kavachos 0.0.3 → 0.0.5

package/dist/index.d.ts

@@ -1,12 +1,13 @@
 export { createAgentModule } from './agent/index.js';
-import { D as Database, a as DatabaseConfig, b as DelegateInput, P as Permission, c as DelegationChain, d as DidDocument, e as DidKeyPair, f as DidWebConfig, A as AgentDid, S as SignedPayload, V as VerificationResult, K as KavachConfig, C as CreateAgentInput, g as AgentIdentity, h as AgentFilter, U as UpdateAgentInput, i as AuthorizeRequest, R as RequestContext, j as AuthorizeResult, k as AuditFilter, l as AuditEntry, m as AuditExportOptions, M as McpServerInput, n as McpServer, o as ResolvedUser, p as SessionManager, q as ApprovalRequest, r as MagicLinkModule, E as EmailOtpModule, T as TotpModule, s as PasskeyModule, O as OrgModule, t as SsoModule, u as AdminModule, v as ApiKeyManagerModule, w as UsernameAuthModule, x as PhoneAuthModule, y as CaptchaModule, W as WebhookModule$1, z as PluginEndpoint, B as EndpointContext, F as KavachPlugin, G as SessionConfig, H as Session } from './types-Xk83hv4O.js';
-export { I as AdminConfig, J as AdminUser, L as AgentConfig, N as ApiKey, Q as ApiKeyManagerConfig, X as ApprovalConfig, Y as ApprovalModule, Z as AuthAdapter, _ as CaptchaConfig, $ as CaptchaVerifyResult, a0 as DatabaseConfig, a1 as EmailOtpConfig, a2 as KavachHooks, a3 as KavachInstance, a4 as MagicLinkConfig, a5 as McpMiddleware, a6 as OidcProvider, a7 as OrgConfig, a8 as OrgInvitation, a9 as OrgMember, aa as OrgRole, ab as Organization, ac as PasskeyConfig, ad as PasskeyCredential, ae as PermissionConstraints, af as PhoneAuthConfig, ag as PluginContext, ah as PluginInitResult, ai as SSO_ERROR, aj as SamlProvider, ak as ServiceEndpoint, al as SsoAuditEvent, am as SsoConfig, an as SsoConnection, ao as SsoError, ap as TokenValidationResult, aq as TotpConfig, ar as TotpSetup, as as UsernameAuthConfig, at as VerificationMethod, au as agentCards, av as agentDids, aw as agents, ax as apiKeysTable, ay as approvalRequests, az as auditLogs, aA as budgetPolicies, aB as classifyViolation, aC as createAdminModule, aD as createApiKeyManagerModule, aE as createApprovalModule, aF as createCaptchaModule, aG as createDatabase, aH as createDatabaseSync, aI as createEmailOtpModule, aJ as createMagicLinkModule, aK as createOrgModule, aL as createPasskeyModule, aM as createPhoneAuthModule, aN as createSessionManager, aO as createSsoModule, aP as createTotpModule, aQ as createUsernameAuthModule, aR as delegationChains, aS as emailOtps, aT as magicLinks, aU as mcpServers, aV as oauthAccessTokens, aW as oauthAuthorizationCodes, aX as oauthClients, aY as orgInvitations, aZ as orgMembers, a_ as orgRoles, a$ as organizations, b0 as passkeyChallenges, b1 as passkeyCredentials, b2 as permissions, b3 as rateLimits, b4 as sessions, b5 as ssoConnections, b6 as tenants, b7 as totpRecords, b8 as trustScores, b9 as users } from './types-Xk83hv4O.js';
+import { D as Database, a as DatabaseConfig, b as DelegateInput, P as Permission, c as DelegationChain, d as DidDocument, e as DidKeyPair, f as DidWebConfig, g as AgentDid, S as SignedPayload, V as VerificationResult, K as KavachConfig, C as CreateAgentInput, A as AgentIdentity, h as AgentFilter, U as UpdateAgentInput, i as AuthorizeRequest, R as RequestContext, j as AuthorizeResult, k as AuditFilter, l as AuditEntry, m as AuditExportOptions, M as McpServerInput, n as McpServer, o as ResolvedUser, p as SessionManager, q as ApprovalRequest, r as MagicLinkModule, E as EmailOtpModule, T as TotpModule, s as PasskeyModule, O as OrgModule, t as SsoModule, u as AdminModule, v as ApiKeyManagerModule, w as UsernameAuthModule, x as PasswordResetModule, y as EmailVerificationModule, z as OneTimeTokenModule, B as SessionFreshnessModule, F as PhoneAuthModule, G as CaptchaModule, W as WebhookModule$1, H as RedirectChainManager, I as PluginEndpoint, J as EndpointContext, L as KavachPlugin, N as SessionConfig, Q as Session } from './types-BTui0HQU.js';
+export { X as AdminConfig, Y as AdminUser, Z as AgentConfig, _ as ApiKey, $ as ApiKeyManagerConfig, a0 as ApprovalConfig, a1 as ApprovalModule, a2 as AuthAdapter, a3 as CaptchaConfig, a4 as CaptchaVerifyResult, a5 as CreateTokenInput, a6 as D1DatabaseBinding, a7 as EmailOtpConfig, a8 as EmailVerificationConfig, a9 as KavachHooks, aa as KavachInstance, ab as MagicLinkConfig, ac as McpMiddleware, ad as OidcProvider, ae as OneTimeTokenConfig, af as OneTimeTokenPurpose, ag as OrgConfig, ah as OrgInvitation, ai as OrgMember, aj as OrgRole, ak as Organization, al as PasskeyConfig, am as PasskeyCredential, an as PasswordResetConfig, ao as PermissionConstraints, ap as PhoneAuthConfig, aq as PluginContext, ar as PluginInitResult, as as RedirectChainState, at as RedirectConfig, au as RedirectEntry, av as RevokeTokensResult, aw as SSO_ERROR, ax as SamlProvider, ay as ServiceEndpoint, az as SessionFreshnessConfig, aA as SsoAuditEvent, aB as SsoConfig, aC as SsoConnection, aD as SsoError, aE as TokenValidationResult, aF as TotpConfig, aG as TotpSetup, aH as UsernameAuthConfig, aI as ValidateTokenResult, aJ as VerificationMethod, aK as agentCards, aL as agentDids, aM as agents, aN as apiKeysTable, aO as approvalRequests, aP as auditLogs, aQ as budgetPolicies, aR as classifyViolation, aS as createAdminModule, aT as createApiKeyManagerModule, aU as createApprovalModule, aV as createCaptchaModule, aW as createDatabase, aX as createDatabaseSync, aY as createEmailOtpModule, aZ as createEmailVerificationModule, a_ as createMagicLinkModule, a$ as createOneTimeTokenModule, b0 as createOrgModule, b1 as createPasskeyModule, b2 as createPasswordResetModule, b3 as createPhoneAuthModule, b4 as createRedirectChain, b5 as createSessionFreshnessModule, b6 as createSessionManager, b7 as createSsoModule, b8 as createTotpModule, b9 as createUsernameAuthModule, ba as delegationChains, bb as emailOtps, bc as magicLinks, bd as mcpServers, be as oauthAccessTokens, bf as oauthAuthorizationCodes, bg as oauthClients, bh as orgInvitations, bi as orgMembers, bj as orgRoles, bk as organizations, bl as passkeyChallenges, bm as passkeyCredentials, bn as permissions, bo as rateLimits, bp as sessions, bq as ssoConnections, br as tenants, bs as totpRecords, bt as trustScores, bu as users } from './types-BTui0HQU.js';
 export { createAuditModule } from './audit/index.js';
-export { AccessTokenClaims, AdditionalFieldsConfig, AdditionalFieldsModule, AnonymousAuthConfig, AnonymousAuthModule, AuthorizeParams, BearerAuthOptions, CheckoutOptions, CreateTokenInput, CustomSessionConfig, CustomSessionModule, DeleteOptions, DeleteResult, DeviceAuthConfig, DeviceAuthModule, DeviceAuthStatus, DeviceCodeResponse, EndpointGroup, FieldDefinition, GdprModule, GetUserClaimsFn, GoogleUser, HeaderAuthOptions, HibpApiError, HibpBreachedError, HibpConfig, HibpModule, JsonWebKeySet, JwtSessionConfig, JwtSessionModule, LastLoginConfig, LastLoginModule, LoginEvent, LoginMethod, OAuthProxyConfig, OAuthProxyError, OAuthProxyModule, OAuthProxyPluginConfig, OidcClient, OidcDiscoveryDocument, OidcProviderConfig, OidcProviderModule, OneTapConfig, OneTapModule, OneTapVerifyError, OneTimeTokenConfig, OneTimeTokenModule, OneTimeTokenPurpose, OpenApiComponents, OpenApiConfig, OpenApiDocument, OpenApiInfo, OpenApiMediaType, OpenApiModule, OpenApiOperation, OpenApiParameter, OpenApiPathItem, OpenApiRequestBody, OpenApiResponse, OpenApiSchema, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServer, PolarConfig, PolarModule, PolarSubscription, ProxyTokens, RateLimitConfig, RateLimitMiddlewareOptions, RateLimitResult, RateLimiter, RecordLoginInput, RegisterClientInput, RevokeTokensResult, ScimConfig, ScimGroup, ScimModule, ScimUser, SessionTokens, SessionUser, SiweConfig, SiweModule, SiweVerifyResult, StripeConfig, StripeModule, SubscriptionInfo, TokenParams, TokenResponse, TrustedDevice, TrustedDeviceConfig, TrustedDeviceModule, TwoFactorConfig, UserDataExport, UserInfoClaims, ValidateTokenResult, ValidationResult, VerifiedSession, additionalFields, admin, anonymousAuth, apiKeys, bearerAuth, createAdditionalFieldsModule, createAnonymousAuthModule, createCustomSessionModule, createDeviceAuthModule, createGdprModule, createHibpModule, createJwtSessionModule, createLastLoginModule, createOAuthProxyModule, createOidcProviderModule, createOneTapModule, createOneTimeTokenModule, createOpenApiModule, createPolarModule, createRateLimiter, createScimModule, createSiweModule, createStripeModule, createTrustedDeviceModule, customAuth, customSession, deviceAuth, deviceLabelFromRequest, emailOtp, gdpr, headerAuth, magicLink, oauthProxy, oneTap, organization, passkey, polar, scim, siwe, stripe, twoFactor, withRateLimit } from './auth/index.js';
+export { AccessTokenClaims, AdditionalFieldsConfig, AdditionalFieldsModule, AnonymousAuthConfig, AnonymousAuthModule, AuthorizeParams, BearerAuthOptions, BudgetCheckResult, CheckParams, CheckResult, CheckoutOptions, CostAlert, CostAttributionConfig, CostAttributionModule, CostReport, CreateEphemeralSessionInput, CustomSessionConfig, CustomSessionModule, DeleteOptions, DeleteResult, DeviceAuthConfig, DeviceAuthModule, DeviceAuthStatus, DeviceCodeResponse, EVENT_TYPES, EndpointGroup, EphemeralSession, EphemeralSessionConfig, EphemeralSessionModule, EphemeralSessionValidateResult, EventStreamConfig, EventStreamModule, EventType, ExpandParams, FederatedAgent, FederationConfig, FederationModule, FederationToken, FederationWellKnown, FieldDefinition, GdprModule, GetUserClaimsFn, GoogleUser, HeaderAuthOptions, HibpApiError, HibpBreachedError, HibpConfig, HibpModule, InstanceIdentity, IssueFederationTokenInput, JsonWebKeySet, JwtSessionConfig, JwtSessionModule, LastLoginConfig, LastLoginModule, ListObjectsParams, ListSubjectsParams, LoginEvent, LoginMethod, OAuthProxyConfig, OAuthProxyError, OAuthProxyModule, OAuthProxyPluginConfig, OidcClient, OidcDiscoveryDocument, OidcProviderConfig, OidcProviderModule, OneTapConfig, OneTapModule, OneTapVerifyError, OpenApiComponents, OpenApiConfig, OpenApiDocument, OpenApiInfo, OpenApiMediaType, OpenApiModule, OpenApiOperation, OpenApiParameter, OpenApiPathItem, OpenApiRequestBody, OpenApiResponse, OpenApiSchema, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiServer, PermissionRuleSet, PolarConfig, PolarModule, PolarSubscription, ProxyTokens, RateLimitConfig, RateLimitMiddlewareOptions, RateLimitResult, RateLimiter, ReBACConfig, ReBACModule, RecordCostInput, RecordLoginInput, RegisterClientInput, Relationship, ResourceNode, ScimConfig, ScimGroup, ScimModule, ScimUser, SessionTokens, SessionUser, SiweConfig, SiweModule, SiweVerifyResult, StreamEvent, StripeConfig, StripeModule, SubscriptionInfo, TokenParams, TokenResponse, TrustLevel, TrustedDevice, TrustedDeviceConfig, TrustedDeviceModule, TrustedInstance, TwoFactorConfig, UserDataExport, UserInfoClaims, ValidationResult, VerifiedSession, additionalFields, admin, anonymousAuth, apiKeys, bearerAuth, createAdditionalFieldsModule, createAnonymousAuthModule, createCostAttributionModule, createCustomSessionModule, createDeviceAuthModule, createEphemeralSessionModule, createEventStreamModule, createFederationModule, createGdprModule, createHibpModule, createJwtSessionModule, createLastLoginModule, createOAuthProxyModule, createOidcProviderModule, createOneTapModule, createOpenApiModule, createPolarModule, createRateLimiter, createReBACModule, createScimModule, createSiweModule, createStripeModule, createTrustedDeviceModule, customAuth, customSession, deviceAuth, deviceLabelFromRequest, emailOtp, gdpr, headerAuth, magicLink, oauthProxy, oneTap, organization, passkey, polar, scim, siwe, stripe, twoFactor, withRateLimit } from './auth/index.js';
 export { PermissionTemplateName, createPermissionEngine, getPermissionTemplate, permissionTemplates } from './permission/index.js';
+export { CredentialFormat, CredentialStatus, CredentialStatusSchema, CredentialSubject, CredentialSubjectSchema, DelegationLink, ExtractedPermissions, IssueAgentCredentialInput, IssueDelegationCredentialInput, IssuePermissionCredentialInput, KAVACH_AGENT_CREDENTIAL, KAVACH_DELEGATION_CREDENTIAL, KAVACH_PERMISSION_CREDENTIAL, Proof, ProofSchema, VCIssuer, VCIssuerConfig, VCJwtPayload, VCVerifier, VCVerifierConfig, VC_CONTEXT_V1, VC_CONTEXT_V2, VC_TYPE_CREDENTIAL, VC_TYPE_PRESENTATION, VerifiableCredential, VerifiableCredentialSchema, VerifiablePresentation, VerifiablePresentationSchema, VerifiedCredential, VerifiedPresentation, createVCIssuer, createVCVerifier } from './vc/index.js';
 import 'drizzle-orm/better-sqlite3';
 import 'drizzle-orm/sqlite-core';
-import './types-mwupB57A.js';
+import './types-BuHrZcjE.js';
 import 'zod';
 import 'jose';
 
@@ -55,6 +56,60 @@ declare function createPrivilegeAnalyzer(db: Database): {
 };
 type PrivilegeAnalyzer = ReturnType<typeof createPrivilegeAnalyzer>;
 
+/**
+ * Web Crypto API utilities for KavachOS.
+ *
+ * This module uses ONLY the Web Crypto API (globalThis.crypto) which is
+ * available natively in Cloudflare Workers, Deno, Bun, and Node 20+.
+ * No `node:crypto` imports are used, making the core package edge-compatible.
+ */
+/** Encode a Uint8Array as a lowercase hex string. */
+declare function toHex(bytes: Uint8Array): string;
+/** Decode a hex string into a Uint8Array. */
+declare function fromHex(hex: string): Uint8Array;
+/** Encode a Uint8Array as a base64url string (no padding). */
+declare function toBase64Url(bytes: Uint8Array): string;
+/** Decode a base64url string into a Uint8Array. */
+declare function fromBase64Url(b64: string): Uint8Array;
+/** Generate a v4 UUID using the globally available crypto.randomUUID(). */
+declare function generateId(): string;
+/** Generate cryptographically secure random bytes as a Uint8Array. */
+declare function randomBytes(length: number): Uint8Array;
+/** Generate cryptographically secure random bytes as a hex string. */
+declare function randomBytesHex(length: number): string;
+/** SHA-256 hash, returns hex string. */
+declare function sha256(data: string | Uint8Array): Promise<string>;
+/** SHA-256 hash, returns Uint8Array. */
+declare function sha256Raw(data: string | Uint8Array): Promise<Uint8Array>;
+/** SHA-1 hash, returns hex string. Needed for HIBP k-anonymity. */
+declare function sha1(data: string | Uint8Array): Promise<string>;
+/** Import a secret key for HMAC operations. */
+declare function importHmacKey(key: string | Uint8Array, hash?: "SHA-256" | "SHA-1"): Promise<CryptoKey>;
+/** HMAC-SHA256 sign, returns hex string. */
+declare function hmacSha256(key: string | Uint8Array, data: string | Uint8Array): Promise<string>;
+/** HMAC-SHA256 sign, returns Uint8Array. */
+declare function hmacSha256Raw(key: string | Uint8Array, data: string | Uint8Array): Promise<Uint8Array>;
+/** HMAC-SHA1 sign, returns Uint8Array (needed for TOTP per RFC 6238). */
+declare function hmacSha1Raw(key: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
+/**
+ * Hash a password using PBKDF2-SHA256.
+ *
+ * Returns a string in the format: `pbkdf2:iterations:salt_hex:hash_hex`
+ * which is safe to store in the database.
+ */
+declare function pbkdf2Hash(password: string, salt?: Uint8Array, iterations?: number): Promise<string>;
+/**
+ * Verify a password against a stored PBKDF2 hash.
+ *
+ * Supports the `pbkdf2:iterations:salt:hash` format produced by `pbkdf2Hash`.
+ */
+declare function pbkdf2Verify(password: string, stored: string): Promise<boolean>;
+/**
+ * Constant-time comparison of two Uint8Arrays.
+ * Returns false immediately if lengths differ (length is not secret).
+ */
+declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
+
 /**
  * Create all KavachOS tables if they do not already exist.
  *
@@ -660,6 +715,63 @@ declare function createKavach(config: KavachConfig): Promise<{
      * ```
      */
     username: UsernameAuthModule | null;
+    /**
+     * Password reset (forgot password + reset password).
+     *
+     * Null when `passwordReset` config was not provided or `auth.session`
+     * is not configured.
+     *
+     * @example
+     * ```typescript
+     * // In your route handler
+     * const response = await kavach.passwordReset?.handleRequest(request);
+     * if (response) return response;
+     *
+     * // Or programmatically
+     * await kavach.passwordReset?.requestReset('alice@example.com');
+     * await kavach.passwordReset?.resetPassword(token, 'new-password');
+     * ```
+     */
+    passwordReset: PasswordResetModule | null;
+    /**
+     * Email address verification.
+     *
+     * Null when `emailVerification` config was not provided.
+     *
+     * @example
+     * ```typescript
+     * // Send a verification email after sign-up
+     * await kavach.emailVerification?.sendVerification(userId, email);
+     *
+     * // Confirm from the link in the email
+     * const result = await kavach.emailVerification?.verify(token);
+     *
+     * // Check status
+     * const verified = await kavach.emailVerification?.isVerified(userId);
+     * ```
+     */
+    emailVerification: EmailVerificationModule | null;
+    /**
+     * One-time tokens (email verify, password reset, invitations, custom).
+     *
+     * Always available. Used internally by password reset but exposed for
+     * custom flows (email verification, invitation links, etc.).
+     */
+    oneTimeTokens: OneTimeTokenModule;
+    /**
+     * Session freshness enforcement for sensitive operations.
+     *
+     * Use as middleware before password changes, passkey registration,
+     * billing updates, or any action that requires a recently-authenticated
+     * session rather than an auto-refreshed one.
+     *
+     * @example
+     * ```typescript
+     * const stale = kavach.sessionFreshness.guard(session);
+     * if (stale) return stale; // 403 SESSION_NOT_FRESH
+     * ```
+     */
+    sessionFreshness: SessionFreshnessModule;
     /**
      * Phone number (SMS OTP) authentication.
      *
@@ -696,6 +808,27 @@ declare function createKavach(config: KavachConfig): Promise<{
      * ```
      */
     webhooks: WebhookModule$1 | null;
+    /**
+     * Redirect chain manager.
+     *
+     * Capture the user's original destination before auth redirects, push
+     * intermediate steps (onboarding, email verification), and pop them
+     * back in order. Cookie-based, works across page transitions and tabs.
+     *
+     * @example
+     * ```typescript
+     * // In auth middleware — save where the user was going
+     * const setCookie = kavach.redirects.capture(request);
+     * return new Response(null, { status: 302, headers: { Location: '/sign-in', 'Set-Cookie': setCookie } });
+     *
+     * // After sign-in — send user to their original destination
+     * const { url, clearCookie } = kavach.redirects.pop(request);
+     * const headers: Record<string, string> = { Location: url };
+     * if (clearCookie) headers['Set-Cookie'] = clearCookie;
+     * return new Response(null, { status: 302, headers });
+     * ```
+     */
+    redirects: RedirectChainManager;
     /**
      * Plugin system.
      *
@@ -1348,4 +1481,4 @@ declare function createWebhookModule(config: WebhookConfig): WebhookModule;
  */
 declare function verifyWebhookSignature(secret: string, rawBody: string, signature: string): Promise<boolean>;
 
-export { AdminModule, AgentDid, AgentFilter, AgentIdentity, ApiKeyManagerModule, ApprovalRequest, AuditEntry, AuditExportOptions, AuditFilter, AuthorizeRequest, AuthorizeResult, type BudgetLimits, type BudgetPolicy, type BudgetUsage, CaptchaModule, type CookieOptions, type CookieSessionConfig, type CookieSessionManager, CreateAgentInput, type CreatePolicyInput, type CreateSessionResult, type CreateTenantInput, type CsrfValidationResult, Database, DelegateInput, DelegationChain, DidDocument, DidKeyPair, type DidModule, DidWebConfig, EmailOtpModule, type EmailTemplate, type EmailTemplateConfig, type EmailTemplateName, type EmailTemplates, EndpointContext, type I18nConfig, type I18nModule, type Kavach, KavachConfig, KavachPlugin, MagicLinkModule, McpServer, McpServerInput, type MultiSessionConfig, MultiSessionLimitError, type MultiSessionModule, OrgModule, PasskeyModule, Permission, PhoneAuthModule, PluginEndpoint, type PluginRegistry, type PolicyFilters, type PrivilegeAnalysis, type PrivilegeAnalyzer, type PrivilegeFinding, type PrivilegeSummary, ResolvedUser, type SameSite, Session, SessionConfig, type SessionInfo, SessionManager, SignedPayload, SsoModule, type Tenant, type TenantSettings, TotpModule, type TranslationKeys, type TrustConfig, type TrustModule, type TrustScore, UpdateAgentInput, UsernameAuthModule, type ValidateSessionResult, VerificationResult, type WebhookConfig, type WebhookEvent, type WebhookModule, type WebhookSubscription, buildDidDocument, buildSessionMetadata, createCookieSessionManager, createDelegationModule, createDidModule, createEmailTemplates, createI18n, createKavach, createMultiSessionModule, createPluginRouter, createPolicyModule, createPresentation, createPrivilegeAnalyzer, createTables, createTenantModule, createTrustModule, createWebhookModule, de, en, es, fr, generateCsrfToken, generateDidKey, generateDidWeb, generateOpenAPISpec, getCookie, getDidWebUrl, initializePlugins, ja, parseCookies, parseCookiesFromRequest, resolveDidKey, resolveDidWeb, serializeCookie, serializeCookieDeletion, signPayload, validateCsrfToken, validateOrigin, verifyPayload, verifyPresentation, verifyWebhookSignature, zh };
+export { AdminModule, AgentDid, AgentFilter, AgentIdentity, ApiKeyManagerModule, ApprovalRequest, AuditEntry, AuditExportOptions, AuditFilter, AuthorizeRequest, AuthorizeResult, type BudgetLimits, type BudgetPolicy, type BudgetUsage, CaptchaModule, type CookieOptions, type CookieSessionConfig, type CookieSessionManager, CreateAgentInput, type CreatePolicyInput, type CreateSessionResult, type CreateTenantInput, type CsrfValidationResult, Database, DatabaseConfig, DelegateInput, DelegationChain, DidDocument, DidKeyPair, type DidModule, DidWebConfig, EmailOtpModule, type EmailTemplate, type EmailTemplateConfig, type EmailTemplateName, type EmailTemplates, EmailVerificationModule, EndpointContext, type I18nConfig, type I18nModule, type Kavach, KavachConfig, KavachPlugin, MagicLinkModule, McpServer, McpServerInput, type MultiSessionConfig, MultiSessionLimitError, type MultiSessionModule, OneTimeTokenModule, OrgModule, PasskeyModule, PasswordResetModule, Permission, PhoneAuthModule, PluginEndpoint, type PluginRegistry, type PolicyFilters, type PrivilegeAnalysis, type PrivilegeAnalyzer, type PrivilegeFinding, type PrivilegeSummary, RedirectChainManager, ResolvedUser, type SameSite, Session, SessionConfig, SessionFreshnessModule, type SessionInfo, SessionManager, SignedPayload, SsoModule, type Tenant, type TenantSettings, TotpModule, type TranslationKeys, type TrustConfig, type TrustModule, type TrustScore, UpdateAgentInput, UsernameAuthModule, type ValidateSessionResult, VerificationResult, type WebhookConfig, type WebhookEvent, type WebhookModule, type WebhookSubscription, buildDidDocument, buildSessionMetadata, constantTimeEqual, createCookieSessionManager, createDelegationModule, createDidModule, createEmailTemplates, createI18n, createKavach, createMultiSessionModule, createPluginRouter, createPolicyModule, createPresentation, createPrivilegeAnalyzer, createTables, createTenantModule, createTrustModule, createWebhookModule, de, en, es, fr, fromBase64Url, fromHex, generateCsrfToken, generateDidKey, generateDidWeb, generateId, generateOpenAPISpec, getCookie, getDidWebUrl, hmacSha1Raw, hmacSha256, hmacSha256Raw, importHmacKey, initializePlugins, ja, parseCookies, parseCookiesFromRequest, pbkdf2Hash, pbkdf2Verify, randomBytes, randomBytesHex, resolveDidKey, resolveDidWeb, serializeCookie, serializeCookieDeletion, sha1, sha256, sha256Raw, signPayload, toBase64Url, toHex, validateCsrfToken, validateOrigin, verifyPayload, verifyPresentation, verifyWebhookSignature, zh };