@syncello/auth 3.6.1 → 4.1.0

package/dist/index.d.ts

@@ -66,7 +66,7 @@ declare function validatePasswordWithBreachCheck(password: string, checkBreaches
     warning?: string;
 }>;
 
-type DrizzleDB$2 = any;
+type DrizzleDB$3 = any;
 
 type SessionsTable = PgTableWithColumns<any>;
 type UsersTable$4 = PgTableWithColumns<any>;
@@ -101,7 +101,7 @@ interface SessionData {
  * @param sessionTtlMs - Session TTL in milliseconds (optional)
  * @returns Session ID
  */
-declare function createSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, userId: string, fingerprint?: string, ipAddress?: string, sessionTtlMs?: number): Promise<string>;
+declare function createSession(db: DrizzleDB$3, tables: Pick<SessionTables, 'sessions'>, userId: string, fingerprint?: string, ipAddress?: string, sessionTtlMs?: number): Promise<string>;
 /**
  * Validate a session and return user data
  * @param db - Drizzle database instance
@@ -111,7 +111,9 @@ declare function createSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'ses
  * @param sessionMaxLifetimeMs - Absolute session lifetime cap in milliseconds (optional)
  * @returns Session data or null if invalid
  */
-declare function validateSession(db: DrizzleDB$2, tables: SessionTables, sessionId: string, currentFingerprint?: string, sessionMaxLifetimeMs?: number): Promise<SessionData | null>;
+declare function validateSession(db: DrizzleDB$3, tables: SessionTables, sessionId: string, currentFingerprint?: string, sessionMaxLifetimeMs?: number): Promise<SessionData | null>;
+/** Whether the sliding window should move: never yet, or not in the last refresh interval. */
+declare function sessionRefreshDue(lastActiveAt: number | null, now?: number): boolean;
 /**
  * Refresh session expiration (sliding window)
  * @param db - Drizzle database instance
@@ -119,28 +121,28 @@ declare function validateSession(db: DrizzleDB$2, tables: SessionTables, session
  * @param sessionId - Session ID
  * @param sessionTtlMs - Session TTL in milliseconds (optional)
  */
-declare function refreshSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, sessionId: string, sessionTtlMs?: number): Promise<void>;
+declare function refreshSession(db: DrizzleDB$3, tables: Pick<SessionTables, 'sessions'>, sessionId: string, sessionTtlMs?: number): Promise<void>;
 /**
  * Delete a session (logout)
  * @param db - Drizzle database instance
  * @param tables - Session tables (sessions)
  * @param sessionId - Session ID
  */
-declare function deleteSession(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, sessionId: string): Promise<void>;
+declare function deleteSession(db: DrizzleDB$3, tables: Pick<SessionTables, 'sessions'>, sessionId: string): Promise<void>;
 /**
  * Delete all sessions for a user (logout all devices)
  * @param db - Drizzle database instance
  * @param tables - Session tables (sessions)
  * @param userId - User ID
  */
-declare function deleteAllUserSessions(db: DrizzleDB$2, tables: Pick<SessionTables, 'sessions'>, userId: string): Promise<void>;
+declare function deleteAllUserSessions(db: DrizzleDB$3, tables: Pick<SessionTables, 'sessions'>, userId: string): Promise<void>;
 /**
  * Invalidate all sessions after password change
  * @param db - Drizzle database instance
  * @param tables - Session tables (sessions, users)
  * @param userId - User ID
  */
-declare function invalidateAllUserSessions(db: DrizzleDB$2, tables: SessionTables, userId: string): Promise<void>;
+declare function invalidateAllUserSessions(db: DrizzleDB$3, tables: SessionTables, userId: string): Promise<void>;
 
 /**
  * Generate a cryptographically secure random token
@@ -163,9 +165,13 @@ declare function hashToken(token: string): Promise<string>;
 declare const AUTH_DEFAULTS: {
     readonly SESSION_TTL_DAYS: 7;
     readonly SESSION_MAX_LIFETIME_DAYS: 30;
+    readonly SESSION_REFRESH_INTERVAL_MINUTES: 15;
     readonly LOCKOUT_DURATION_MINUTES: 30;
     readonly LOCKOUT_MAX_ATTEMPTS: 5;
     readonly PASSWORD_RESET_TTL_MINUTES: 15;
+    readonly EMAIL_VERIFICATION_TTL_HOURS: 24;
+    readonly EMAIL_CHANGE_TTL_HOURS: 24;
+    readonly TWO_FACTOR_EMAIL_CODE_TTL_MINUTES: 5;
     readonly TWO_FACTOR_CHALLENGE_TTL_SECONDS: 300;
     readonly APP_NAME: "App";
 };
@@ -255,6 +261,13 @@ interface EmailBranding {
     buttonRadius?: string;
     /** Footer band background color. Default: '#1e1b4b' */
     footerColor?: string;
+    /** Heading and welcome-line color. Default: '#1e1b4b' */
+    headingColor?: string;
+    /**
+     * Marketing site the footer's Privacy Policy (`/privacy`) and Get in Touch (`/contact`)
+     * links point at. Default: unset, and the footer has no links.
+     */
+    marketingUrl?: string;
 }
 
 /**
@@ -332,8 +345,14 @@ interface InvitationHookUser {
  * library calls `verify`. If it returns a matching email, the account is created
  * with `emailVerified: true` and NO verification email is sent — the token, which
  * was delivered to that address, is itself the proof of ownership (the same trust
- * model as OAuth-provider signup). `onAccepted` then runs so the app can link the
- * user (e.g. create a team membership) atomically with signup.
+ * model as OAuth-provider signup). `onAccepted` then runs right after the user is
+ * created so the app can link them (e.g. create a team membership); a failure is
+ * logged, not raised, since the account already exists. A user the OAuth callback
+ * creates from a verified invitation gets `onAccepted` too. A `verify` that
+ * throws is logged and treated as "not invited".
+ *
+ * With `signup: 'invitation'`, a verified invitation is the only way to create
+ * an account.
  */
 interface InvitationHooks<TEnv = Record<string, unknown>> {
     /**
@@ -358,6 +377,16 @@ interface InvitationHooks<TEnv = Record<string, unknown>> {
         env: TEnv;
     }): Promise<void>;
 }
+/**
+ * Who may create an account.
+ *
+ * - `'open'`: anyone can sign up. An `invitationToken`, when given and verified,
+ *   only skips email verification and links the user.
+ * - `'invitation'`: every new account needs an invitation that `invitations.verify`
+ *   accepts for its email, on password signup, OAuth signup and the OAuth callback
+ *   alike. Existing users sign in as usual. Requires `invitations`.
+ */
+type SignupMode = 'open' | 'invitation';
 /**
  * Configuration for createAuth
  */
@@ -372,6 +401,8 @@ interface AuthConfig<TEnv = Record<string, unknown>> {
     emailBranding?: EmailBranding;
     /** Optional app-owned invitation hooks for token-verified signup. */
     invitations?: InvitationHooks<TEnv>;
+    /** Who may create an account; defaults to `'open'`. See {@link SignupMode}. */
+    signup?: SignupMode;
 }
 /**
  * Auth context available in all auth operations.
@@ -383,6 +414,8 @@ interface AuthContext<TEnv = Record<string, unknown>> {
     env: TEnv;
     emailBranding?: EmailBranding;
     invitations?: InvitationHooks<TEnv>;
+    /** Absent means `'open'`. */
+    signup?: SignupMode;
 }
 /**
  * Creates an auth instance with injected database and schema.
@@ -595,7 +628,7 @@ declare function generateFingerprint(request: Request): Promise<string>;
  */
 declare function getClientIp(request: Request): string;
 
-type DrizzleDB$1 = any;
+type DrizzleDB$2 = any;
 type UsersTable$3 = PgTableWithColumns<any>;
 interface AccountLockoutTables {
     users: UsersTable$3;
@@ -607,7 +640,7 @@ interface AccountLockoutTables {
  * @param userId - User ID to check
  * @returns Lock status and unlock time if locked
  */
-declare function checkAccountLocked(db: DrizzleDB$1, tables: AccountLockoutTables, userId: string): Promise<{
+declare function checkAccountLocked(db: DrizzleDB$2, tables: AccountLockoutTables, userId: string): Promise<{
     isLocked: boolean;
     unlockAt?: number;
 }>;
@@ -620,7 +653,7 @@ declare function checkAccountLocked(db: DrizzleDB$1, tables: AccountLockoutTable
  * @param maxAttempts - Maximum failed attempts before lockout
  * @param lockoutDurationMs - Duration of lockout in milliseconds
  */
-declare function incrementFailedAttempts(db: DrizzleDB$1, tables: AccountLockoutTables, userId: string, maxAttempts?: number, lockoutDurationMs?: number): Promise<void>;
+declare function incrementFailedAttempts(db: DrizzleDB$2, tables: AccountLockoutTables, userId: string, maxAttempts?: number, lockoutDurationMs?: number): Promise<void>;
 /**
  * Clear account lockout and failed attempt counter
  * Called after successful login
@@ -628,7 +661,7 @@ declare function incrementFailedAttempts(db: DrizzleDB$1, tables: AccountLockout
  * @param tables - Account lockout tables (users)
  * @param userId - User ID
  */
-declare function clearAccountLockout(db: DrizzleDB$1, tables: AccountLockoutTables, userId: string): Promise<void>;
+declare function clearAccountLockout(db: DrizzleDB$2, tables: AccountLockoutTables, userId: string): Promise<void>;
 /**
  * Get minutes remaining until account unlock
  * @param unlockAt - Unlock timestamp
@@ -645,7 +678,7 @@ declare function getMinutesUntilUnlock(unlockAt: number): number;
  */
 declare function verifyTurnstileToken(token: string, secretKey: string, remoteIp?: string, environment?: 'development' | 'staging' | 'production'): Promise<boolean>;
 
-type DrizzleDB = any;
+type DrizzleDB$1 = any;
 type UsersTable$2 = PgTableWithColumns<any>;
 type EmailChangeTokensTable = PgTableWithColumns<any>;
 interface EmailChangeTables {
@@ -657,7 +690,7 @@ interface RequestEmailChangeParams {
     password: string;
     newEmail: string;
     pepper: string;
-    db: DrizzleDB;
+    db: DrizzleDB$1;
     tables: EmailChangeTables;
 }
 interface RequestEmailChangeResult {
@@ -673,7 +706,7 @@ interface RequestEmailChangeResult {
 declare function requestEmailChange(params: RequestEmailChangeParams): Promise<RequestEmailChangeResult>;
 interface ConfirmEmailChangeParams {
     token: string;
-    db: DrizzleDB;
+    db: DrizzleDB$1;
     tables: EmailChangeTables;
 }
 interface ConfirmEmailChangeResult {
@@ -686,7 +719,7 @@ interface ConfirmEmailChangeResult {
 declare function confirmEmailChange(params: ConfirmEmailChangeParams): Promise<ConfirmEmailChangeResult>;
 interface CancelEmailChangeParams {
     token: string;
-    db: DrizzleDB;
+    db: DrizzleDB$1;
     tables: Pick<EmailChangeTables, 'emailChangeTokens'>;
 }
 interface CancelEmailChangeResult {
@@ -776,6 +809,93 @@ declare function verifyCodeChallenge(verifier: string, challenge: string): Promi
  */
 declare function isDeepLinkUri(uri: string): boolean;
 
+type DrizzleDB = any;
+
+type ChallengesTable = PgTableWithColumns<any>;
+interface PasswordlessTables {
+    passwordlessChallenges: ChallengesTable;
+}
+declare const PASSWORDLESS_TTL_MS: number;
+declare const PASSWORDLESS_MAX_ATTEMPTS = 5;
+type PasswordlessSuccess = {
+    ok: true;
+    email: string;
+    subjectId: string | null;
+    payload: unknown;
+};
+type PasswordlessLinkResult = PasswordlessSuccess | {
+    ok: false;
+    reason: 'invalid' | 'expired';
+};
+type PasswordlessCodeResult = PasswordlessSuccess | {
+    ok: false;
+    reason: 'invalid' | 'expired' | 'locked';
+};
+/** A uniformly distributed 6-digit code. */
+declare function generateCode(): string;
+/**
+ * Start a sign-in for an email, replacing any open one. Email the link token and code; keep the
+ * browser secret in an HttpOnly cookie, since the code only works alongside it.
+ * @param input.subjectId - The account signing in, or null for a sign-up
+ * @param input.payload - JSON handed back on success (e.g. sign-up details such as a name)
+ */
+declare function createPasswordlessChallenge(db: DrizzleDB, tables: PasswordlessTables, input: {
+    email: string;
+    subjectId?: string | null;
+    payload?: unknown;
+    ttlMs?: number;
+}): Promise<{
+    challengeId: string;
+    linkToken: string;
+    code: string;
+    browserSecret: string;
+}>;
+/** Redeem an emailed link, from any browser. Success consumes every open challenge for the email. */
+declare function verifyPasswordlessLink(db: DrizzleDB, tables: PasswordlessTables, input: {
+    linkToken: string;
+}): Promise<PasswordlessLinkResult>;
+/**
+ * Redeem a code against the email's newest open challenge, in the browser that started it. Any
+ * other browser is answered `invalid`, uncounted, so a stranger who knows the email can neither
+ * lock the challenge nor learn its state. A wrong code counts an attempt; at `maxAttempts` the
+ * challenge is locked. Success consumes every open challenge for the email.
+ */
+declare function verifyPasswordlessCode(db: DrizzleDB, tables: PasswordlessTables, input: {
+    email: string;
+    code: string;
+    browserSecret: string;
+    maxAttempts?: number;
+}): Promise<PasswordlessCodeResult>;
+/**
+ * Failed code attempts for an email across every challenge created within the window, consumed
+ * ones included, so asking for a new code never resets the count. Failures are dated by their
+ * challenge's creation, so one can leave the window up to a TTL early. Anyone can fail codes for
+ * an email they know only from their own browser, so pair this with a per-browser or per-IP limit.
+ */
+declare function recentPasswordlessFailures(db: DrizzleDB, tables: PasswordlessTables, input: {
+    email: string;
+    windowMs: number;
+}): Promise<number>;
+/** Delete challenges that expired more than a day ago. Run from a scheduled job. */
+declare function cleanupExpiredPasswordlessChallenges(db: DrizzleDB, tables: PasswordlessTables): Promise<void>;
+/**
+ * The sign-in email: the code in the subject and body, and the link as a button.
+ * @param input.appUrl - Base for the logo and footer links; the link must be on its host or a subdomain
+ * @param input.ttlMs - The challenge's lifetime, for the stated expiry (default PASSWORDLESS_TTL_MS)
+ * @throws If `linkUrl` is not http(s) on `appUrl`'s host
+ */
+declare function passwordlessEmail(input: {
+    appName: string;
+    appUrl: string;
+    linkUrl: string;
+    code: string;
+    ttlMs?: number;
+}): {
+    subject: string;
+    html: string;
+    text: string;
+};
+
 /**
  * TOTP (Time-based One-Time Password) utilities
  * RFC 6238 compliant with replay prevention
@@ -1701,10 +1821,9 @@ declare const authRoutes: OpenAPIHono<{
             input: {
                 json: {
                     email: string;
-                    password?: string | undefined;
+                    password: string;
+                    turnstileToken: string;
                     name?: string | undefined;
-                    turnstileToken?: string | undefined;
-                    oauthToken?: string | undefined;
                     invitationToken?: string | undefined;
                 };
             };
@@ -1723,10 +1842,30 @@ declare const authRoutes: OpenAPIHono<{
             input: {
                 json: {
                     email: string;
-                    password?: string | undefined;
+                    password: string;
+                    turnstileToken: string;
+                    name?: string | undefined;
+                    invitationToken?: string | undefined;
+                };
+            };
+            output: {
+                type: string;
+                title: string;
+                status: number;
+                detail?: string | undefined;
+                instance?: string | undefined;
+                traceId?: string | undefined;
+                requestId?: string | undefined;
+            };
+            outputFormat: "json";
+            status: 403;
+        } | {
+            input: {
+                json: {
+                    email: string;
+                    password: string;
+                    turnstileToken: string;
                     name?: string | undefined;
-                    turnstileToken?: string | undefined;
-                    oauthToken?: string | undefined;
                     invitationToken?: string | undefined;
                 };
             };
@@ -1745,10 +1884,9 @@ declare const authRoutes: OpenAPIHono<{
             input: {
                 json: {
                     email: string;
-                    password?: string | undefined;
+                    password: string;
+                    turnstileToken: string;
                     name?: string | undefined;
-                    turnstileToken?: string | undefined;
-                    oauthToken?: string | undefined;
                     invitationToken?: string | undefined;
                 };
             };
@@ -2406,7 +2544,7 @@ declare function problemJson(c: Context, problem: ProblemDetails): Response & ho
     instance?: string | undefined;
     traceId?: string | undefined;
     requestId?: string | undefined;
-}, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+}, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
 /**
  * Helper function to return common problem types
  */
@@ -2423,7 +2561,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 400 Bad Request - Validation errors with field-specific details
      */
@@ -2439,7 +2577,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 401 Unauthorized - Authentication required
      */
@@ -2452,7 +2590,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 403 Forbidden - Insufficient permissions
      */
@@ -2465,7 +2603,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 404 Not Found
      */
@@ -2478,7 +2616,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 409 Conflict - Resource conflict (e.g., duplicate email)
      */
@@ -2491,7 +2629,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 410 Gone - Resource is no longer available
      */
@@ -2504,7 +2642,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 429 Too Many Requests - Rate limit exceeded
      */
@@ -2517,7 +2655,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 500 Internal Server Error - Generic server error
      * SECURITY: Never include error details or stack traces
@@ -2531,7 +2669,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
     /**
      * 503 Service Unavailable - Service is temporarily unavailable
      */
@@ -2544,7 +2682,7 @@ declare const problems: {
         instance?: string | undefined;
         traceId?: string | undefined;
         requestId?: string | undefined;
-    }, 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503, "json">;
+    }, 500 | 400 | 401 | 403 | 404 | 409 | 410 | 429 | 503, "json">;
 };
 
 /**
@@ -2728,11 +2866,17 @@ declare function handleWebhookEvent(payload: ResendWebhookPayload, db: PostgresJ
     users: UsersTable;
 }): Promise<void>;
 
+/** The svix headers Resend sends with every webhook delivery. */
+interface SvixHeaders {
+    'svix-id': string;
+    'svix-timestamp': string;
+    'svix-signature': string;
+}
 /**
- * Verify Resend webhook signature using svix
- * Resend uses svix for webhook signing
+ * Whether a Resend webhook is genuine. Svix signs `<id>.<timestamp>.<body>` and refuses a
+ * timestamp more than five minutes off, so all three headers are needed.
  */
-declare function verifyWebhookSignature(payload: string, signature: string, secret: string): boolean;
+declare function verifyWebhookSignature(payload: string, headers: SvixHeaders, secret: string): boolean;
 
 type EmailEventsTable = PgTableWithColumns<any>;
 /**
@@ -2746,4 +2890,4 @@ declare function calculateBounceRate(db: PostgresJsDatabase<Record<string, unkno
  */
 declare function calculateComplaintRate(db: PostgresJsDatabase<Record<string, unknown>>, emailEventsTable: EmailEventsTable, hoursAgo?: number): Promise<number>;
 
-export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailBranding, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, type InvitationHookUser, type InvitationHooks, MAX_CHALLENGE_ATTEMPTS, type PasswordResetEmailData, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, problemJson, problems, rateLimit, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };
+export { AUTH_DEFAULTS, type AccountLockoutTables, type Auth, type AuthConfig, type AuthContext, type AuthDatabase, type AuthSchema, CHALLENGE_TTL_MS, type ChallengePayload, CloudflareEmailAdapter, type DeviceType, type EmailAdapter, type EmailBranding, type EmailChangeConfirmationData, type EmailChangeNotificationData, type EmailChangeTables, type EmailSendOptions, type EmailSendResult, EmailService, type EmailTemplate, type EmailType, type Env, type InferNewSession, type InferNewUser, type InferSession, type InferUser, type InvitationHookUser, type InvitationHooks, MAX_CHALLENGE_ATTEMPTS, PASSWORDLESS_MAX_ATTEMPTS, PASSWORDLESS_TTL_MS, type PasswordResetEmailData, type PasswordlessCodeResult, type PasswordlessLinkResult, type PasswordlessSuccess, type PasswordlessTables, type ProblemDetails, ProblemTypes, ResendAdapter, type ResendEventType, type ResendWebhookPayload, type SendEmailBinding, type SendEmailResult, type SessionData, type SessionTables, type SignupMode, type SvixHeaders, TRUSTED_DEVICE_COOKIE_BASE, TRUSTED_DEVICE_TTL_MS, type TotpVerifyResult, type TwoFactorCodeEmailData, type TwoFactorDisabledEmailData, type TwoFactorEnabledEmailData, type ValidationResult, type Variables, type VerificationEmailData, authRoutes, calculateBounceRate, calculateComplaintRate, cancelEmailChange, checkAccountLocked, checkBreachedPassword, cleanupExpiredPasswordlessChallenges, clearAccountLockout, clearChallengeCookie, clearSessionCookie, clearTrustedDeviceCookie, confirmEmailChange, createAuth, createAuthMiddleware, createChallengeToken, createDeviceToken, createEmailAdapter, createPasswordlessChallenge, createProblemDetails, createSession, csrf, decryptTotpSecret, deleteAllUserSessions, deleteChallengeToken, deleteSession, encryptTotpSecret, extractAppUrl, formatBackupCode, generate2faCodeEmail, generate2faDisabledEmail, generate2faEnabledEmail, generateApiKey, generateBackupCodes, generateCode, generateCodeChallenge, generateCodeVerifier, generateEmailChangeConfirmation, generateEmailChangeNotification, generateFingerprint, generatePasswordResetEmail, generateQrCodeUri, generateSecureToken, generateTotpSecret, generateTraceId, generateVerificationEmail, getAllowedOrigins, getAuthContext, getChallengeCookieName, getClientIp, getKeyPrefix, getMinutesUntilUnlock, getSessionCookieName, getTotpCounter, getTrustedDeviceCookieName, handleWebhookEvent, hashApiKey, hashBackupCode, hashPassword, hashToken, incrementFailedAttempts, invalidateAllUserSessions, isCapacitorApp, isCloudflarePreviewUrl, isDeepLinkUri, isValidApiKeyFormat, logError, logSecurityEvent, logger, normalizeBackupCode, optionalAuth, parseDeviceName, parseDeviceType, passwordlessEmail, problemJson, problems, rateLimit, recentPasswordlessFailures, refreshSession, requestEmailChange, requireAuth, requireVerifiedEmail, retrieveChallengeToken, sessionRefreshDue, setChallengeCookie, setSessionCookie, setTrustedDeviceCookie, storeChallengeToken, updateChallengeAttempts, validateChallengePayload, validateOrigin, validatePassword, validatePasswordWithBreachCheck, validateSession, validateTrustedDevice, verifyBackupCode, verifyCodeChallenge, verifyPassword, verifyPasswordWithRotation, verifyPasswordlessCode, verifyPasswordlessLink, verifyTotpCode, verifyTurnstileToken, verifyWebhookSignature };