@touchque/node 1.3.0

package/dist/index.d.ts

@@ -0,0 +1,686 @@
+import { Request, Response, NextFunction } from 'express';
+
+interface TouchQueConfig {
+    /** Your TouchQue API key (starts with `tq_`) */
+    apiKey: string;
+    /** Your TouchQue API secret */
+    apiSecret: string;
+    /**
+     * Optional base URL override (default:
+     * https://api-authenticator.touchque.com). Must be `https://` unless it
+     * points at localhost — the SDK refuses plaintext `http://` to any other
+     * host so the API key / signature are never sent in the clear.
+     */
+    baseUrl?: string;
+    /** Request timeout in ms (default: 10000) */
+    timeout?: number;
+}
+interface GenerateSecretOptions {
+    /** The user's unique identifier in YOUR system (email, userId, etc.) */
+    externalUsername: string;
+}
+interface GenerateSecretResponse {
+    /** New setup secret — show to user once (e.g. as QR code) */
+    secret: string;
+    externalUsername: string;
+    /** ISO string of when this secret expires if not used */
+    expiresAt: string;
+    ttlMs: number;
+    /**
+     * 10 one-time recovery codes to be shown to the user.
+     * If the user loses their device, they can use one of these codes to bypass 2FA.
+     */
+    recoveryCodes: string[];
+}
+interface UnlinkSecretOptions {
+    externalUsername: string;
+}
+interface UnlinkSecretResponse {
+    success: boolean;
+    externalUsername: string;
+    message: string;
+}
+interface ValidateSecretOptions {
+    secret: string;
+}
+interface ValidateSecretResponse {
+    valid: boolean;
+    externalUsername?: string;
+    integrationId?: string;
+    integration?: {
+        companyName: string;
+        icon: string;
+        color: string;
+    };
+    message?: string;
+    reason?: string;
+    usedAt?: string;
+    expiredAt?: string;
+}
+interface ResetSecretOptions {
+    externalUsername: string;
+}
+interface ResetSecretResponse {
+    /** New setup secret — show to user once */
+    secret: string;
+    externalUsername: string;
+    expiresAt?: string;
+    recoveryCodes?: string[];
+}
+interface GetUserResponse {
+    externalUsername: string;
+    /** Set once the mobile app has linked (scanned) the secret. */
+    deviceId: string | null;
+    /** true once the secret has been linked to a device via /auth/secret/link. */
+    used: boolean;
+    frozen: boolean;
+    createdAt: string;
+    expireAt: string | null;
+}
+type LoginType = 'LOGIN' | 'DISABLE_2FA' | string;
+interface LoginRequestOptions {
+    /** User identifier in YOUR system */
+    externalUsername: string;
+    /**
+     * The type of action requiring 2FA confirmation.
+     * Built-in types: 'LOGIN', 'DISABLE_2FA'
+     * Custom types can be created/configured in your TouchQue Dashboard.
+     */
+    type: LoginType;
+    /** Optional reference (e.g. your internal transaction ID) */
+    referenceId?: string;
+    /** The IP address of the user initiating the request. TouchQue will resolve this to a City/Country. */
+    clientIp?: string;
+    /** The User-Agent string of the user's browser/device. */
+    userAgent?: string;
+    /** Require the user to authenticate with FaceID / TouchID on their device to approve this request. */
+    requireBiometric?: boolean;
+    /**
+     * Force Number Matching (anti-push-bombing).
+     * When true, the user must type a matching code shown on their screen to approve.
+     * The backend also auto-enables this if MFA fatigue is detected (2+ failed requests in 10 min).
+     */
+    requireNumberMatch?: boolean;
+}
+interface LoginRequestResponse {
+    requestId: string;
+    /** Challenge code for number matching UI (if enabled for this integration) */
+    challengeCode?: string;
+    message: string;
+    expiresAt: string;
+    /**
+     * Present only when this integration has behavioral biometrics enabled
+     * (TenantPolicy.behavioralBiometricsEnabled). Pass this down to your
+     * frontend along with `requestId` to initialize the behavioral widget in
+     * `@touchque/web` (`tq.behavioral.attach(...)`), scoped to your 2FA
+     * challenge UI. Single-purpose and short-lived — do not reuse across requests.
+     */
+    telemetryToken?: string;
+}
+type LoginStatus = 'PENDING' | 'CONFIRMED' | 'REJECTED' | 'EXPIRED';
+interface LoginStatusResponse {
+    status: LoginStatus;
+}
+interface WaitForApprovalOptions {
+    requestId: string;
+    /** How long to poll in total, ms (default: 30000 = 30s) */
+    timeout?: number;
+    /** Polling interval, ms (default: 1500) */
+    pollInterval?: number;
+}
+interface WaitForApprovalResult {
+    approved: boolean;
+    status: LoginStatus;
+}
+interface VerifyWebhookOptions {
+    /** Raw request body as string, exactly as received (before JSON.parse). */
+    rawBody: string;
+    /**
+     * The signature to check against. Pass the value of the `x-signature`
+     * header. Optional: if omitted, the SDK falls back to the `signature`
+     * field TouchQue also embeds in the JSON body.
+     */
+    signature?: string;
+    /**
+     * Reject the webhook if its `timestamp` is more than this many seconds
+     * from now (replay protection). Default 300 (5 minutes). Set to 0 to
+     * disable the freshness check.
+     */
+    toleranceSeconds?: number;
+}
+interface WebhookPayload {
+    event: string;
+    requestId: string;
+    externalUsername: string;
+    status: LoginStatus;
+    timestamp: string;
+    [key: string]: unknown;
+}
+interface ProtectOptions<TArgs extends any[]> {
+    /** The action type (e.g. 'WITHDRAW', 'LOGIN') */
+    type: string;
+    /** Function to extract the externalUsername from the wrapped function's arguments */
+    getUserIdentifier: (...args: TArgs) => string;
+    /** Optional function to extract a referenceId from the arguments */
+    getReferenceId?: (...args: TArgs) => string | undefined;
+    /** Timeout in ms */
+    timeout?: number;
+    /** Polling interval in ms */
+    pollInterval?: number;
+}
+interface TouchQueErrorData {
+    error?: string;
+    message?: string;
+    code?: string;
+}
+
+declare class HttpClient {
+    private readonly client;
+    private readonly apiKey;
+    private readonly apiSecret;
+    constructor(config: TouchQueConfig);
+    /**
+     * Canonical signature.
+     * Format: HMAC(apiSecret, "METHOD:pathWithQuery:timestamp:nonce:bodyHash")
+     *
+     * `pathWithQuery` includes the sorted query string so GET/DELETE query
+     * params are covered by the signature (older SDKs signed the path only;
+     * the backend accepts either form).
+     */
+    private sign;
+    private generateNonce;
+    private authHeaders;
+    post<T>(path: string, body?: Record<string, unknown>): Promise<T>;
+    get<T>(path: string, params?: Record<string, string | number | boolean>): Promise<T>;
+    delete<T>(path: string): Promise<T>;
+    private handleError;
+}
+
+declare class Auth {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Generate a new setup secret for a user.
+     * Show this secret to the user ONCE (e.g. as a QR code) so they can
+     * link their TouchQue app.
+     *
+     * The secret expires after 60 seconds if not used (scanned by the mobile app).
+     * After expiry, calling this method again will automatically rotate the secret.
+     *
+     * @example
+     * const { secret, expiresAt } = await tq.auth.generateSecret({
+     *   externalUsername: 'user@company.com'
+     * });
+     * // Show `secret` to user as QR code
+     * // Secret expires at `expiresAt` if not scanned
+     */
+    generateSecret(options: GenerateSecretOptions): Promise<GenerateSecretResponse>;
+    /**
+     * Reset (regenerate) a user's secret.
+     * This invalidates the old secret and generates a new one.
+     * Show the new secret to the user.
+     *
+     * @example
+     * const { secret } = await tq.auth.resetSecret({
+     *   externalUsername: 'user@company.com'
+     * });
+     * // Show new secret to user
+     */
+    resetSecret(options: ResetSecretOptions): Promise<ResetSecretResponse>;
+    /**
+     * Validate a secret code.
+     * Useful if you want to verify the user entered the correct setup secret.
+     * Note: The backend allows this without an API key, but the SDK sends it for consistency.
+     */
+    validateSecret(options: ValidateSecretOptions): Promise<ValidateSecretResponse>;
+    /**
+     * Look up a user's current link status — no push notification is sent.
+     * Useful for detecting "the mobile app just linked this secret" (`used`
+     * flips true, `deviceId` gets set) without sending a LOGIN challenge to
+     * their device, e.g. while polling during enrollment.
+     *
+     * @example
+     * const { used, deviceId } = await tq.auth.getUser({
+     *   externalUsername: 'user@company.com'
+     * });
+     * if (used && deviceId) {
+     *   // Device has linked — no approval push needed to confirm this.
+     * }
+     */
+    getUser(options: {
+        externalUsername: string;
+    }): Promise<GetUserResponse>;
+}
+
+declare class Login {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Request 2FA confirmation from a user's TouchQue app.
+     *
+     * The user will receive a push notification on their device.
+     * They can then approve or reject the request.
+     *
+     * Built-in `type` values:
+     * - `'LOGIN'` — User is logging in
+     * - `'DISABLE_2FA'` — User is disabling 2FA
+     * - Custom action type IDs or slugs configured in your TouchQue Dashboard
+     *
+     * @example
+     * // Basic login verification
+     * const response = await tq.login.request({
+     *   externalUsername: 'user@company.com',
+     *   type: 'LOGIN'
+     * });
+     *
+     * @example
+     * // Protect a custom action using its Dashboard-configured ID or slug
+     * const response = await tq.login.request({
+     *   externalUsername: 'user@company.com',
+     *   type: 'action_type_slug_or_id',
+     *   referenceId: 'txn_abc123' // Your internal transaction ID
+     * });
+     */
+    request(options: LoginRequestOptions): Promise<LoginRequestResponse>;
+    /**
+     * Check the current status of a login request.
+     *
+     * Returns: `'PENDING'` | `'CONFIRMED'` | `'REJECTED'` | `'EXPIRED'`
+     *
+     * @example
+     * const { status } = await tq.login.status('request_id_here');
+     * if (status === 'CONFIRMED') {
+     *   // User approved — proceed with action
+     * }
+     */
+    status(requestId: string): Promise<LoginStatusResponse>;
+    /**
+     * Wait for the user to approve or reject a login request.
+     *
+     * This is a convenience method that polls the status endpoint
+     * until the request is approved, rejected, or times out.
+     *
+     * **This is the recommended way to integrate TouchQue into your routes.**
+     *
+     * @throws {TouchQueRejectedError} If the user rejects the request
+     * @throws {TouchQueTimeoutError} If the request times out (user didn't respond)
+     *
+     * @example
+     * // Simple: Send request and wait for approval in one step
+     * try {
+     *   const loginReq = await tq.login.request({
+     *     externalUsername: 'user@company.com',
+     *     type: 'LOGIN'
+     *   });
+     *
+     *   const result = await tq.login.waitForApproval({
+     *     requestId: loginReq.requestId,
+     *     timeout: 30000  // Wait up to 30 seconds
+     *   });
+     *
+     *   if (result.approved) {
+     *     // ✅ User approved — proceed
+     *     proceedWithAction();
+     *   }
+     * } catch (err) {
+     *   if (err instanceof TouchQueRejectedError) {
+     *     // ❌ User rejected — cancel the action
+     *   } else if (err instanceof TouchQueTimeoutError) {
+     *     // ⏰ User didn't respond in time
+     *   }
+     * }
+     */
+    waitForApproval(options: WaitForApprovalOptions): Promise<WaitForApprovalResult>;
+    /**
+     * Convenience: Send a 2FA request AND wait for approval in one call.
+     *
+     * Perfect for protecting any action with a single function call.
+     *
+     * @throws {TouchQueRejectedError} User rejected
+     * @throws {TouchQueTimeoutError} User didn't respond in time
+     *
+     * @example
+     * // Protect an action with 2FA — ONE LINE!
+     * const result = await tq.login.verify({
+     *   externalUsername: 'user@company.com',
+     *   type: 'action_type_slug_or_id',
+     *   referenceId: 'action_789'
+     * });
+     * // If we reach here, user approved ✅
+     * executeAction();
+     */
+    verify(options: LoginRequestOptions & {
+        timeout?: number;
+        pollInterval?: number;
+    }): Promise<WaitForApprovalResult & {
+        requestId: string;
+        challengeCode?: string;
+    }>;
+    /**
+     * Approve a pending 2FA request using a Recovery Code.
+     * Useful when a user loses their phone and needs to bypass 2FA
+     * using one of the backup codes generated during setup.
+     */
+    approveWithRecoveryCode(options: {
+        requestId: string;
+        code: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+}
+
+declare class Webhook {
+    private readonly apiSecret;
+    constructor(apiSecret: string);
+    /**
+     * Verify that an incoming webhook request is genuinely from TouchQue and
+     * return its parsed payload. Throws `TouchQueWebhookSignatureError` if the
+     * signature is invalid, the body is malformed, or the webhook is stale.
+     *
+     * **Always verify before processing, and de-duplicate on `payload.jti`
+     * (or `payload.requestId` + `payload.event`) so a replayed webhook can't
+     * re-trigger your logic.**
+     *
+     * @throws {TouchQueWebhookSignatureError}
+     *
+     * @example
+     * // Express.js — mount with a raw body parser on this route
+     * app.post('/webhooks/touchque', express.raw({ type: 'application/json' }), (req, res) => {
+     *   try {
+     *     const event = tq.webhook.verify({
+     *       rawBody: req.body.toString('utf8'),
+     *       signature: req.headers['x-signature'] as string,
+     *     });
+     *     // ... handle event.event, guarded by an idempotency check on event.jti
+     *     res.sendStatus(200);
+     *   } catch {
+     *     res.sendStatus(403); // not from TouchQue, tampered, or replayed
+     *   }
+     * });
+     */
+    verify(options: VerifyWebhookOptions): WebhookPayload;
+    /**
+     * Check a webhook signature without throwing. Returns `true` / `false`.
+     *
+     * @example
+     * if (tq.webhook.isValid({ rawBody, signature })) {
+     *   // process
+     * }
+     */
+    isValid(options: VerifyWebhookOptions): boolean;
+}
+
+interface WebAuthnRegisterOptionsRequest {
+    externalUsername: string;
+    /**
+     * Register a *resident* (discoverable) credential with forced user
+     * verification and a stable WebAuthn user handle — the shape a
+     * passwordless-primary login (see `primaryOptions`) authenticates against.
+     * Omit for the classic second-factor credential.
+     */
+    discoverable?: boolean;
+}
+/** Passed straight through to navigator.credentials.create() in the browser. */
+type WebAuthnRegistrationOptions = Record<string, unknown>;
+interface WebAuthnRegisterVerifyRequest {
+    externalUsername: string;
+    /** The RegistrationResponseJSON returned by navigator.credentials.create(). */
+    response: Record<string, unknown>;
+    /** Optional display label for this credential (e.g. "MacBook Touch ID"). */
+    label?: string;
+}
+interface WebAuthnRegisterVerifyResponse {
+    verified: boolean;
+    credentialId: string;
+}
+interface WebAuthnAuthenticateOptionsRequest {
+    /** The pending LoginRequest id this WebAuthn assertion will approve. */
+    requestId: string;
+}
+/** Passed straight through to navigator.credentials.get() in the browser. */
+type WebAuthnAuthenticationOptions = Record<string, unknown>;
+interface WebAuthnAuthenticateVerifyRequest {
+    requestId: string;
+    /** The AuthenticationResponseJSON returned by navigator.credentials.get(). */
+    response: Record<string, unknown>;
+}
+interface WebAuthnAuthenticateVerifyResponse {
+    success: boolean;
+    message: string;
+}
+interface WebAuthnPrimaryOptionsRequest {
+    /** The account to authenticate (username-first passwordless-primary login). */
+    externalUsername: string;
+}
+interface WebAuthnPrimaryOptionsResponse {
+    /** Opaque id tying the browser assertion back to this attempt. */
+    attemptId: string;
+    /** Passed straight through to navigator.credentials.get() in the browser. */
+    options: Record<string, unknown>;
+}
+interface WebAuthnPrimaryVerifyRequest {
+    attemptId: string;
+    /** The AuthenticationResponseJSON returned by navigator.credentials.get(). */
+    response: Record<string, unknown>;
+}
+interface WebAuthnPrimaryVerifyResponse {
+    success: boolean;
+    /** Present when success:false — risk/policy demands a step-up (push/number-match). */
+    requiresStepUp?: boolean;
+    externalUsername: string;
+    riskScore: number;
+    /** Present when success:true — the CONFIRMED LoginRequest id. */
+    requestId?: string;
+}
+interface WebAuthnCredentialSummary {
+    id: string;
+    credentialId: string;
+    deviceType: string | null;
+    backedUp: boolean;
+    label: string | null;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+declare class WebAuthn {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Step 1 of registering a passkey: get options for `navigator.credentials.create()`.
+     *
+     * @example
+     * const options = await tq.webauthn.registerOptions({ externalUsername: 'user@company.com' });
+     * // send `options` to the browser, call navigator.credentials.create({ publicKey: options })
+     */
+    registerOptions(options: WebAuthnRegisterOptionsRequest): Promise<WebAuthnRegistrationOptions>;
+    /**
+     * Step 2: verify the browser's registration response and store the credential.
+     *
+     * @example
+     * const { verified, credentialId } = await tq.webauthn.registerVerify({
+     *   externalUsername: 'user@company.com',
+     *   response: browserRegistrationResponseJSON,
+     *   label: 'MacBook Touch ID',
+     * });
+     */
+    registerVerify(options: WebAuthnRegisterVerifyRequest): Promise<WebAuthnRegisterVerifyResponse>;
+    /**
+     * Step 1 of approving a pending login with a passkey: get options for
+     * `navigator.credentials.get()`, scoped to a specific `requestId` (from
+     * `tq.login.request()`).
+     *
+     * @example
+     * const loginReq = await tq.login.request({ externalUsername: 'user@company.com', type: 'LOGIN' });
+     * const options = await tq.webauthn.authenticateOptions({ requestId: loginReq.requestId });
+     */
+    authenticateOptions(options: WebAuthnAuthenticateOptionsRequest): Promise<WebAuthnAuthenticationOptions>;
+    /**
+     * Step 2: verify the browser's assertion — approves the LoginRequest on success.
+     *
+     * @example
+     * const result = await tq.webauthn.authenticateVerify({
+     *   requestId: loginReq.requestId,
+     *   response: browserAuthenticationResponseJSON,
+     * });
+     */
+    authenticateVerify(options: WebAuthnAuthenticateVerifyRequest): Promise<WebAuthnAuthenticateVerifyResponse>;
+    /**
+     * Step 1 of a PASSWORDLESS-PRIMARY login: authenticate a user *from zero*
+     * (no password, no prior `tq.login.request()`, no mobile device) with a
+     * passkey registered via `registerOptions({ discoverable: true })`.
+     *
+     * Requires `TenantPolicy.passwordlessLoginEnabled` for the integration.
+     * Returns `404 no_passkey_registered` if the user has no passkey — the
+     * caller should then fall back to password login.
+     *
+     * @example
+     * const { attemptId, options } = await tq.webauthn.primaryOptions({ externalUsername: 'user@company.com' });
+     * // browser: const assertion = await navigator.credentials.get({ publicKey: options });
+     */
+    primaryOptions(options: WebAuthnPrimaryOptionsRequest): Promise<WebAuthnPrimaryOptionsResponse>;
+    /**
+     * Step 2 of a passwordless-primary login: verify the browser assertion.
+     *
+     * On `success:true` the returned `requestId` is a CONFIRMED LoginRequest —
+     * the login is done. On `success:false` with `requiresStepUp:true`, risk
+     * or policy demands a second factor: start the normal `tq.login.request()`
+     * / number-match flow instead of trusting this assertion alone.
+     */
+    primaryVerify(options: WebAuthnPrimaryVerifyRequest): Promise<WebAuthnPrimaryVerifyResponse>;
+    /**
+     * List a user's registered WebAuthn credentials (labels/metadata only, no key material).
+     */
+    listCredentials(options: {
+        externalUsername: string;
+    }): Promise<{
+        credentials: WebAuthnCredentialSummary[];
+    }>;
+    /**
+     * Remove a registered credential (e.g. the user lost that device).
+     */
+    deleteCredential(credentialRecordId: string): Promise<{
+        deleted: boolean;
+    }>;
+}
+
+/**
+ * Base error class for all TouchQue SDK errors.
+ */
+declare class TouchQueError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown when the TouchQue API returns a non-2xx HTTP response.
+ * Contains the HTTP status code and the raw API error data.
+ */
+declare class TouchQueAPIError extends TouchQueError {
+    readonly status: number;
+    readonly code: string | undefined;
+    readonly data: TouchQueErrorData;
+    constructor(status: number, data: TouchQueErrorData);
+}
+/**
+ * Thrown when the waitForApproval() polling method times out
+ * before the user approves or rejects the request.
+ */
+declare class TouchQueTimeoutError extends TouchQueError {
+    readonly requestId: string;
+    constructor(requestId: string, timeoutMs: number);
+}
+/**
+ * Thrown when a login request is explicitly rejected by the user.
+ */
+declare class TouchQueRejectedError extends TouchQueError {
+    readonly requestId: string;
+    constructor(requestId: string);
+}
+/**
+ * Thrown when webhook signature verification fails.
+ * This means the incoming webhook is not from TouchQue (potential forgery).
+ */
+declare class TouchQueWebhookSignatureError extends TouchQueError {
+    constructor();
+}
+/**
+ * Thrown when SDK is used before being properly configured.
+ */
+declare class TouchQueConfigError extends TouchQueError {
+    constructor(message: string);
+}
+
+interface TouchQueMiddlewareOptions {
+    /**
+     * How long to wait for user approval in milliseconds.
+     * Default: 30000 (30 seconds)
+     */
+    timeout?: number;
+    /**
+     * Function to extract the user's ID/Username from the Express request.
+     * By default, it looks for `req.user.email`, `req.user.id`, or `req.user.username`.
+     */
+    getUserId?: (req: Request) => string | undefined;
+    /**
+     * Optional function to extract a reference ID (like a transaction ID) from the request.
+     */
+    getReferenceId?: (req: Request) => string | undefined;
+}
+/**
+ * Creates an Express.js middleware that protects a route with TouchQue 2FA.
+ *
+ * @param tqClient - Your initialized TouchQue instance
+ * @param actionType - The type of action (e.g., 'LOGIN', or a custom action slug/ID)
+ * @param options - Custom timeout and ID extraction functions
+ *
+ * @example
+ * const tq = new TouchQue({ apiKey: '...', apiSecret: '...' });
+ *
+ * app.post('/api/sensitive-action',
+ *   requireTouchQue(tq, 'action_type_slug_or_id'),
+ *   (req, res) => { res.send('Success'); }
+ * );
+ */
+declare function requireTouchQue(tqClient: TouchQue, actionType: string, options?: TouchQueMiddlewareOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+declare class TouchQue {
+    private readonly client;
+    readonly auth: Auth;
+    readonly login: Login;
+    /** Webhook signature verification */
+    readonly webhook: Webhook;
+    /** WebAuthn/FIDO2 (passkey) registration and login approval */
+    readonly webauthn: WebAuthn;
+    /**
+     * Create a new TouchQue SDK client.
+     *
+     * @param config - Your API credentials from the TouchQue Dashboard
+     *
+     * @example
+     * import { TouchQue } from '@touchque/node';
+     *
+     * const tq = new TouchQue({
+     *   apiKey: 'tq_auth_abc123',
+     *   apiSecret: 'your_api_secret'
+     * });
+     *
+     * // Now use tq.auth, tq.login, tq.webhook
+     */
+    constructor(config: TouchQueConfig);
+    /**
+     * Wrap and protect any async function with TouchQue 2FA.
+     *
+     * @param fn The function to protect
+     * @param options Configuration for extracting the user identity and 2FA type
+     * @returns A new function that requires 2FA approval before executing the original function
+     *
+     * @example
+     * const secureWithdraw = tq.protect(processWithdraw, {
+     *   type: 'WITHDRAW',
+     *   getUserIdentifier: (username, amount) => username
+     * });
+     *
+     * await secureWithdraw("user@company.com", 500); // Prompts 2FA automatically
+     */
+    protect<TArgs extends any[], TReturn>(fn: (...args: TArgs) => Promise<TReturn> | TReturn, options: ProtectOptions<TArgs>): (...args: TArgs) => Promise<TReturn>;
+}
+
+export { Auth, type GenerateSecretOptions, type GenerateSecretResponse, type GetUserResponse, Login, type LoginRequestOptions, type LoginRequestResponse, type LoginStatus, type LoginStatusResponse, type LoginType, type ProtectOptions, type ResetSecretOptions, type ResetSecretResponse, TouchQue, TouchQueAPIError, type TouchQueConfig, TouchQueConfigError, TouchQueError, type TouchQueErrorData, type TouchQueMiddlewareOptions, TouchQueRejectedError, TouchQueTimeoutError, TouchQueWebhookSignatureError, type UnlinkSecretOptions, type UnlinkSecretResponse, type ValidateSecretOptions, type ValidateSecretResponse, type VerifyWebhookOptions, type WaitForApprovalOptions, type WaitForApprovalResult, WebAuthn, type WebAuthnAuthenticateOptionsRequest, type WebAuthnAuthenticateVerifyRequest, type WebAuthnAuthenticateVerifyResponse, type WebAuthnAuthenticationOptions, type WebAuthnCredentialSummary, type WebAuthnPrimaryOptionsRequest, type WebAuthnPrimaryOptionsResponse, type WebAuthnPrimaryVerifyRequest, type WebAuthnPrimaryVerifyResponse, type WebAuthnRegisterOptionsRequest, type WebAuthnRegisterVerifyRequest, type WebAuthnRegisterVerifyResponse, type WebAuthnRegistrationOptions, Webhook, type WebhookPayload, requireTouchQue };