTableWithColumns<any>` keeps column access available (e.g.
+ * `schema.users.email`) and stays assignable to the column-specific table
+ * types declared by the core modules.
  */
-type AuthTable = PgTable;
+type AuthTable = PgTableWithColumns<any>;
 /**
  * Schema interface that consumers must provide.
  * Each property must be a Drizzle PgTable with the expected columns.
@@ -234,14 +215,19 @@ type InferSession<TSchema extends AuthSchema> = InferSelectModel<TSchema['sessio
 type InferNewSession<TSchema extends AuthSchema> = InferInsertModel<TSchema['sessions']>;
 /**
  * Database interface - accepts any Drizzle Postgres database.
+ *
  * Uses duck typing for flexibility across different Drizzle configurations.
+ * Because the consumer's concrete schema is injected at runtime, the query
+ * builder chains cannot be statically typed against specific tables here; the
+ * methods are intentionally permissive and rely on the consumer's real Drizzle
+ * instance for correctness.
  */
 interface AuthDatabase {
-    select: <T extends PgTable>(from?: T) => unknown;
-    insert: <T extends PgTable>(into: T) => unknown;
-    update: <T extends PgTable>(table: T) => unknown;
-    delete: <T extends PgTable>(from: T) => unknown;
-    query: Record<string, unknown>;
+    select: (...args: any[]) => any;
+    insert: (...args: any[]) => any;
+    update: (...args: any[]) => any;
+    delete: (...args: any[]) => any;
+    query: Record<string, any>;
 }
 /**
  * Configuration for createAuth
@@ -335,6 +321,51 @@ declare function createAuthMiddleware<TEnv = Record<string, unknown>>(auth: Auth
  */
 declare function getAuthContext<TEnv = Record<string, unknown>>(c: Context): AuthContext<TEnv>;
 
+/**
+ * Email adapter interface for provider abstraction
+ * Allows for provider abstraction (currently Resend)
+ */
+interface EmailSendOptions {
+    from: string;
+    to: string;
+    subject: string;
+    html: string;
+    text?: string;
+    tags?: Record<string, string>;
+}
+interface EmailSendResult {
+    success: boolean;
+    emailId?: string;
+    error?: string;
+}
+interface EmailAdapter {
+    /**
+     * Send an email through the provider
+     */
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+    /**
+     * Provider name for logging
+     */
+    readonly providerName: string;
+}
+/**
+ * Structural type for the Cloudflare Email Service `send_email` Workers binding.
+ * Defined locally so consumers do not need a specific @cloudflare/workers-types
+ * version that includes Email Service (beta) types.
+ */
+interface SendEmailBinding {
+    send(message: {
+        to: string;
+        from: string;
+        subject: string;
+        html?: string;
+        text?: string;
+        headers?: Record<string, string>;
+    }): Promise<{
+        messageId: string;
+    }>;
+}
+
 /**
  * Environment variables available in Cloudflare Workers
  */
@@ -344,8 +375,11 @@ type Env = {
     SESSION_SECRET: string;
     PASSWORD_PEPPER_V1: string;
     PASSWORD_PEPPER_V2?: string;
+    EMAIL_PROVIDER?: 'resend' | 'cloudflare';
+    EMAIL_FROM?: string;
     RESEND_API_KEY?: string;
     RESEND_WEBHOOK_SECRET?: string;
+    EMAIL?: SendEmailBinding;
     DB: {
         connectionString: string;
     };
@@ -427,16 +461,7 @@ declare function generateFingerprint(request: Request): Promise<string>;
 declare function getClientIp(request: Request): string;
 
 type DrizzleDB$1 = any;
-type UsersTable$3 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        lockedUntil: any;
-        failedLoginCount: any;
-    };
-    dialect: 'pg';
-}>;
+type UsersTable$3 = PgTableWithColumns<any>;
 interface AccountLockoutTables {
     users: UsersTable$3;
 }
@@ -486,31 +511,8 @@ declare function getMinutesUntilUnlock(unlockAt: number): number;
 declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, environment?: 'development' | 'staging' | 'production'): Promise<boolean>;
 
 type DrizzleDB = any;
-type UsersTable$2 = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        email: any;
-        hashedPassword: any;
-        updatedAt: any;
-    };
-    dialect: 'pg';
-}>;
-type EmailChangeTokensTable = PgTableWithColumns<{
-    name: string;
-    schema: undefined;
-    columns: {
-        id: any;
-        userId: any;
-        newEmail: any;
-        tokenHash: any;
-        cancelTokenHash: any;
-        expiresAt: any;
-        createdAt: any;
-    };
-    dialect: 'pg';
-}>;
+type UsersTable$2 = PgTableWithColumns<any>;
+type EmailChangeTokensTable = PgTableWithColumns<any>;
 interface EmailChangeTables {
     users: UsersTable$2;
     emailChangeTokens: EmailChangeTokensTable;
@@ -2526,39 +2528,15 @@ interface ResendWebhookPayload {
 }
 
 /**
- * Email adapter interface for provider abstraction
- * Allows for provider abstraction (currently Resend)
- */
-interface EmailSendOptions {
-    from: string;
-    to: string;
-    subject: string;
-    html: string;
-    text?: string;
-    tags?: Record<string, string>;
-}
-interface EmailSendResult {
-    success: boolean;
-    emailId?: string;
-    error?: string;
-}
-interface EmailAdapter {
-    /**
-     * Send an email through the provider
-     */
-    send(options: EmailSendOptions): Promise<EmailSendResult>;
-    /**
-     * Provider name for logging
-     */
-    readonly providerName: string;
-}
-
-/**
- * Create the Resend email adapter
+ * Create the configured email adapter.
  *
- * @param env - Environment variables
- * @returns ResendAdapter instance
- * @throws Error if RESEND_API_KEY is missing
+ * Provider is selected by EMAIL_PROVIDER (defaults to 'resend' for backward
+ * compatibility):
+ * - 'resend': requires RESEND_API_KEY
+ * - 'cloudflare': requires the EMAIL send_email Workers binding; dry-runs
+ *   (logs instead of sending) outside production/staging
+ *
+ * @throws Error if the selected provider's configuration is missing
  */
 declare function createEmailAdapter(env: Env): EmailAdapter;
 
@@ -2573,6 +2551,26 @@ declare class ResendAdapter implements EmailAdapter {
     send(options: EmailSendOptions): Promise<EmailSendResult>;
 }
 
+/**
+ * Cloudflare Email Service adapter
+ * Sends through the Workers `send_email` binding. Cloudflare manages bounce and
+ * complaint suppression at the account level; a send to a suppressed address is
+ * rejected with error code E_RECIPIENT_SUPPRESSED.
+ *
+ * In dry-run mode (any environment other than production/staging) it logs the
+ * email and reports success without sending: Cloudflare has no test inbox and
+ * real bounces damage sender reputation.
+ */
+declare class CloudflareEmailAdapter implements EmailAdapter {
+    private readonly binding;
+    private readonly options;
+    readonly providerName = "cloudflare";
+    constructor(binding: SendEmailBinding, options: {
+        dryRun: boolean;
+    });
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
+}
+
 type UsersTable$1 = PgTableWithColumns<any>;
 declare class EmailService {
     private adapter;
@@ -2592,31 +2590,31 @@ declare class EmailService {
     /**
      * Send verification email
      */
-    sendVerificationEmail(data: VerificationEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendVerificationEmail(data: VerificationEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send password reset email
      */
-    sendPasswordResetEmail(data: PasswordResetEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendPasswordResetEmail(data: PasswordResetEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send email change confirmation email (to new email address)
      */
-    sendEmailChangeConfirmation(data: EmailChangeConfirmationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendEmailChangeConfirmation(data: EmailChangeConfirmationData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send email change notification email (to old email address)
      */
-    sendEmailChangeNotification(data: EmailChangeNotificationData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    sendEmailChangeNotification(data: EmailChangeNotificationData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA verification code email
      */
-    send2faCodeEmail(data: TwoFactorCodeEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faCodeEmail(data: TwoFactorCodeEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA enabled confirmation email
      */
-    send2faEnabledEmail(data: TwoFactorEnabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faEnabledEmail(data: TwoFactorEnabledEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
     /**
      * Send 2FA disabled notification email
      */
-    send2faDisabledEmail(data: TwoFactorDisabledEmailData, db: PostgresJsDatabase<Record<string, unknown>>, usersTable: UsersTable$1): Promise<SendEmailResult>;
+    send2faDisabledEmail(data: TwoFactorDisabledEmailData, db: AuthDatabase, usersTable: UsersTable$1): Promise<SendEmailResult>;
 }
 
 /**
@@ -2681,4 +2679,4 @@ declare function calculateBounceRate(db: PostgresJsDatabase<Record<string, unkno
  */
 declare function calculateComplaintRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
 
-export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, type DeviceType, type EmailAdapter, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };
+export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };