@spfn/auth 0.2.0-beta.86 → 0.2.0-beta.87

package/dist/server.js

@@ -1379,7 +1379,7 @@ var init_boolean2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/bigint/bigint.mjs
-function BigInt(options) {
+function BigInt2(options) {
   return CreateType({ [Kind]: "BigInt", type: "bigint" }, options);
 }
 var init_bigint = __esm({
@@ -1441,7 +1441,7 @@ var init_string2 = __esm({
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.41/node_modules/@sinclair/typebox/build/esm/type/template-literal/syntax.mjs
 function* FromUnion(syntax) {
   const trim = syntax.trim().replace(/"|'/g, "");
-  return trim === "boolean" ? yield Boolean2() : trim === "number" ? yield Number2() : trim === "bigint" ? yield BigInt() : trim === "string" ? yield String2() : yield (() => {
+  return trim === "boolean" ? yield Boolean2() : trim === "number" ? yield Number2() : trim === "bigint" ? yield BigInt2() : trim === "string" ? yield String2() : yield (() => {
     const literals = trim.split("|").map((literal) => Literal(literal.trim()));
     return literals.length === 0 ? Never() : literals.length === 1 ? literals[0] : UnionEvaluated(literals);
   })();
@@ -2457,7 +2457,7 @@ function ConditionalReadonly(T, root) {
   return root === true ? T : Readonly(T);
 }
 function FromValue(value, root) {
-  return IsAsyncIterator(value) ? ConditionalReadonly(Any(), root) : IsIterator(value) ? ConditionalReadonly(Any(), root) : IsArray(value) ? Readonly(Tuple(FromArray3(value))) : IsUint8Array(value) ? Uint8Array2() : IsDate(value) ? Date2() : IsObject(value) ? ConditionalReadonly(Object2(FromProperties7(value)), root) : IsFunction(value) ? ConditionalReadonly(Function([], Unknown()), root) : IsUndefined(value) ? Undefined() : IsNull(value) ? Null() : IsSymbol(value) ? Symbol2() : IsBigInt(value) ? BigInt() : IsNumber(value) ? Literal(value) : IsBoolean(value) ? Literal(value) : IsString(value) ? Literal(value) : Object2({});
+  return IsAsyncIterator(value) ? ConditionalReadonly(Any(), root) : IsIterator(value) ? ConditionalReadonly(Any(), root) : IsArray(value) ? Readonly(Tuple(FromArray3(value))) : IsUint8Array(value) ? Uint8Array2() : IsDate(value) ? Date2() : IsObject(value) ? ConditionalReadonly(Object2(FromProperties7(value)), root) : IsFunction(value) ? ConditionalReadonly(Function([], Unknown()), root) : IsUndefined(value) ? Undefined() : IsNull(value) ? Null() : IsSymbol(value) ? Symbol2() : IsBigInt(value) ? BigInt2() : IsNumber(value) ? Literal(value) : IsBoolean(value) ? Literal(value) : IsString(value) ? Literal(value) : Object2({});
 }
 function Const(T, options) {
   return CreateType(FromValue(T, true), options);
@@ -4243,7 +4243,7 @@ __export(type_exports3, {
   Array: () => Array2,
   AsyncIterator: () => AsyncIterator,
   Awaited: () => Awaited,
-  BigInt: () => BigInt,
+  BigInt: () => BigInt2,
   Boolean: () => Boolean2,
   Capitalize: () => Capitalize,
   Composite: () => Composite,
@@ -5802,6 +5802,17 @@ var init_keys_repository = __esm({
         ).returning();
         return result[0] ?? null;
       }
+      /**
+       * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
+       *
+       * 폐기(isActive=false)·만료(expiresAt 경과)를 SESSION_REVOKED로, 미등록을
+       * PROOF_INVALID로 구분해야 하므로 활성 필터 없이 조회한다. keyId는 UNIQUE.
+       * Read replica 사용
+       */
+      async findByKeyId(keyId) {
+        const result = await this.readDb.select().from(userPublicKeys).where(eq2(userPublicKeys.keyId, keyId)).limit(1);
+        return result[0] ?? null;
+      }
       /**
        * Key ID로 활성 공개키 조회 (authenticate용)
        * Read replica 사용
@@ -8158,12 +8169,15 @@ async function verifyCodeService(params) {
   };
 }
 
+// src/server/lib/key-policy.ts
+var KEY_TTL_DAYS = 90;
+
 // src/server/services/key.service.ts
 init_repositories();
 import { InvalidKeyFingerprintError } from "@spfn/auth/errors";
 function getKeyExpiryDate() {
   const expiresAt = /* @__PURE__ */ new Date();
-  expiresAt.setDate(expiresAt.getDate() + 90);
+  expiresAt.setDate(expiresAt.getDate() + KEY_TTL_DAYS);
   return expiresAt;
 }
 async function registerPublicKeyService(params) {
@@ -9750,8 +9764,8 @@ function getGithubConfig() {
   };
 }
 function getGithubScopes() {
-  const configured = env3.SPFN_AUTH_GITHUB_SCOPES;
-  return configured ? configured.split(",").map((scope) => scope.trim()).filter(Boolean) : ["read:user", "user:email"];
+  const configured2 = env3.SPFN_AUTH_GITHUB_SCOPES;
+  return configured2 ? configured2.split(",").map((scope) => scope.trim()).filter(Boolean) : ["read:user", "user:email"];
 }
 async function requestGithubTokens(params) {
   const response = await fetch(GITHUB_TOKEN_URL, {
@@ -9881,8 +9895,8 @@ function getKakaoConfig() {
   };
 }
 function getKakaoScopes() {
-  const configured = env3.SPFN_AUTH_KAKAO_SCOPES;
-  return configured ? configured.split(",").map((scope) => scope.trim()).filter(Boolean) : ["account_email"];
+  const configured2 = env3.SPFN_AUTH_KAKAO_SCOPES;
+  return configured2 ? configured2.split(",").map((scope) => scope.trim()).filter(Boolean) : ["account_email"];
 }
 async function requestKakaoTokens(params) {
   const response = await fetch(KAKAO_TOKEN_URL, {
@@ -10685,33 +10699,831 @@ import { EMAIL_PATTERN as EMAIL_PATTERN2, UUID_PATTERN } from "@spfn/auth";
 
 // src/server/middleware/authenticate.ts
 import { defineMiddleware } from "@spfn/core/route";
-import { UnauthorizedError } from "@spfn/core/errors";
-import { verifyClientToken as verifyClientToken2, decodeToken as decodeToken2, authLogger as authLogger2, keysRepository as keysRepository2, usersRepository as usersRepository2, userProfilesRepository as userProfilesRepository2, getPendingDeletionInfo as getPendingDeletionInfo2 } from "@spfn/auth/server";
+import { UnauthorizedError as UnauthorizedError2 } from "@spfn/core/errors";
+import { verifyClientToken as verifyClientToken2, decodeToken as decodeToken2, authLogger as authLogger3, keysRepository as keysRepository3, usersRepository as usersRepository3, userProfilesRepository as userProfilesRepository3 } from "@spfn/auth/server";
 import {
   InvalidTokenError,
   TokenExpiredError,
-  KeyExpiredError,
-  AccountDisabledError as AccountDisabledError3,
-  AccountPendingDeletionError as AccountPendingDeletionError3
+  KeyExpiredError
 } from "@spfn/auth/errors";
+
+// src/server/middleware/auth-profiles.ts
+import {
+  BadRequestError as BadRequestError2,
+  ConflictError as ConflictError2,
+  ServiceUnavailableError,
+  UnauthorizedError
+} from "@spfn/core/errors";
+import {
+  authLogger as authLogger2,
+  keysRepository as keysRepository2,
+  usersRepository as usersRepository2,
+  userProfilesRepository as userProfilesRepository2,
+  getPendingDeletionInfo as getPendingDeletionInfo2
+} from "@spfn/auth/server";
+import { AccountDisabledError as AccountDisabledError3, AccountPendingDeletionError as AccountPendingDeletionError3 } from "@spfn/auth/errors";
+
+// src/server/client-proof/canonical-json.ts
+var CanonicalJsonError = class extends Error {
+  constructor(code) {
+    super(`canonical JSON: ${code}`);
+    this.code = code;
+    this.name = "CanonicalJsonError";
+  }
+};
+var INT64_MIN = -(2n ** 63n);
+var INT64_MAX = 2n ** 63n - 1n;
+function parseCanonicalJson(bytes) {
+  let text12;
+  try {
+    text12 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new CanonicalJsonError("INVALID_UTF8");
+  }
+  const parser = new Parser(text12);
+  const value = parser.parseValue();
+  parser.skipWhitespace();
+  if (!parser.atEnd()) {
+    throw new CanonicalJsonError("TRAILING_CONTENT");
+  }
+  return value;
+}
+function isCanonicalBytes(bytes, value) {
+  const encoded = encodeCanonicalJson(value);
+  if (encoded.length !== bytes.length) {
+    return false;
+  }
+  for (let i = 0; i < encoded.length; i++) {
+    if (encoded[i] !== bytes[i]) {
+      return false;
+    }
+  }
+  return true;
+}
+var Parser = class {
+  constructor(text12) {
+    this.text = text12;
+  }
+  pos = 0;
+  atEnd() {
+    return this.pos >= this.text.length;
+  }
+  skipWhitespace() {
+    while (!this.atEnd()) {
+      const c = this.text[this.pos];
+      if (c === " " || c === "	" || c === "\n" || c === "\r") {
+        this.pos++;
+        continue;
+      }
+      break;
+    }
+  }
+  parseValue() {
+    this.skipWhitespace();
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const c = this.text[this.pos];
+    if (c === "{") {
+      return this.parseObject();
+    }
+    if (c === "[") {
+      return this.parseArray();
+    }
+    if (c === '"') {
+      return this.parseString();
+    }
+    if (c === "-" || c >= "0" && c <= "9") {
+      return this.parseNumber();
+    }
+    if (this.text.startsWith("null", this.pos)) {
+      this.pos += 4;
+      return null;
+    }
+    if (this.text.startsWith("true", this.pos)) {
+      this.pos += 4;
+      return true;
+    }
+    if (this.text.startsWith("false", this.pos)) {
+      this.pos += 5;
+      return false;
+    }
+    throw new CanonicalJsonError("INVALID_TOKEN");
+  }
+  parseObject() {
+    this.pos++;
+    const members = /* @__PURE__ */ new Map();
+    this.skipWhitespace();
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    if (this.text[this.pos] === "}") {
+      this.pos++;
+      return members;
+    }
+    for (; ; ) {
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      if (this.text[this.pos] !== '"') {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      const key = this.parseString();
+      if (members.has(key)) {
+        throw new CanonicalJsonError("DUPLICATE_KEY");
+      }
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      if (this.text[this.pos] !== ":") {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      this.pos++;
+      members.set(key, this.parseValue());
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      const next = this.text[this.pos];
+      if (next === ",") {
+        this.pos++;
+        continue;
+      }
+      if (next === "}") {
+        this.pos++;
+        return members;
+      }
+      throw new CanonicalJsonError("INVALID_TOKEN");
+    }
+  }
+  parseArray() {
+    this.pos++;
+    const items = [];
+    this.skipWhitespace();
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    if (this.text[this.pos] === "]") {
+      this.pos++;
+      return items;
+    }
+    for (; ; ) {
+      items.push(this.parseValue());
+      this.skipWhitespace();
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      const next = this.text[this.pos];
+      if (next === ",") {
+        this.pos++;
+        continue;
+      }
+      if (next === "]") {
+        this.pos++;
+        return items;
+      }
+      throw new CanonicalJsonError("INVALID_TOKEN");
+    }
+  }
+  parseString() {
+    this.pos++;
+    let out = "";
+    for (; ; ) {
+      if (this.atEnd()) {
+        throw new CanonicalJsonError("UNEXPECTED_END");
+      }
+      const c = this.text[this.pos];
+      const code = this.text.charCodeAt(this.pos);
+      if (c === '"') {
+        this.pos++;
+        return out;
+      }
+      if (c === "\\") {
+        out += this.parseEscape();
+        continue;
+      }
+      if (code < 32) {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      out += c;
+      this.pos++;
+    }
+  }
+  parseEscape() {
+    this.pos++;
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const c = this.text[this.pos];
+    this.pos++;
+    switch (c) {
+      case '"':
+        return '"';
+      case "\\":
+        return "\\";
+      case "/":
+        return "/";
+      case "b":
+        return "\b";
+      case "f":
+        return "\f";
+      case "n":
+        return "\n";
+      case "r":
+        return "\r";
+      case "t":
+        return "	";
+      case "u":
+        return this.parseUnicodeEscape();
+      default:
+        throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+  }
+  parseUnicodeEscape() {
+    const high = this.readHex4();
+    if (high >= 56320 && high <= 57343) {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    if (high < 55296 || high > 56319) {
+      return String.fromCharCode(high);
+    }
+    if (this.text[this.pos] !== "\\" || this.text[this.pos + 1] !== "u") {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    this.pos += 2;
+    const low = this.readHex4();
+    if (low < 56320 || low > 57343) {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    return String.fromCharCode(high, low);
+  }
+  readHex4() {
+    if (this.pos + 4 > this.text.length) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const hex = this.text.slice(this.pos, this.pos + 4);
+    if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+      throw new CanonicalJsonError("INVALID_ESCAPE");
+    }
+    this.pos += 4;
+    return parseInt(hex, 16);
+  }
+  parseNumber() {
+    const start = this.pos;
+    if (this.text[this.pos] === "-") {
+      this.pos++;
+    }
+    if (this.atEnd()) {
+      throw new CanonicalJsonError("UNEXPECTED_END");
+    }
+    const first = this.text[this.pos];
+    if (first < "0" || first > "9") {
+      throw new CanonicalJsonError("INVALID_TOKEN");
+    }
+    if (first === "0") {
+      this.pos++;
+    } else {
+      while (!this.atEnd() && this.text[this.pos] >= "0" && this.text[this.pos] <= "9") {
+        this.pos++;
+      }
+    }
+    if (!this.atEnd()) {
+      const next = this.text[this.pos];
+      if (next >= "0" && next <= "9") {
+        throw new CanonicalJsonError("INVALID_TOKEN");
+      }
+      if (next === "." || next === "e" || next === "E") {
+        throw new CanonicalJsonError("NON_INTEGER_NUMBER");
+      }
+    }
+    const value = BigInt(this.text.slice(start, this.pos));
+    if (value < INT64_MIN || value > INT64_MAX) {
+      throw new CanonicalJsonError("INTEGER_OUT_OF_RANGE");
+    }
+    return value;
+  }
+};
+function encodeCanonicalJson(value) {
+  return new TextEncoder().encode(encodeToString(value));
+}
+function encodeToString(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  if (typeof value === "string") {
+    return encodeString(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(encodeToString).join(",")}]`;
+  }
+  const keys = [...value.keys()].sort(compareByCodePoints);
+  const members = keys.map((key) => `${encodeString(key)}:${encodeToString(value.get(key))}`);
+  return `{${members.join(",")}}`;
+}
+function compareByCodePoints(a, b) {
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    const ca = a.codePointAt(i);
+    const cb = b.codePointAt(j);
+    if (ca !== cb) {
+      return ca - cb;
+    }
+    i += ca > 65535 ? 2 : 1;
+    j += cb > 65535 ? 2 : 1;
+  }
+  return a.length - i - (b.length - j);
+}
+function encodeString(value) {
+  let out = '"';
+  for (const ch of value) {
+    const code = ch.codePointAt(0);
+    if (ch === '"') {
+      out += '\\"';
+    } else if (ch === "\\") {
+      out += "\\\\";
+    } else if (code === 8) {
+      out += "\\b";
+    } else if (code === 12) {
+      out += "\\f";
+    } else if (code === 10) {
+      out += "\\n";
+    } else if (code === 13) {
+      out += "\\r";
+    } else if (code === 9) {
+      out += "\\t";
+    } else if (code < 32) {
+      out += `\\u00${code.toString(16).padStart(2, "0")}`;
+    } else {
+      out += ch;
+    }
+  }
+  return out + '"';
+}
+
+// src/server/client-proof/proof.ts
+import { createHash as createHash4, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
+var CLIENT_PROOF_PROFILE = "clientProofV1";
+var ABSENT_BODY_SHA256 = "0".repeat(64);
+var DEFAULT_REPLAY_WINDOW_MILLIS = 3e5;
+var PROOF_INPUT_FIELDS = [
+  "profile",
+  "method",
+  "path",
+  "clientId",
+  "keyId",
+  "nonce",
+  "issuedAtMillis",
+  "bodySha256"
+];
+var PROOF_INPUT_SEPARATOR = "\n";
+var PROOF_SIGNATURE_BYTES = 64;
+var PROOF_SIGNATURE_HEX_LENGTH = PROOF_SIGNATURE_BYTES * 2;
+var PROOF_SIGNATURE_PATTERN = /^[0-9a-f]{128}$/;
+var RAW_SIGNATURE_ENCODING = "ieee-p1363";
+var ProofInputError = class extends Error {
+  constructor() {
+    super("proof input field contains a C0 control character");
+    this.name = "ProofInputError";
+  }
+};
+function canonicalProofInput(input) {
+  const values = {
+    profile: CLIENT_PROOF_PROFILE,
+    method: input.method,
+    path: input.path,
+    clientId: input.clientId,
+    keyId: input.keyId,
+    nonce: input.nonce,
+    issuedAtMillis: input.issuedAtMillis.toString(),
+    bodySha256: input.bodySha256
+  };
+  const fields = PROOF_INPUT_FIELDS.map((name) => values[name]);
+  for (const field of fields) {
+    for (const ch of field) {
+      if (ch.codePointAt(0) < 32) {
+        throw new ProofInputError();
+      }
+    }
+  }
+  return fields.join(PROOF_INPUT_SEPARATOR);
+}
+function parseClientProofPublicKey(spkiDerBase64) {
+  const key = createPublicKey({
+    key: Buffer.from(spkiDerBase64, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+    throw new Error("a clientProofV1 public key must be an ECDSA P-256 key");
+  }
+  return key;
+}
+function verifyClientProof(input, presentedProof, publicKey) {
+  const data = Buffer.from(canonicalProofInput(input), "utf8");
+  if (!PROOF_SIGNATURE_PATTERN.test(presentedProof)) {
+    return false;
+  }
+  return verify2(
+    "sha256",
+    data,
+    { key: publicKey, dsaEncoding: RAW_SIGNATURE_ENCODING },
+    Buffer.from(presentedProof, "hex")
+  );
+}
+function sha256Hex(bytes) {
+  return createHash4("sha256").update(bytes).digest("hex");
+}
+
+// src/server/client-proof/refusal.ts
+import { randomBytes } from "crypto";
+var HTTP_STATUS = {
+  PROOF_INVALID: 401,
+  PROOF_REPLAYED: 401,
+  PROOF_EXPIRED: 401,
+  SESSION_REVOKED: 401,
+  PROFILE_REJECTED: 400,
+  CONTRACT_UNSUPPORTED: 409
+};
+var ClientProofRefusal = class _ClientProofRefusal {
+  constructor(code, message) {
+    this.code = code;
+    this.message = message;
+  }
+  get httpStatus() {
+    return HTTP_STATUS[this.code];
+  }
+  /** The canonical bytes of `{"error":{"code":…,"message":…,"requestId":…}}`. */
+  envelopeBytes(requestId) {
+    const error = /* @__PURE__ */ new Map([
+      ["code", this.code],
+      ["message", this.message],
+      ["requestId", requestId]
+    ]);
+    return encodeCanonicalJson(/* @__PURE__ */ new Map([["error", error]]));
+  }
+  /** Nothing request-derived reaches a log through this. */
+  toString() {
+    return `ClientProofRefusal(${this.code})`;
+  }
+  // ---- shape: what arrived is not the contract (rule 2) -------------------
+  static unroutable() {
+    return contractViolation("no operation in this contract answers that method and path");
+  }
+  static malformedHeaders() {
+    return contractViolation("the request does not carry the contract header fields exactly once each");
+  }
+  static missingContentType() {
+    return contractViolation("a request that carries a body must declare the contract content type");
+  }
+  static bodyTooLarge() {
+    return contractViolation("the request body exceeds the size this server accepts");
+  }
+  /**
+   * The body parsed but its bytes are not the canonical form of what it
+   * parsed to. Not PROOF_INVALID even though it is discovered next to the
+   * proof: the proof over these bytes verifies perfectly well, and an
+   * auth-family answer would tell the client to re-handshake and send the
+   * same non-canonical bytes again.
+   */
+  static bodyNotCanonical() {
+    return contractViolation("the request body is not the canonical JSON form of the value it encodes");
+  }
+  static bodyNotTheDeclaredType() {
+    return contractViolation("the request body is not the request type this operation declares");
+  }
+  static sessionHeaderMisplaced() {
+    return contractViolation("the session header is present exactly on the operations that require one");
+  }
+  static unprocessable() {
+    return contractViolation("the request could not be processed");
+  }
+  // ---- the profile allowlist ----------------------------------------------
+  static profileRejected() {
+    return new _ClientProofRefusal("PROFILE_REJECTED", "the named auth profile is not on this contract's allowlist");
+  }
+  // ---- auth: a new session might clear it (rule 1) -------------------------
+  static sessionRevoked() {
+    return new _ClientProofRefusal("SESSION_REVOKED", "the key or session was revoked");
+  }
+  static proofExpired() {
+    return new _ClientProofRefusal("PROOF_EXPIRED", "issuedAtMillis falls outside the replay window");
+  }
+  static proofReplayed() {
+    return new _ClientProofRefusal("PROOF_REPLAYED", "the nonce was already used inside the replay window");
+  }
+  static proofInvalid() {
+    return new _ClientProofRefusal("PROOF_INVALID", "the client proof did not verify");
+  }
+};
+function contractViolation(message) {
+  return new ClientProofRefusal("CONTRACT_UNSUPPORTED", message);
+}
+
+// src/server/client-proof/admission.ts
+var CLIENT_PROOF_HEADERS = {
+  profile: "x-spfn-auth-profile",
+  clientId: "x-spfn-client-id",
+  keyId: "x-spfn-key-id",
+  nonce: "x-spfn-nonce",
+  issuedAtMillis: "x-spfn-issued-at",
+  proof: "x-spfn-proof",
+  session: "x-spfn-session"
+};
+var CLIENT_PROOF_CONTENT_TYPE = "application/json";
+var INT64_MIN2 = -(2n ** 63n);
+var INT64_MAX2 = 2n ** 63n - 1n;
+function readCredentials(headers) {
+  const profile = headers.get(CLIENT_PROOF_HEADERS.profile);
+  const clientId = headers.get(CLIENT_PROOF_HEADERS.clientId);
+  const keyId = headers.get(CLIENT_PROOF_HEADERS.keyId);
+  const nonce = headers.get(CLIENT_PROOF_HEADERS.nonce);
+  const issuedAtRaw = headers.get(CLIENT_PROOF_HEADERS.issuedAtMillis);
+  const proof = headers.get(CLIENT_PROOF_HEADERS.proof);
+  if (profile === null || clientId === null || keyId === null || nonce === null || issuedAtRaw === null || proof === null) {
+    return null;
+  }
+  const issuedAtMillis = parseInt64(issuedAtRaw);
+  if (issuedAtMillis === null) {
+    return null;
+  }
+  return {
+    profile,
+    clientId,
+    keyId,
+    nonce,
+    issuedAtMillis,
+    proof,
+    sessionId: headers.get(CLIENT_PROOF_HEADERS.session)
+  };
+}
+function parseInt64(raw) {
+  if (!/^[+-]?\d{1,19}$/.test(raw)) {
+    return null;
+  }
+  const value = BigInt(raw);
+  if (value < INT64_MIN2 || value > INT64_MAX2) {
+    return null;
+  }
+  return value;
+}
+function isRequestContentType(value) {
+  if (value === null) {
+    return false;
+  }
+  return value.split(";")[0].trim().toLowerCase() === CLIENT_PROOF_CONTENT_TYPE;
+}
+
+// src/server/client-proof/replay-store.ts
+import { getCache } from "@spfn/core/cache";
+function replayLedgerKey(clientId, nonce) {
+  return JSON.stringify([clientId, nonce]);
+}
+var MemoryReplayLedger = class {
+  /** replayLedgerKey(...) → the millis it was spent at. */
+  spent = /* @__PURE__ */ new Map();
+  isSpent(clientId, nonce) {
+    return this.spent.has(replayLedgerKey(clientId, nonce));
+  }
+  /** Records the pair at `atMillis`; false when it was already spent. */
+  spend(clientId, nonce, atMillis) {
+    const key = replayLedgerKey(clientId, nonce);
+    if (this.spent.has(key)) {
+      return false;
+    }
+    this.spent.set(key, atMillis);
+    return true;
+  }
+  /** Drops entries older than the window, judged against `nowMillis`. */
+  prune(nowMillis, windowMillis) {
+    for (const [key, spentAtMillis] of this.spent) {
+      if (nowMillis - spentAtMillis > windowMillis) {
+        this.spent.delete(key);
+      }
+    }
+  }
+  get size() {
+    return this.spent.size;
+  }
+  clear() {
+    this.spent.clear();
+  }
+};
+var MemoryReplayStore = class {
+  constructor(windowMillis = DEFAULT_REPLAY_WINDOW_MILLIS) {
+    this.windowMillis = windowMillis;
+  }
+  ledger = new MemoryReplayLedger();
+  async isSpent(clientId, nonce) {
+    this.ledger.prune(Date.now(), this.windowMillis);
+    return this.ledger.isSpent(clientId, nonce);
+  }
+  async spend(clientId, nonce) {
+    const now = Date.now();
+    this.ledger.prune(now, this.windowMillis);
+    return this.ledger.spend(clientId, nonce, now);
+  }
+};
+var configured = null;
+function getClientProofReplayStore() {
+  configured ??= new MemoryReplayStore();
+  return configured;
+}
+
+// src/server/middleware/auth-profiles.ts
+function selectAuthProfile(c) {
+  const profile = c.req.header(CLIENT_PROOF_HEADERS.profile);
+  if (profile === void 0) {
+    return null;
+  }
+  if (c.req.header("Authorization") !== void 0) {
+    throw new BadRequestError2({
+      message: "an auth profile and Bearer credentials must not be mixed in one request",
+      details: { code: "PROFILE_REJECTED" }
+    });
+  }
+  const verifier = AUTH_PROFILE_VERIFIERS.get(profile);
+  if (verifier === void 0) {
+    throw refusalError(ClientProofRefusal.profileRejected());
+  }
+  return verifier;
+}
+async function resolveAuthenticatedUser(userId) {
+  const [result, locale] = await Promise.all([
+    usersRepository2.findByIdWithRole(userId),
+    userProfilesRepository2.findLocaleByUserId(userId)
+  ]);
+  if (!result) {
+    throw new UnauthorizedError({ message: "User not found" });
+  }
+  const { user, role } = result;
+  if (user.status !== "active") {
+    if (user.status === "pending_deletion") {
+      const pending = await getPendingDeletionInfo2(user.id);
+      throw new AccountPendingDeletionError3({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
+    }
+    throw new AccountDisabledError3({ status: user.status });
+  }
+  return { user, role: role?.name ?? null, locale };
+}
+function refusalError(refusal) {
+  const data = { message: refusal.message, details: { code: refusal.code } };
+  if (refusal.code === "PROFILE_REJECTED") {
+    return new BadRequestError2(data);
+  }
+  if (refusal.code === "CONTRACT_UNSUPPORTED") {
+    return new ConflictError2(data);
+  }
+  return new UnauthorizedError(data);
+}
+async function failClosed(operation) {
+  try {
+    return await operation();
+  } catch (err) {
+    authLogger2.middleware.error("client-proof replay store unavailable \u2014 refusing (fail-closed)", err);
+    throw new ServiceUnavailableError({ message: "Authentication is temporarily unavailable" });
+  }
+}
+async function verifyClientProofProfile(c) {
+  const headers = c.req.raw.headers;
+  const credentials = readCredentials(headers);
+  if (credentials === null) {
+    throw refusalError(ClientProofRefusal.malformedHeaders());
+  }
+  if (credentials.profile !== CLIENT_PROOF_PROFILE) {
+    throw refusalError(ClientProofRefusal.profileRejected());
+  }
+  if (credentials.sessionId !== null) {
+    throw refusalError(ClientProofRefusal.sessionHeaderMisplaced());
+  }
+  const body = new Uint8Array(await c.req.arrayBuffer());
+  const proofInput = {
+    method: c.req.method,
+    path: c.req.path,
+    clientId: credentials.clientId,
+    keyId: credentials.keyId,
+    nonce: credentials.nonce,
+    issuedAtMillis: credentials.issuedAtMillis,
+    bodySha256: admitBodySha256(headers, body)
+  };
+  const keyRecord = await keysRepository2.findByKeyId(credentials.keyId);
+  if (keyRecord !== null) {
+    if (!keyRecord.isActive) {
+      throw refusalError(ClientProofRefusal.sessionRevoked());
+    }
+    if (keyRecord.expiresAt && /* @__PURE__ */ new Date() > keyRecord.expiresAt) {
+      throw refusalError(ClientProofRefusal.sessionRevoked());
+    }
+  }
+  const age = Date.now() - Number(credentials.issuedAtMillis);
+  if (age < 0 || age > DEFAULT_REPLAY_WINDOW_MILLIS) {
+    throw refusalError(ClientProofRefusal.proofExpired());
+  }
+  const replayStore = getClientProofReplayStore();
+  if (await failClosed(() => replayStore.isSpent(credentials.clientId, credentials.nonce))) {
+    throw refusalError(ClientProofRefusal.proofReplayed());
+  }
+  if (keyRecord === null) {
+    throw refusalError(ClientProofRefusal.proofInvalid());
+  }
+  if (credentials.clientId !== String(keyRecord.userId)) {
+    throw refusalError(ClientProofRefusal.proofInvalid());
+  }
+  verifyProofOrThrow(proofInput, credentials, keyRecord.publicKey);
+  if (!await failClosed(() => replayStore.spend(credentials.clientId, credentials.nonce))) {
+    throw refusalError(ClientProofRefusal.proofReplayed());
+  }
+  const { user, role, locale } = await resolveAuthenticatedUser(keyRecord.userId);
+  keysRepository2.updateLastUsedById(keyRecord.id).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
+  authLogger2.middleware.info("API access", {
+    userId: user.id,
+    email: user.email,
+    keyId: credentials.keyId,
+    scheme: CLIENT_PROOF_PROFILE,
+    method: c.req.method,
+    path: c.req.path,
+    ip: c.req.header("x-forwarded-for") || c.req.header("x-real-ip"),
+    userAgent: c.req.header("user-agent")
+  });
+  return {
+    user,
+    userId: String(user.id),
+    keyId: credentials.keyId,
+    role,
+    locale,
+    scheme: "clientProofV1"
+  };
+}
+function admitBodySha256(headers, body) {
+  if (body.length === 0) {
+    return ABSENT_BODY_SHA256;
+  }
+  if (!isRequestContentType(headers.get("content-type"))) {
+    throw refusalError(ClientProofRefusal.missingContentType());
+  }
+  let value;
+  try {
+    value = parseCanonicalJson(body);
+  } catch {
+    throw refusalError(ClientProofRefusal.bodyNotCanonical());
+  }
+  if (!isCanonicalBytes(body, value)) {
+    throw refusalError(ClientProofRefusal.bodyNotCanonical());
+  }
+  return sha256Hex(body);
+}
+function verifyProofOrThrow(proofInput, credentials, publicKeySpkiDerBase64) {
+  let verified;
+  try {
+    const publicKey = parseClientProofPublicKey(publicKeySpkiDerBase64);
+    verified = verifyClientProof(proofInput, credentials.proof, publicKey);
+  } catch (err) {
+    if (err instanceof ProofInputError) {
+      throw refusalError(ClientProofRefusal.unprocessable());
+    }
+    throw refusalError(ClientProofRefusal.proofInvalid());
+  }
+  if (!verified) {
+    throw refusalError(ClientProofRefusal.proofInvalid());
+  }
+}
+var AUTH_PROFILE_VERIFIERS = /* @__PURE__ */ new Map([
+  [CLIENT_PROOF_PROFILE, { verify: verifyClientProofProfile }]
+]);
+
+// src/server/middleware/authenticate.ts
 var authenticate = defineMiddleware("auth", async (c, next) => {
+  const profileVerifier = selectAuthProfile(c);
+  if (profileVerifier !== null) {
+    c.set("auth", await profileVerifier.verify(c));
+    await next();
+    return;
+  }
   const authHeader = c.req.header("Authorization");
   if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    authLogger2.middleware.error("Missing or invalid authorization header. If using Next.js API routes, ensure you have imported '@spfn/auth/nextjs/api' in your API route handler (e.g., src/app/api/actions/[[...path]]/route.ts) to enable automatic authentication header forwarding from client to backend.", {
+    authLogger3.middleware.error("Missing or invalid authorization header. If using Next.js API routes, ensure you have imported '@spfn/auth/nextjs/api' in your API route handler (e.g., src/app/api/actions/[[...path]]/route.ts) to enable automatic authentication header forwarding from client to backend.", {
       headers: c.req.header(),
       path: c.req.path
     });
-    throw new UnauthorizedError({ message: "Authentication header missing or invalid: Bearer {token}" });
+    throw new UnauthorizedError2({ message: "Authentication header missing or invalid: Bearer {token}" });
   }
   const token = authHeader.substring(7);
   const decoded = decodeToken2(token);
   if (!decoded || !decoded.keyId) {
-    throw new UnauthorizedError({ message: "Invalid token: missing keyId" });
+    throw new UnauthorizedError2({ message: "Invalid token: missing keyId" });
   }
   const keyId = decoded.keyId;
-  const keyRecord = await keysRepository2.findActiveByKeyId(keyId);
+  const keyRecord = await keysRepository3.findActiveByKeyId(keyId);
   if (!keyRecord) {
-    throw new UnauthorizedError({ message: "Invalid or revoked key" });
+    throw new UnauthorizedError2({ message: "Invalid or revoked key" });
   }
   if (keyRecord.expiresAt && /* @__PURE__ */ new Date() > keyRecord.expiresAt) {
     throw new KeyExpiredError();
@@ -10732,34 +11544,21 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
         throw new InvalidTokenError({ message: "Invalid token signature" });
       }
     }
-    throw new UnauthorizedError({ message: "Authentication failed" });
-  }
-  const [result, locale] = await Promise.all([
-    usersRepository2.findByIdWithRole(keyRecord.userId),
-    userProfilesRepository2.findLocaleByUserId(keyRecord.userId)
-  ]);
-  if (!result) {
-    throw new UnauthorizedError({ message: "User not found" });
-  }
-  const { user, role } = result;
-  if (user.status !== "active") {
-    if (user.status === "pending_deletion") {
-      const pending = await getPendingDeletionInfo2(user.id);
-      throw new AccountPendingDeletionError3({ purgeScheduledAt: pending?.purgeScheduledAt.toISOString() });
-    }
-    throw new AccountDisabledError3({ status: user.status });
+    throw new UnauthorizedError2({ message: "Authentication failed" });
   }
-  keysRepository2.updateLastUsedById(keyRecord.id).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
+  const { user, role, locale } = await resolveAuthenticatedUser(keyRecord.userId);
+  keysRepository3.updateLastUsedById(keyRecord.id).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
   c.set("auth", {
     user,
     userId: String(user.id),
     keyId,
-    role: role?.name ?? null,
-    locale
+    role,
+    locale,
+    scheme: "bearer"
   });
   const method = c.req.method;
   const path = c.req.path;
-  authLogger2.middleware.info("API access", {
+  authLogger3.middleware.info("API access", {
     userId: user.id,
     email: user.email,
     keyId,
@@ -10771,6 +11570,12 @@ var authenticate = defineMiddleware("auth", async (c, next) => {
   await next();
 });
 var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
+  const profileVerifier = selectAuthProfile(c);
+  if (profileVerifier !== null) {
+    c.set("auth", await profileVerifier.verify(c));
+    await next();
+    return;
+  }
   const authHeader = c.req.header("Authorization");
   if (!authHeader || !authHeader.startsWith("Bearer ")) {
     await next();
@@ -10784,7 +11589,7 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
       return;
     }
     const keyId = decoded.keyId;
-    const keyRecord = await keysRepository2.findActiveByKeyId(keyId);
+    const keyRecord = await keysRepository3.findActiveByKeyId(keyId);
     if (!keyRecord) {
       await next();
       return;
@@ -10799,21 +11604,22 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
       keyRecord.algorithm
     );
     const [result, locale] = await Promise.all([
-      usersRepository2.findByIdWithRole(keyRecord.userId),
-      userProfilesRepository2.findLocaleByUserId(keyRecord.userId)
+      usersRepository3.findByIdWithRole(keyRecord.userId),
+      userProfilesRepository3.findLocaleByUserId(keyRecord.userId)
     ]);
     if (!result || result.user.status !== "active") {
       await next();
       return;
     }
     const { user, role } = result;
-    keysRepository2.updateLastUsedById(keyRecord.id).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
+    keysRepository3.updateLastUsedById(keyRecord.id).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
     c.set("auth", {
       user,
       userId: String(user.id),
       keyId,
       role: role?.name ?? null,
-      locale
+      locale,
+      scheme: "bearer"
     });
   } catch {
   }
@@ -10824,13 +11630,13 @@ var optionalAuth = defineMiddleware("optionalAuth", async (c, next) => {
 import { defineMiddleware as defineMiddleware2 } from "@spfn/core/route";
 import { ForbiddenError as ForbiddenError2 } from "@spfn/core/errors";
 import { InsufficientPermissionsError } from "@spfn/auth/errors";
-import { getAuth as getAuth2, hasAllPermissions as hasAllPermissions2, hasAnyPermission as hasAnyPermission2, authLogger as authLogger3 } from "@spfn/auth/server";
+import { getAuth as getAuth2, hasAllPermissions as hasAllPermissions2, hasAnyPermission as hasAnyPermission2, authLogger as authLogger4 } from "@spfn/auth/server";
 var requirePermissions = defineMiddleware2(
   "permission",
   (...permissionNames) => async (c, next) => {
     const auth = getAuth2(c);
     if (!auth) {
-      authLogger3.middleware.warn("Permission check failed: not authenticated", {
+      authLogger4.middleware.warn("Permission check failed: not authenticated", {
         permissions: permissionNames,
         path: c.req.path
       });
@@ -10839,14 +11645,14 @@ var requirePermissions = defineMiddleware2(
     const { userId } = auth;
     const allowed = await hasAllPermissions2(userId, permissionNames);
     if (!allowed) {
-      authLogger3.middleware.warn("Permission check failed", {
+      authLogger4.middleware.warn("Permission check failed", {
         userId,
         requiredPermissions: permissionNames,
         path: c.req.path
       });
       throw new InsufficientPermissionsError({ requiredPermissions: permissionNames });
     }
-    authLogger3.middleware.debug("Permission check passed", {
+    authLogger4.middleware.debug("Permission check passed", {
       userId,
       permissions: permissionNames
     });
@@ -10858,7 +11664,7 @@ var requireAnyPermission = defineMiddleware2(
   (...permissionNames) => async (c, next) => {
     const auth = getAuth2(c);
     if (!auth) {
-      authLogger3.middleware.warn("Any permission check failed: not authenticated", {
+      authLogger4.middleware.warn("Any permission check failed: not authenticated", {
         permissions: permissionNames,
         path: c.req.path
       });
@@ -10867,14 +11673,14 @@ var requireAnyPermission = defineMiddleware2(
     const { userId } = auth;
     const allowed = await hasAnyPermission2(userId, permissionNames);
     if (!allowed) {
-      authLogger3.middleware.warn("Any permission check failed", {
+      authLogger4.middleware.warn("Any permission check failed", {
         userId,
         requiredAnyOf: permissionNames,
         path: c.req.path
       });
       throw new InsufficientPermissionsError({ requiredPermissions: permissionNames });
     }
-    authLogger3.middleware.debug("Any permission check passed", {
+    authLogger4.middleware.debug("Any permission check passed", {
       userId,
       permissions: permissionNames
     });
@@ -10884,7 +11690,7 @@ var requireAnyPermission = defineMiddleware2(
 
 // src/server/middleware/require-role.ts
 import { defineMiddleware as defineMiddleware3 } from "@spfn/core/route";
-import { getAuth as getAuth3, authLogger as authLogger4 } from "@spfn/auth/server";
+import { getAuth as getAuth3, authLogger as authLogger5 } from "@spfn/auth/server";
 import { ForbiddenError as ForbiddenError3 } from "@spfn/core/errors";
 import { InsufficientRoleError } from "@spfn/auth/errors";
 var requireRole = defineMiddleware3(
@@ -10892,7 +11698,7 @@ var requireRole = defineMiddleware3(
   (...roleNames) => async (c, next) => {
     const auth = getAuth3(c);
     if (!auth) {
-      authLogger4.middleware.warn("Role check failed: not authenticated", {
+      authLogger5.middleware.warn("Role check failed: not authenticated", {
         roles: roleNames,
         path: c.req.path
       });
@@ -10900,7 +11706,7 @@ var requireRole = defineMiddleware3(
     }
     const { userId, role: userRole } = auth;
     if (!userRole || !roleNames.includes(userRole)) {
-      authLogger4.middleware.warn("Role check failed", {
+      authLogger5.middleware.warn("Role check failed", {
         userId,
         userRole,
         requiredRoles: roleNames,
@@ -10908,7 +11714,7 @@ var requireRole = defineMiddleware3(
       });
       throw new InsufficientRoleError({ requiredRoles: roleNames });
     }
-    authLogger4.middleware.debug("Role check passed", {
+    authLogger5.middleware.debug("Role check passed", {
       userId,
       userRole,
       roles: roleNames
@@ -10919,7 +11725,7 @@ var requireRole = defineMiddleware3(
 
 // src/server/middleware/role-guard.ts
 import { defineMiddleware as defineMiddleware4 } from "@spfn/core/route";
-import { getAuth as getAuth4, authLogger as authLogger5 } from "@spfn/auth/server";
+import { getAuth as getAuth4, authLogger as authLogger6 } from "@spfn/auth/server";
 import { ForbiddenError as ForbiddenError4 } from "@spfn/core/errors";
 import { InsufficientRoleError as InsufficientRoleError2 } from "@spfn/auth/errors";
 var roleGuard = defineMiddleware4(
@@ -10931,7 +11737,7 @@ var roleGuard = defineMiddleware4(
     }
     const auth = getAuth4(c);
     if (!auth) {
-      authLogger5.middleware.warn("Role guard failed: not authenticated", {
+      authLogger6.middleware.warn("Role guard failed: not authenticated", {
         path: c.req.path
       });
       throw new ForbiddenError4({ message: "Authentication required" });
@@ -10939,7 +11745,7 @@ var roleGuard = defineMiddleware4(
     const { userId, role: userRole } = auth;
     if (deny && deny.length > 0) {
       if (userRole && deny.includes(userRole)) {
-        authLogger5.middleware.warn("Role guard denied", {
+        authLogger6.middleware.warn("Role guard denied", {
           userId,
           userRole,
           deniedRoles: deny,
@@ -10950,7 +11756,7 @@ var roleGuard = defineMiddleware4(
     }
     if (allow && allow.length > 0) {
       if (!userRole || !allow.includes(userRole)) {
-        authLogger5.middleware.warn("Role guard failed: role not allowed", {
+        authLogger6.middleware.warn("Role guard failed: role not allowed", {
           userId,
           userRole,
           allowedRoles: allow,
@@ -10959,7 +11765,7 @@ var roleGuard = defineMiddleware4(
         throw new InsufficientRoleError2({ requiredRoles: allow });
       }
     }
-    authLogger5.middleware.debug("Role guard passed", {
+    authLogger6.middleware.debug("Role guard passed", {
       userId,
       userRole,
       allow,
@@ -10971,27 +11777,27 @@ var roleGuard = defineMiddleware4(
 
 // src/server/middleware/one-time-token-auth.ts
 import { defineMiddleware as defineMiddleware5 } from "@spfn/core/route";
-import { UnauthorizedError as UnauthorizedError2 } from "@spfn/core/errors";
-import { usersRepository as usersRepository3, userProfilesRepository as userProfilesRepository3 } from "@spfn/auth/server";
+import { UnauthorizedError as UnauthorizedError3 } from "@spfn/core/errors";
+import { usersRepository as usersRepository4, userProfilesRepository as userProfilesRepository4 } from "@spfn/auth/server";
 var oneTimeTokenAuth = defineMiddleware5("oneTimeTokenAuth", async (c, next) => {
   const token = c.req.query("token") ?? extractOTTHeader(c.req.header("Authorization"));
   if (!token) {
-    throw new UnauthorizedError2({ message: "One-time token required: ?token=xxx or Authorization: OTT xxx" });
+    throw new UnauthorizedError3({ message: "One-time token required: ?token=xxx or Authorization: OTT xxx" });
   }
   const userId = await verifyOneTimeTokenService(token);
   if (!userId) {
-    throw new UnauthorizedError2({ message: "Invalid or expired one-time token" });
+    throw new UnauthorizedError3({ message: "Invalid or expired one-time token" });
   }
   const [result, locale] = await Promise.all([
-    usersRepository3.findByIdWithRole(Number(userId)),
-    userProfilesRepository3.findLocaleByUserId(Number(userId))
+    usersRepository4.findByIdWithRole(Number(userId)),
+    userProfilesRepository4.findLocaleByUserId(Number(userId))
   ]);
   if (!result) {
-    throw new UnauthorizedError2({ message: "User not found" });
+    throw new UnauthorizedError3({ message: "User not found" });
   }
   const { user, role } = result;
   if (user.status !== "active") {
-    throw new UnauthorizedError2({ message: "Account is not active" });
+    throw new UnauthorizedError3({ message: "Account is not active" });
   }
   c.set("auth", {
     user,
@@ -10999,7 +11805,8 @@ var oneTimeTokenAuth = defineMiddleware5("oneTimeTokenAuth", async (c, next) =>
     keyId: "",
     // No key involved in OTT auth
     role: role?.name ?? null,
-    locale
+    locale,
+    scheme: "oneTimeToken"
   });
   await next();
 }, { skips: ["auth"] });
@@ -12476,6 +13283,7 @@ export {
   requirePermissions,
   requireRole,
   resendInvitation,
+  resolveAuthenticatedUser,
   revokeKeyService,
   roleGuard,
   rolePermissions,
@@ -12485,6 +13293,7 @@ export {
   rotateKeyService,
   runBeforeRegister,
   sealSession,
+  selectAuthProfile,
   sendVerificationCodeService,
   setRolePermissions,
   shouldRefreshSession,