@spfn/auth 0.3.0-beta.1 → 0.3.0-beta.2

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, l as OAuthProvider, j as VerificationPurpose, h as PermissionCategory, n as AuthContext } from './authenticate-DlTGaBT8.js';
-export { o as AuthProfileOutcome, p as AuthProfileVerifier, C as ChangePasswordParams, D as DeviceNameSchema, E as EmailSchema, I as IssueOneTimeTokenResult, q as KEY_FINGERPRINT_PREFIX_LENGTH, K as KeySummary, r as LoginParams, L as LoginResult, s as LogoutParams, N as NativeVerifyOptions, t as NormalizedIdentity, u as OAuthCallbackParams, v as OAuthCallbackResult, w as OAuthCodeExchangeOptions, x as OAuthNativeParams, d as OAuthNativeResult, y as OAuthStartParams, O as OAuthStartResult, z as OAuthTokens, B as PasswordSchema, F as PhoneSchema, G as PlatformSchema, H as RegisterParams, J as RegisterPublicKeyParams, a as RegisterResult, M as RevokeAllKeysParams, c as RevokeAllKeysResult, Q as RevokeKeyParams, T as RotateKeyParams, b as RotateKeyResult, W as SendVerificationCodeParams, S as SendVerificationCodeResult, X as TargetTypeSchema, Y as UnlinkNotification, Z as UnlinkNotifyRejection, _ as UnlinkNotifyRequest, $ as UnlinkNotifyResult, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, a0 as VerificationPurposeSchema, k as VerificationTargetType, a1 as VerifyCodeParams, a2 as VerifyCodeResult, m as authRouter, a3 as authenticate, a4 as buildOAuthErrorUrl, a5 as changePasswordService, a6 as getEnabledOAuthProviders, a7 as getGoogleAccessToken, a8 as getOAuthProvider, a9 as getRegisteredProviders, aa as isOAuthProviderEnabled, ab as issueOneTimeTokenService, ac as listKeysService, ad as loginService, ae as logoutService, af as oauthCallbackService, ag as oauthNativeService, ah as oauthStartService, ai as oauthUnlinkNotifyService, aj as optionalAuth, ak as registerOAuthProvider, al as registerPublicKeyService, am as registerService, an as requireEnabledProvider, ao as resolveAuthenticatedUser, ap as revokeAllKeysService, aq as revokeKeyService, ar as rotateKeyService, as as runAuthProfile, at as selectAuthProfile, au as sendVerificationCodeService, av as verifyCodeService, aw as verifyOneTimeTokenService } from './authenticate-DlTGaBT8.js';
+import { A as AuthInitOptions, l as OAuthProvider, j as VerificationPurpose, h as PermissionCategory, n as AuthContext } from './authenticate-55LeXHqZ.js';
+export { o as AuthProfileOutcome, p as AuthProfileVerifier, C as ChangePasswordParams, D as DeviceNameSchema, E as EmailSchema, I as IssueOneTimeTokenResult, q as KEY_FINGERPRINT_PREFIX_LENGTH, K as KeySummary, r as LoginParams, L as LoginResult, s as LogoutParams, N as NativeVerifyOptions, t as NormalizedIdentity, u as OAuthCallbackParams, v as OAuthCallbackResult, w as OAuthCodeExchangeOptions, x as OAuthNativeParams, d as OAuthNativeResult, y as OAuthStartParams, O as OAuthStartResult, z as OAuthTokens, B as PasswordSchema, F as PhoneSchema, G as PlatformSchema, H as RegisterParams, J as RegisterPublicKeyParams, a as RegisterResult, M as RevokeAllKeysParams, c as RevokeAllKeysResult, Q as RevokeKeyParams, T as RotateKeyParams, b as RotateKeyResult, W as SendVerificationCodeParams, S as SendVerificationCodeResult, X as TargetTypeSchema, Y as UnlinkNotification, Z as UnlinkNotifyRejection, _ as UnlinkNotifyRequest, $ as UnlinkNotifyResult, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, a0 as VerificationPurposeSchema, k as VerificationTargetType, a1 as VerifyCodeParams, a2 as VerifyCodeResult, m as authRouter, a3 as authenticate, a4 as buildOAuthErrorUrl, a5 as changePasswordService, a6 as getEnabledOAuthProviders, a7 as getGoogleAccessToken, a8 as getOAuthProvider, a9 as getRegisteredProviders, aa as isOAuthProviderEnabled, ab as issueOneTimeTokenService, ac as listKeysService, ad as loginService, ae as logoutService, af as oauthCallbackService, ag as oauthNativeService, ah as oauthStartService, ai as oauthUnlinkNotifyService, aj as optionalAuth, ak as registerOAuthProvider, al as registerPublicKeyService, am as registerService, an as requireEnabledProvider, ao as resolveAuthenticatedUser, ap as revokeAllKeysService, aq as revokeKeyService, ar as rotateKeyService, as as runAuthProfile, at as selectAuthProfile, au as sendVerificationCodeService, av as verifyCodeService, aw as verifyOneTimeTokenService } from './authenticate-55LeXHqZ.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { K as KeyAlgorithmType, d as InvitationStatus, j as SocialProvider, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
@@ -8,7 +8,7 @@ import { BaseRepository } from '@spfn/core/db';
 import { c as ClientIdentity } from './wire-version-CtzMKvBB.js';
 import { Context } from 'hono';
 import * as _spfn_core_route from '@spfn/core/route';
-import { Algorithm } from 'jsonwebtoken';
+export { KeyPair, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, getKeySize, shouldRotateKey } from './crypto.js';
 export { S as SessionData, g as getSessionInfo, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-DTHahDQ9.js';
 import { JWTPayload } from 'jose';
 import { SSETokenManager, SSETokenStore } from '@spfn/core/event/sse';
@@ -17,6 +17,7 @@ import * as _spfn_core_job from '@spfn/core/job';
 import * as _spfn_core_event from '@spfn/core/event';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import '@spfn/auth/server';
+import 'jsonwebtoken';
 
 /**
  * @spfn/auth - Users Entity
@@ -1935,6 +1936,202 @@ interface SweepDuePurgesResult {
  */
 declare function sweepDuePurges(now?: Date): Promise<SweepDuePurgesResult>;
 
+/**
+ * @spfn/auth - Ops Tokens Entity
+ *
+ * Machine tokens for the CLI-first ops surface (`@spfn/core/ops`). A token is
+ * an operator credential, not a user session: it carries a label and a scope
+ * list, and the row stores only the SHA-256 hash of the secret — the secret
+ * itself is shown once at issuance and never persisted.
+ *
+ * Issuance is an operator act performed where database access already exists
+ * (`spfn ops token issue`); there is no HTTP surface for creating tokens, so
+ * a deployed app exposes verification only.
+ */
+declare const opsTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "ops_tokens";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        name: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"ops_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "ops_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type OpsToken = typeof opsTokens.$inferSelect;
+type NewOpsToken = typeof opsTokens.$inferInsert;
+
+/**
+ * Ops Token Service
+ *
+ * Issuance and verification for the CLI-first ops surface. The secret is
+ * `spfn_ops_<64 hex>`; only its SHA-256 hash is stored, so issuance is the
+ * one moment the secret exists in the clear.
+ *
+ * Verification answers with the same null for an unknown, revoked, or
+ * expired token — the refusal reveals nothing about whether a presented
+ * secret ever existed (the non-disclosure rule the client-proof surface
+ * keeps).
+ */
+
+/** What a verified token authorizes — the principal ops middleware exposes. */
+interface VerifiedOpsToken {
+    tokenId: number;
+    name: string;
+    scopes: string[];
+}
+interface IssuedOpsToken {
+    /** The secret, shown exactly once. Never stored, never logged. */
+    token: string;
+    record: OpsToken;
+}
+/**
+ * Issue a new ops token.
+ *
+ * @param name - Operator-facing label
+ * @param scopes - Permission strings the token grants ('*' grants all)
+ * @param expiresAt - null for a non-expiring token
+ */
+declare function issueOpsTokenService(name: string, scopes: string[], expiresAt: Date | null): Promise<IssuedOpsToken>;
+/**
+ * Verify a presented token. Null for unknown, revoked, and expired alike.
+ */
+declare function verifyOpsTokenService(token: string): Promise<VerifiedOpsToken | null>;
+declare function revokeOpsTokenService(id: number): Promise<OpsToken | null>;
+declare function listOpsTokensService(): Promise<OpsToken[]>;
+
 /**
  * @spfn/auth - Database Schema Definition
  *
@@ -3871,12 +4068,12 @@ declare class KeysRepository extends BaseRepository {
         isActive: boolean;
         createdAt: Date;
         expiresAt: Date | null;
+        revokedAt: Date | null;
+        lastUsedAt: Date | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
-        lastUsedAt: Date | null;
-        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -3973,12 +4170,12 @@ declare class KeysRepository extends BaseRepository {
         isActive: boolean;
         createdAt: Date;
         expiresAt: Date | null;
+        revokedAt: Date | null;
+        lastUsedAt: Date | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
-        lastUsedAt: Date | null;
-        revokedAt: Date | null;
         revokedReason: string | null;
     }>;
     /**
@@ -5440,6 +5637,37 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
 }
 declare const accountDeletionRequestsRepository: AccountDeletionRequestsRepository;
 
+/**
+ * Ops Tokens Repository
+ *
+ * Data access for the ops-token credential store. Extends BaseRepository for
+ * transaction context and read/write splitting like every other auth
+ * repository.
+ */
+
+declare class OpsTokensRepository extends BaseRepository {
+    /**
+     * Lookup by the secret's hash — the verification path.
+     *
+     * Reads the primary, not the replica, unlike every other SELECT here.
+     * Revocation writes to the primary, so a replica read would keep
+     * authenticating a revoked token for the length of the replication lag —
+     * and revocation is documented as taking effect immediately.
+     */
+    findByTokenHash(tokenHash: string): Promise<OpsToken | null>;
+    create(data: NewOpsToken): Promise<OpsToken>;
+    list(): Promise<OpsToken[]>;
+    /**
+     * Revoke an active token. Returns null when the id does not exist or the
+     * token is already revoked — the first revocation's timestamp is never
+     * overwritten.
+     */
+    revokeById(id: number): Promise<OpsToken | null>;
+    /** Fire-and-forget from the verification path. */
+    updateLastUsedById(id: number): Promise<void>;
+}
+declare const opsTokensRepository: OpsTokensRepository;
+
 /**
  * @spfn/auth - Password Helpers
  *
@@ -5815,6 +6043,24 @@ declare const roleGuard: _spfn_core_route.NamedMiddlewareFactory<"roleGuard", [o
  */
 declare const oneTimeTokenAuth: _spfn_core_route.NamedMiddleware<"oneTimeTokenAuth">;
 
+/** Read the verified ops token a handler runs under. */
+declare function getOpsToken(c: Context): VerifiedOpsToken | null;
+declare const opsTokenAuth: _spfn_core_route.NamedMiddleware<"opsTokenAuth">;
+/**
+ * Require the verified ops token to carry every named scope.
+ *
+ * Must run after `opsTokenAuth` — on a `createOpsRouter` surface it always
+ * does, because the factory injects the auth middleware first.
+ *
+ * @example
+ * ```ts
+ * export const listSignups = route.get('/_ops/signups')
+ *     .use([requireOpsScope('waitlist:read')])
+ *     .handler(async () => { ... });
+ * ```
+ */
+declare const requireOpsScope: _spfn_core_route.NamedMiddlewareFactory<"opsScope", string[]>;
+
 /**
  * Auth Context Helpers
  *
@@ -5959,63 +6205,6 @@ declare function getKeyId(c: Context | {
     raw: Context;
 }): string;
 
-/**
- * @spfn/auth - Client Crypto Helpers
- *
- * ES256 (ECDSA P-256) key generation and JWT signing for Next.js
- * Keys are stored in DER format (Base64 encoded) for efficiency
- *
- * Key Sizes:
- * - ES256 (ECDSA P-256): ~91 bytes (Base64: ~120 chars)
- * - RS256 (RSA 2048):   ~294 bytes (Base64: ~392 chars)
- */
-
-type Unit = 'Years' | 'Year' | 'Yrs' | 'Yr' | 'Y' | 'Weeks' | 'Week' | 'W' | 'Days' | 'Day' | 'D' | 'Hours' | 'Hour' | 'Hrs' | 'Hr' | 'H' | 'Minutes' | 'Minute' | 'Mins' | 'Min' | 'M' | 'Seconds' | 'Second' | 'Secs' | 'Sec' | 's' | 'Milliseconds' | 'Millisecond' | 'Msecs' | 'Msec' | 'Ms';
-type UnitAnyCase = Unit | Uppercase<Unit> | Lowercase<Unit>;
-type StringValue = `${number}` | `${number}${UnitAnyCase}` | `${number} ${UnitAnyCase}`;
-interface KeyPair {
-    privateKey: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm: KeyAlgorithmType;
-}
-/**
- * Generate ECDSA P-256 key pair (ES256)
- * Recommended for optimal size and performance
- */
-declare function generateKeyPairES256(): KeyPair;
-/**
- * Generate RSA 2048 key pair (RS256)
- * Fallback option, larger size but wider compatibility
- */
-declare function generateKeyPairRS256(): KeyPair;
-/**
- * Generate key pair (defaults to ES256)
- */
-declare function generateKeyPair(algorithm?: KeyAlgorithmType): KeyPair;
-/**
- * Generate JWT signed with client private key (DER format)
- */
-declare function generateClientToken(payload: Record<string, any>, privateKeyB64: string, algorithm: Algorithm, options?: {
-    expiresIn?: StringValue | number;
-    issuer?: string;
-}): string;
-/**
- * Get key size information
- */
-declare function getKeySize(publicKeyB64: string): {
-    bytes: number;
-    base64Length: number;
-};
-/**
- * Check if key should be rotated based on creation date
- */
-declare function shouldRotateKey(createdAt: Date, rotationDays?: number): {
-    shouldRotate: boolean;
-    daysRemaining: number;
-};
-
 /**
  * @spfn/auth - Global Configuration
  *
@@ -6725,4 +6914,4 @@ type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
 type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
 type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
 
-export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, KeyAlgorithmType, type KeyPair, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getKeySize, getLocale, getOneTimeTokenManager, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, kakaoProvider, keysRepository, listInvitations, matchOAuthCsrfCookies, naverProvider, oauthUnlinkedEvent, oneTimeTokenAuth, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requirePermissions, requireRole, resendInvitation, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, shouldRotateKey, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyPassword, verifyToken };
+export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewOpsToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type OpsToken, OpsTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOpsToken, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, issueOpsTokenService, kakaoProvider, keysRepository, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, naverProvider, oauthUnlinkedEvent, oneTimeTokenAuth, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken };