@spfn/auth 0.3.0-beta.2 → 0.3.0-beta.20

package/dist/server.d.ts

@@ -1,24 +1,316 @@
-import { A as AuthInitOptions, l as OAuthProvider, j as VerificationPurpose, h as PermissionCategory, n as AuthContext } from './authenticate-55LeXHqZ.js';
-export { o as AuthProfileOutcome, p as AuthProfileVerifier, C as ChangePasswordParams, D as DeviceNameSchema, E as EmailSchema, I as IssueOneTimeTokenResult, q as KEY_FINGERPRINT_PREFIX_LENGTH, K as KeySummary, r as LoginParams, L as LoginResult, s as LogoutParams, N as NativeVerifyOptions, t as NormalizedIdentity, u as OAuthCallbackParams, v as OAuthCallbackResult, w as OAuthCodeExchangeOptions, x as OAuthNativeParams, d as OAuthNativeResult, y as OAuthStartParams, O as OAuthStartResult, z as OAuthTokens, B as PasswordSchema, F as PhoneSchema, G as PlatformSchema, H as RegisterParams, J as RegisterPublicKeyParams, a as RegisterResult, M as RevokeAllKeysParams, c as RevokeAllKeysResult, Q as RevokeKeyParams, T as RotateKeyParams, b as RotateKeyResult, W as SendVerificationCodeParams, S as SendVerificationCodeResult, X as TargetTypeSchema, Y as UnlinkNotification, Z as UnlinkNotifyRejection, _ as UnlinkNotifyRequest, $ as UnlinkNotifyResult, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, a0 as VerificationPurposeSchema, k as VerificationTargetType, a1 as VerifyCodeParams, a2 as VerifyCodeResult, m as authRouter, a3 as authenticate, a4 as buildOAuthErrorUrl, a5 as changePasswordService, a6 as getEnabledOAuthProviders, a7 as getGoogleAccessToken, a8 as getOAuthProvider, a9 as getRegisteredProviders, aa as isOAuthProviderEnabled, ab as issueOneTimeTokenService, ac as listKeysService, ad as loginService, ae as logoutService, af as oauthCallbackService, ag as oauthNativeService, ah as oauthStartService, ai as oauthUnlinkNotifyService, aj as optionalAuth, ak as registerOAuthProvider, al as registerPublicKeyService, am as registerService, an as requireEnabledProvider, ao as resolveAuthenticatedUser, ap as revokeAllKeysService, aq as revokeKeyService, ar as rotateKeyService, as as runAuthProfile, at as selectAuthProfile, au as sendVerificationCodeService, av as verifyCodeService, aw as verifyOneTimeTokenService } from './authenticate-55LeXHqZ.js';
+import { A as AuthInitOptions, u as OAuthProvider, s as VerificationPurpose, N as NewPasskey, v as Passkey, q as PermissionCategory, w as AuthContext } from './machine-principals-BD4tnASp.js';
+export { x as ApproveDeviceAuthParams, y as AuthProfileOutcome, z as AuthProfileVerifier, B as ChangePasswordParams, E as CompletePasswordResetParams, G as CompleteSignupParams, H as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, J as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, M as DenyDeviceAuthParams, Q as DeviceAuthApprovedResult, T as DeviceAuthInfoParams, D as DeviceAuthInfoResult, W as DeviceAuthPendingResult, X as DeviceAuthPollResponseSchema, Y as DeviceNameSchema, Z as EmailSchema, _ as FingerprintSchema, $ as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, a0 as FinishPasskeyLoginParams, I as IssueOneTimeTokenResult, a1 as KEY_FINGERPRINT_PREFIX_LENGTH, a2 as KeyIdSchema, K as KeySummary, a3 as LoginParams, L as LoginResult, a4 as LogoutParams, a5 as MachinePrincipal, a6 as MachineVerifierRegistration, a7 as NativeVerifyOptions, a8 as NormalizedIdentity, l as OAuth2AuthorizationCodeIssued, a9 as OAuth2AuthorizeParams, k as OAuth2ConsentView, n as OAuth2GrantSummary, aa as OAuth2ScopeDescription, ab as OAuthCallbackParams, ac as OAuthCallbackResult, ad as OAuthCodeExchangeOptions, ae as OAuthNativeParams, i as OAuthNativeResult, af as OAuthStartParams, O as OAuthStartResult, ag as OAuthTokens, ah as PASSKEY_DEVICE_TYPES, ai as PASSKEY_LABEL_MAX_LENGTH, aj as PasskeyDeviceType, f as PasskeySummary, ak as PasswordSchema, al as PhoneSchema, am as PlatformSchema, an as PollDeviceAuthParams, ao as PollDeviceAuthResult, ap as PublicKeySchema, aq as RecentAuthenticationParams, ar as RegisterParams, as as RegisterPublicKeyParams, a as RegisterResult, at as RenamePasskeyParams, au as RequestPasswordResetParams, c as RequestPasswordResetResult, av as RequestSignupLinkParams, b as RequestSignupLinkResult, aw as RevokeAllKeysParams, h as RevokeAllKeysResult, ax as RevokeKeyParams, ay as RevokePasskeyParams, az as RotateKeyParams, g as RotateKeyResult, aA as SendVerificationCodeParams, S as SendVerificationCodeResult, aB as StartDeviceAuthParams, e as StartDeviceAuthResult, aC as StartPasskeyEnrollmentParams, aD as TargetTypeSchema, aE as UnlinkNotification, aF as UnlinkNotifyRejection, aG as UnlinkNotifyRequest, aH as UnlinkNotifyResult, aI as UserCodeSchema, V as VERIFICATION_PURPOSES, r as VERIFICATION_TARGET_TYPES, aJ as VerificationPurposeSchema, t as VerificationTargetType, aK as VerifyCodeParams, aL as VerifyCodeResult, aM as approveDeviceAuthService, aN as approveOAuth2AuthorizeService, aO as assertNotLastRecoveryCredential, aP as assertRecentAuthentication, m as authRouter, aQ as authenticate, aR as buildOAuthErrorUrl, aS as changePasswordService, aT as completePasswordResetService, aU as completeSignupService, aV as confirmPasswordResetService, aW as confirmSignupLinkService, aX as denyDeviceAuthService, aY as denyOAuth2AuthorizeService, aZ as describeOAuth2AuthorizeRequestService, a_ as finishPasskeyEnrollmentService, a$ as finishPasskeyLoginService, b0 as getDeviceAuthInfoService, b1 as getEnabledOAuthProviders, b2 as getGoogleAccessToken, b3 as getMachinePrincipal, b4 as getOAuthProvider, b5 as getRegisteredProviders, b6 as isOAuthProviderEnabled, b7 as issueOneTimeTokenService, b8 as listKeysService, b9 as listOAuth2GrantsService, ba as listPasskeysService, bb as loginService, bc as logoutService, bd as machineAuth, be as oauthCallbackService, bf as oauthNativeService, bg as oauthStartService, bh as oauthUnlinkNotifyService, bi as optionalAuth, bj as passkeys, bk as pollDeviceAuthService, bl as registerAuthProfile, bm as registerMachineVerifier, bn as registerOAuthProvider, bo as registerPublicKeyService, bp as registerService, bq as renamePasskeyService, br as requestPasswordResetService, bs as requestSignupLinkService, bt as requireEnabledProvider, bu as requireMachineScope, bv as resolveAuthenticatedUser, bw as revokeAllKeysService, bx as revokeAllOAuth2GrantsForUser, by as revokeKeyService, bz as revokeOAuth2GrantService, bA as revokePasskeyService, bB as rotateKeyService, bC as runAuthProfile, bD as selectAuthProfile, bE as sendVerificationCodeService, bF as startDeviceAuthService, bG as startPasskeyEnrollmentService, bH as startPasskeyLoginService, bI as verifyCodeService, bJ as verifyOneTimeTokenService } from './machine-principals-BD4tnASp.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
-import { K as KeyAlgorithmType, d as InvitationStatus, j as SocialProvider, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
+import { j as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';
 import { c as ClientIdentity } from './wire-version-CtzMKvBB.js';
 import { Context } from 'hono';
 import * as _spfn_core_route from '@spfn/core/route';
+import { NamedMiddleware } from '@spfn/core/route';
 export { KeyPair, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, getKeySize, shouldRotateKey } from './crypto.js';
-export { S as SessionData, g as getSessionInfo, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-DTHahDQ9.js';
+export { S as SessionData, g as getSessionInfo, i as isSafeReturnPath, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-Dfwu5g2W.js';
 import { JWTPayload } from 'jose';
 import { SSETokenManager, SSETokenStore } from '@spfn/core/event/sse';
 import * as _spfn_core_logger from '@spfn/core/logger';
 import * as _spfn_core_job from '@spfn/core/job';
 import * as _spfn_core_event from '@spfn/core/event';
 import * as _sinclair_typebox from '@sinclair/typebox';
+import '@simplewebauthn/server';
 import '@spfn/auth/server';
 import 'jsonwebtoken';
 
+/**
+ * @spfn/auth - Global Configuration
+ *
+ * Manages global auth configuration including session TTL
+ */
+
+/**
+ * Cookie names used by SPFN Auth
+ *
+ * Names include a port-based suffix so that multiple dev instances
+ * on different ports don't overwrite each other's cookies.
+ */
+declare const COOKIE_NAMES: {
+    /** Encrypted session data (userId, privateKey, keyId, algorithm) */
+    readonly SESSION: string;
+    /** Current key ID (for key rotation) */
+    readonly SESSION_KEY_ID: string;
+    /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
+    readonly OAUTH_PENDING: string;
+    /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
+    readonly OAUTH_CSRF: string;
+    /** Password-setup session for verified-email signup — temporary, single-purpose */
+    readonly SIGNUP_SETUP: string;
+    /** Password-setup session for a password reset — temporary, single-purpose */
+    readonly PASSWORD_RESET_SETUP: string;
+    /** CSRF token — the only cookie here the browser can read */
+    readonly CSRF: string;
+};
+/**
+ * OAuth CSRF 쿠키를 PORT 접미사와 무관하게 전부 수집한다.
+ *
+ * 쿠키를 심는 쪽은 Next.js 프로세스, 읽는 쪽은 API 프로세스라 분리 배포에서는
+ * 두 프로세스의 PORT가 달라 COOKIE_NAMES.OAUTH_CSRF 정확 일치 조회가 빗나간다.
+ * nonce 자체가 랜덤값이고 암호화된 state의 nonce와 대조되므로, 접미사가 다른
+ * spfn_oauth_csrf* 후보를 모두 대조 대상으로 넘겨도 안전하다.
+ */
+declare function matchOAuthCsrfCookies(cookies: Record<string, string>): {
+    name: string;
+    value: string;
+}[];
+/**
+ * Parse duration string to seconds
+ *
+ * Supports: '30d', '12h', '45m', '3600s', or plain number
+ *
+ * @example
+ * parseDuration('30d')   // 2592000 (30 days in seconds)
+ * parseDuration('12h')   // 43200
+ * parseDuration('45m')   // 2700
+ * parseDuration('3600')  // 3600
+ */
+declare function parseDuration(duration: string | number): number;
+/**
+ * Registration channel passed to the beforeRegister hook
+ *
+ * - credentials: email/phone + password registration
+ * - oauth: new-user signup through a social provider (web or native flow)
+ * - invitation: invitation acceptance
+ */
+type RegisterChannel = 'credentials' | 'oauth' | 'invitation';
+/**
+ * Context passed to the beforeRegister hook
+ *
+ * Credentials (password, keys) are intentionally excluded — the hook is a
+ * policy gate, not a credential handler.
+ */
+interface BeforeRegisterContext {
+    channel: RegisterChannel;
+    /** Social provider — only set when channel is 'oauth' */
+    provider?: SocialProvider;
+    /**
+     * Canonical form of the address — trimmed and lower-cased, the same form
+     * the account is stored under. A policy keyed on the address (a denylist, a
+     * domain allowlist) therefore matches whatever capitalization the person
+     * typed, instead of being walked past by `Blocked@Example.com`.
+     */
+    email?: string;
+    /**
+     * Whether the email is verified — only set when channel is 'oauth'.
+     * OAuth providers may report an unverified (spoofable) email; the created
+     * account stores it as null in that case, so email-based policies must
+     * check this flag. credentials/invitation emails are already verified.
+     */
+    emailVerified?: boolean;
+    phone?: string;
+    /** App-supplied registration metadata (register params / OAuth start params / invitation) */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * How the Next.js proxy treats a cookie-authenticated mutation that arrives
+ * without a valid CSRF header.
+ *
+ * - `off`: no check
+ * - `warn`: allow it through, log one line per request that would be refused
+ * - `enforce`: refuse it with 403
+ */
+type CsrfMode = 'off' | 'warn' | 'enforce';
+/**
+ * CSRF configuration for the Next.js proxy
+ */
+interface AuthCsrfConfig {
+    /**
+     * @default 'warn' — an existing app gets signal before it gets breakage.
+     *          `SPFN_AUTH_CSRF` sets it when this is not; new apps scaffolded by
+     *          `spfn init` are given `enforce`.
+     */
+    mode?: CsrfMode;
+    /**
+     * Backend paths that skip the check, matched exactly.
+     *
+     * These are route paths as the backend sees them (`/webhooks/stripe`), not
+     * `/api/rpc/...` URLs, with route params already substituted. Intended for
+     * endpoints a browser session never calls — webhook receivers and the like.
+     * A path listed here is unprotected for cookie callers too, so list only
+     * endpoints that carry their own authentication.
+     */
+    exemptPaths?: string[];
+}
+/**
+ * Auth configuration
+ */
+interface AuthConfig {
+    /**
+     * Default session TTL in seconds or duration string
+     *
+     * Supports:
+     * - Number: seconds (e.g., 2592000)
+     * - String: '30d', '12h', '45m', '3600s'
+     *
+     * @default 7d (7 days)
+     */
+    sessionTtl?: string | number;
+    /**
+     * App-injected validator that runs before a new user row is created,
+     * on every registration channel (credentials, oauth, invitation).
+     *
+     * Throw to reject the registration — RegistrationRejectedError (403) is
+     * the recommended error; any HttpError subclass keeps its own status.
+     * Runs after built-in checks (verification token, duplicate account),
+     * so existing error precedence is unchanged. Not called for admin
+     * seeding (initializeAuth) or when linking a social account to an
+     * existing user.
+     *
+     * Runs inside the registration DB transaction on every channel — keep it
+     * fast. A slow call (e.g. an external policy API) holds a pooled DB
+     * connection open for its full duration on every signup.
+     *
+     * @example
+     * ```typescript
+     * configureAuth({
+     *     beforeRegister: async ({ channel, metadata }) =>
+     *     {
+     *         if (channel === 'credentials' && !isOldEnough(metadata?.birthDate))
+     *         {
+     *             throw new RegistrationRejectedError({ message: 'Age requirement not met' });
+     *         }
+     *     },
+     * });
+     * ```
+     */
+    beforeRegister?: (context: BeforeRegisterContext) => void | Promise<void>;
+    /**
+     * CSRF protection for cookie-session mutations, enforced in the Next.js proxy.
+     *
+     * @example
+     * ```typescript
+     * configureAuth({
+     *     csrf: { mode: 'enforce', exemptPaths: ['/webhooks/stripe'] },
+     * });
+     * ```
+     */
+    csrf?: AuthCsrfConfig;
+}
+/**
+ * Configure global auth settings
+ *
+ * @param config - Auth configuration
+ *
+ * @example
+ * ```typescript
+ * configureAuth({
+ *   sessionTtl: '30d',  // 30 days
+ * });
+ * ```
+ */
+declare function configureAuth(config: AuthConfig): void;
+/**
+ * Get current auth configuration
+ */
+declare function getAuthConfig(): AuthConfig;
+/**
+ * Run the app-injected beforeRegister hook if configured — throws to reject.
+ *
+ * Single entry point for every registration channel so a new channel cannot
+ * forget the configured-check. Callers invoke this right before creating the
+ * user row.
+ *
+ * The address is folded here rather than at each call site, for the same reason
+ * the check itself lives here: three channels supply it, and a policy that sees
+ * a different spelling depending on which one the person came through is a
+ * policy that can be walked past.
+ */
+declare function runBeforeRegister(context: BeforeRegisterContext): Promise<void>;
+/**
+ * Get session TTL in seconds
+ *
+ * Priority:
+ * 1. Runtime override (remember parameter)
+ * 2. Global config (configureAuth)
+ * 3. Environment variable (SPFN_AUTH_SESSION_TTL) - via config module
+ * 4. Default (7 days)
+ */
+declare function getSessionTtl(override?: string | number): number;
+/**
+ * Get the CSRF mode
+ *
+ * Priority:
+ * 1. Global config (configureAuth)
+ * 2. Environment variable (SPFN_AUTH_CSRF)
+ * 3. Default ('warn')
+ *
+ * An unrecognized value is a typo in the one setting that turns the check on;
+ * it resolves to `enforce` and says so, rather than quietly leaving mutations
+ * unprotected. It says so once per process: this runs on every mutation, so a
+ * per-call error would be pure repetition burying the rest of the log.
+ */
+declare function getCsrfMode(): CsrfMode;
+/**
+ * Get the paths exempted from the CSRF check (exact match, backend route paths)
+ */
+declare function getCsrfExemptPaths(): string[];
+/**
+ * The relying party this deployment presents to authenticators, resolved.
+ *
+ * `rpId` is the domain a credential is bound to and can never change without
+ * orphaning every passkey already enrolled under it. `origins` is the closed set
+ * of pages allowed to run a ceremony for that rpId.
+ */
+interface PasskeyConfig {
+    /** Domain credentials are bound to — a registrable domain, no protocol, no port. */
+    rpId: string;
+    /** Name shown by the authenticator's own prompt. */
+    rpName: string;
+    /** Full origins allowed to run a ceremony, e.g. `https://app.example.com`. */
+    origins: string[];
+    userVerification: PasskeyUserVerification;
+    challengeTtlMs: number;
+    recentAuthMs: number;
+}
+/**
+ * How hard the authenticator must work to prove the person is present.
+ *
+ * `discouraged` is not offered: a passkey here is the whole credential, so an
+ * assertion that skipped user verification would sign someone in on possession
+ * of an unlocked device alone.
+ */
+type PasskeyUserVerification = 'preferred' | 'required';
+type PasskeyEnvSource = Record<string, string | undefined>;
+/**
+ * Resolve the passkey configuration, refusing anything a ceremony would fail on.
+ *
+ * Zero-config for a one-origin app: rpId is the app URL's host and the single
+ * origin is the app URL's origin. An app on several hosts sets
+ * `SPFN_AUTH_PASSKEY_RP_ID` to the registrable domain they share and lists them
+ * in `SPFN_AUTH_PASSKEY_ORIGINS`.
+ *
+ * @param env - Environment to read; defaults to `process.env`.
+ * @throws PasskeyConfigError when the configuration cannot be honoured.
+ */
+declare function getPasskeyConfig(env?: PasskeyEnvSource): PasskeyConfig;
+/**
+ * Refuse boot on a passkey configuration no ceremony could satisfy.
+ *
+ * Resolution is the check: everything `getPasskeyConfig` refuses would otherwise
+ * surface as the browser rejecting every ceremony, long after the deploy that
+ * introduced the drift.
+ *
+ * The refusal is reserved for a configuration an operator actually wrote, which
+ * is the posture `assertOAuthRedirectUris` already takes for the same reason. An
+ * app that set no passkey variable at all can still resolve to something
+ * unusable — `SPFN_APP_URL=http://192.168.1.5:3000` for mobile development, say,
+ * which is neither https nor localhost — and refusing to start over a feature
+ * nobody asked for would take that app down to fix something it does not use.
+ * It is reported instead, once, and the first ceremony (if there ever is one)
+ * fails with the same message.
+ *
+ * @throws PasskeyConfigError when a passkey variable is set and cannot be honoured
+ */
+declare function assertPasskeyConfig(env?: PasskeyEnvSource): void;
+
 /**
  * @spfn/auth - Users Entity
  *
@@ -431,6 +723,42 @@ declare function updateUsernameService(userId: string | number | bigint, usernam
  */
 declare function initializeAuth(options?: AuthInitOptions): Promise<void>;
 
+/**
+ * @spfn/auth - Stored email normalization
+ *
+ * Brings existing rows into the canonical form the repository now writes and
+ * reads. Without it, normalizing the code alone would lock out every account
+ * whose address was stored with any capitalization: the lookup folds the typed
+ * address to lower case, the stored one stays mixed, and they stop matching.
+ *
+ * Runs once at startup and records that it ran, so a healthy install pays one
+ * small metadata read per boot rather than a scan of the users table.
+ *
+ * The work itself stays in the database — one query to find the addresses two
+ * rows would share, one statement to fold the rest. Nothing proportional to the
+ * table is carried through the application, which is what keeps a legacy
+ * install's first boot from turning into a row-at-a-time migration.
+ */
+interface EmailNormalizationResult {
+    /** Rows rewritten to canonical form. */
+    normalized: number;
+    /** User id groups that share an address once folded, left untouched. */
+    conflicts: number[][];
+}
+/**
+ * Rewrite stored addresses to canonical form, skipping anything that would
+ * collide.
+ *
+ * A collision means two accounts differ only by capitalization. Which of them is
+ * the real one, and what happens to the other's data, is not a question this can
+ * answer — so every row in the group is left exactly as it is and all of their
+ * ids are reported. The alternative, merging or deleting one, destroys an
+ * account on a guess.
+ *
+ * @returns what was rewritten and what was left for an operator
+ */
+declare function normalizeStoredEmails(): Promise<EmailNormalizationResult>;
+
 /**
  * @spfn/auth - Permission Service
  *
@@ -1944,9 +2272,10 @@ declare function sweepDuePurges(now?: Date): Promise<SweepDuePurgesResult>;
  * list, and the row stores only the SHA-256 hash of the secret — the secret
  * itself is shown once at issuance and never persisted.
  *
- * Issuance is an operator act performed where database access already exists
- * (`spfn ops token issue`); there is no HTTP surface for creating tokens, so
- * a deployed app exposes verification only.
+ * Issuance is an operator act, and it goes over HTTP like everything else on
+ * this surface: `POST /_auth/ops-tokens`, behind `authenticate` plus
+ * `requireRole('admin', 'superadmin')`. `spfn ops token issue` signs in as an
+ * administrator and calls it, so the CLI needs no database access of its own.
  */
 declare const opsTokens: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "ops_tokens";
@@ -2106,6 +2435,23 @@ type NewOpsToken = typeof opsTokens.$inferInsert;
  * keeps).
  */
 
+/**
+ * The shape every ops-token secret carries.
+ *
+ * Exported because an application that admits both an ops token and a user
+ * session on one route has to tell the two apart before either is verified,
+ * and a literal copied into application code drifts silently when this
+ * package changes the shape.
+ */
+declare const OPS_TOKEN_PREFIX = "spfn_ops_";
+/**
+ * Whether a presented bearer credential has the ops-token shape.
+ *
+ * Shape only — a token of this shape may still be unknown, revoked, or
+ * expired; `verifyOpsTokenService` decides that. Callers read a raw header,
+ * so a missing or non-string argument answers false rather than throwing.
+ */
+declare function isOpsToken(bearer: string): boolean;
 /** What a verified token authorizes — the principal ops middleware exposes. */
 interface VerifiedOpsToken {
     tokenId: number;
@@ -2133,34 +2479,255 @@ declare function revokeOpsTokenService(id: number): Promise<OpsToken | null>;
 declare function listOpsTokensService(): Promise<OpsToken[]>;
 
 /**
- * @spfn/auth - Database Schema Definition
+ * OAuth 2.1 Client Service
+ *
+ * RFC 7591 dynamic client registration, for public clients and nothing else.
+ * `claude mcp add` and `codex mcp add` both begin here: the CLI discovers the
+ * authorization server, registers itself unauthenticated, and gets back a
+ * `client_id` it keeps on the user's disk.
+ *
+ * Unauthenticated registration means the table is a place anyone can write, so
+ * two things bound it. The route rate-limits by IP, and this service caps how
+ * many clients one IP may have standing that nobody has approved — a rate limit
+ * alone would let an IP accumulate rows forever at a slow enough pace, because a
+ * row costs nothing to make and lives until a job sweeps it. The cap looks back
+ * an hour rather than over all time: it is a bound on how much junk one address
+ * may have standing at once, not a lifetime quota on how many CLIs somebody may
+ * ever connect.
+ *
+ * Every refusal here is RFC 7591 §3.2.2 shaped (`invalid_redirect_uri`,
+ * `invalid_client_metadata`) rather than thrown, because the client reading it
+ * is an OAuth client library that knows those two words and not this
+ * application's error envelope. The route renders the shape; this decides it.
+ */
+/**
+ * How many unapproved clients one IP may have standing.
+ *
+ * Generous against real use — a developer registering the same CLI on four
+ * projects in an afternoon, each abandoned at the consent screen, is nowhere
+ * near it — and small enough that the table cannot be filled from one address
+ * between two sweeps of the purge job.
+ */
+declare const MAX_UNGRANTED_CLIENTS_PER_IP = 20;
+/** How long a client nobody approved is kept before the purge job deletes it. */
+declare const STALE_CLIENT_MAX_AGE_MS: number;
+/** The only grant types this authorization server issues. */
+declare const SUPPORTED_GRANT_TYPES: string[];
+/** The only response type. There is no implicit flow here. */
+declare const SUPPORTED_RESPONSE_TYPES: string[];
+/** Registration metadata as RFC 7591 names it, before anything is trusted. */
+interface OAuth2RegisterRequest {
+    redirect_uris?: unknown;
+    client_name?: unknown;
+    token_endpoint_auth_method?: unknown;
+    grant_types?: unknown;
+    response_types?: unknown;
+}
+/** RFC 7591 §3.2.1 registration response. */
+interface OAuth2RegisteredClient {
+    client_id: string;
+    client_id_issued_at: number;
+    client_name: string;
+    redirect_uris: string[];
+    token_endpoint_auth_method: string;
+    grant_types: string[];
+    response_types: string[];
+}
+/** A refusal in the shape the client's own OAuth library will read. */
+interface OAuth2RegisterRefusal {
+    ok: false;
+    status: 400 | 429;
+    error: string;
+    description: string;
+}
+type OAuth2RegisterResult = {
+    ok: true;
+    client: OAuth2RegisteredClient;
+} | OAuth2RegisterRefusal;
+/**
+ * Register a public client.
  *
- * Defines the 'spfn_auth' PostgreSQL schema for all auth-related tables
+ * @param request - Metadata exactly as it arrived; nothing here is trusted
+ * @param clientIp - Client IP for the standing cap, or null when unknowable
  */
+declare function registerOAuth2ClientService(request: OAuth2RegisterRequest, clientIp: string | null): Promise<OAuth2RegisterResult>;
 /**
- * Auth schema for all authentication and authorization tables
- * Tables: users, roles, permissions, user_invitations, etc.
+ * Delete clients nobody approved within a day — the `auth.oauth2.client-purge`
+ * sweep.
+ *
+ * @returns how many rows the sweep removed
  */
-declare const authSchema: drizzle_orm_pg_core.PgSchema<string>;
+declare function purgeStaleOAuth2ClientsService(): Promise<{
+    deleted: number;
+}>;
 
 /**
- * @spfn/auth - User Profiles Entity
+ * OAuth 2.1 Token Service
+ *
+ * The token endpoint's two grant types, and RFC 7009 revocation.
+ *
+ * Every failure on this endpoint answers `invalid_grant` — an unknown code, a
+ * spent one, an expired one, a mismatched verifier, a code minted for another
+ * client, a refresh token that never existed, one that was rotated away. That is
+ * not laziness with error messages: the endpoint is public and unauthenticated,
+ * and an error that distinguished "this code does not exist" from "this code
+ * exists but is not yours" would answer the question an attacker holding a
+ * stolen value is actually asking. `invalid_target` and `invalid_scope` are the
+ * two exceptions, and both are decided from values the caller already knows.
+ *
+ * Nothing is spent or revoked before the presenter has shown it is the client the
+ * credential belongs to. On the code path that means `client_id`, `redirect_uri`
+ * and the PKCE verifier are all checked against the row before the code is
+ * consumed — a caller that cannot satisfy them leaves the code unspent for the
+ * real client and the grant untouched, because it has proved nothing about
+ * itself and must therefore cost nobody anything.
+ *
+ * Two replays are detected rather than merely refused, and both revoke the whole
+ * grant:
+ *
+ * - A code presented twice. The first exchange already produced tokens; if the
+ *   second presentation is the real client, somebody else holds those tokens.
+ * - A rotated refresh token presented again. Same reasoning, and it is why a
+ *   rotated row is marked rather than deleted — a deleted row is
+ *   indistinguishable from one that never existed.
+ *
+ * Revoking the grant kills the replacement tokens too, which is the point: the
+ * thief's pair and the client's pair both hang off the grant, and there is no
+ * way to tell which is which.
+ */
+/** A token request as RFC 6749 names its fields, before anything is trusted. */
+interface OAuth2TokenRequest {
+    grant_type?: string;
+    code?: string;
+    code_verifier?: string;
+    client_id?: string;
+    redirect_uri?: string;
+    refresh_token?: string;
+    resource?: string;
+    scope?: string;
+}
+/** RFC 6749 §5.1, with `scope` always stated so a narrowed request is legible. */
+interface OAuth2TokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token: string;
+    scope: string;
+}
+/** RFC 6749 §5.2: the code, and a sentence for whoever is reading the logs. */
+interface OAuth2TokenRefusal {
+    ok: false;
+    error: string;
+    description: string;
+}
+type OAuth2TokenResult = {
+    ok: true;
+    tokens: OAuth2TokenResponse;
+} | OAuth2TokenRefusal;
+/**
+ * Exchange a code or refresh a token.
  *
- * User profile information (separate from authentication data)
+ * @param request - The form or JSON body, exactly as it arrived
+ */
+declare function oauth2TokenService(request: OAuth2TokenRequest): Promise<OAuth2TokenResult>;
+/**
+ * Revoke a presented token.
  *
- * Features:
- * - Display name and personal information
- * - Avatar and bio
- * - Locale and timezone preferences
- * - Optional demographic data
- * - Social links and professional info
+ * Answers nothing, ever. RFC 7009 §2.2 requires 200 for a token that was never
+ * issued as well as for one that was, so a caller cannot use this endpoint to
+ * ask whether a value it found somewhere is real.
+ *
+ * A refresh token takes the grant with it: a client presenting its refresh token
+ * here is saying it is finished, and leaving that grant's access tokens alive
+ * for eight more hours would be honouring half the request. An access token is
+ * revoked alone — a client may be discarding one it no longer needs while still
+ * holding the connection.
+ *
+ * A `client_id` that is not the token's is the same 200 and revokes nothing
+ * (RFC 7009 §2.1). The endpoint has no client authentication to lean on, so this
+ * does not stop anybody who holds the token from revoking it — what it stops is
+ * one client tearing down another's connection by presenting a value it came
+ * across, which is the only thing a public client's id can be asked to mean.
+ * Which is also why it is required and not optional: RFC 7009 §2.1 has the
+ * client authenticate per RFC 6749 §2.3, and §2.3.1 says a public client with no
+ * credentials identifies itself with `client_id`. The route refuses a request
+ * that carries none before this is called.
+ *
+ * @param token - The value to revoke, access or refresh
+ * @param clientId - Checked against the token's client
  */
-declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_profiles";
-    schema: string;
-    columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
-            name: string;
+declare function revokeOAuth2TokenService(token: string, clientId: string): Promise<void>;
+
+/**
+ * OAuth 2.1 Access Token Verification
+ *
+ * `verifyAccessToken` is what `@spfn/mcp` calls on every request to `/mcp`. It
+ * is the one function in this feature an application wires up by hand:
+ *
+ * ```typescript
+ * createMcpRoute({ validateToken: verifyAccessToken })
+ * ```
+ *
+ * Null for every refusal, and the same null for all of them — unknown, revoked,
+ * expired, refresh-kind, grant revoked, wrong resource. The non-disclosure rule
+ * `verifyOpsTokenService` keeps, for the same reason: this is a public endpoint
+ * and the refusal must not tell a caller whether the value it presented was ever
+ * real.
+ *
+ * The resource check is not a formality. An access token minted for one API is
+ * refused by another (RFC 8707), so a token a user approved for their MCP server
+ * cannot be replayed against a neighbouring deployment that happens to share this
+ * authorization server.
+ */
+/** What a verified access token authorizes. */
+interface VerifiedOAuth2AccessToken {
+    /** The public `client_id` of the CLI holding the token. */
+    clientId: string;
+    /** Scope names, as granted or as the refresh that minted it narrowed them to. */
+    scopes: string[];
+    /** Expiry as seconds since the epoch — the unit every OAuth field uses. */
+    expiresAt: number;
+    /** The account the CLI is acting for. */
+    userId: string;
+}
+/**
+ * Verify a bearer token presented to a protected resource.
+ *
+ * @param token - The raw bearer value
+ * @param resource - The resource being accessed, e.g. `https://api.example.com/mcp`
+ * @returns the principal, or null for any reason at all
+ */
+declare function verifyAccessToken(token: string, resource: string): Promise<VerifiedOAuth2AccessToken | null>;
+
+/**
+ * @spfn/auth - Database Schema Definition
+ *
+ * Defines the 'spfn_auth' PostgreSQL schema for all auth-related tables
+ */
+/**
+ * Auth schema for all authentication and authorization tables
+ * Tables: users, roles, permissions, user_invitations, etc.
+ */
+declare const authSchema: drizzle_orm_pg_core.PgSchema<string>;
+
+/**
+ * @spfn/auth - User Profiles Entity
+ *
+ * User profile information (separate from authentication data)
+ *
+ * Features:
+ * - Display name and personal information
+ * - Avatar and bio
+ * - Locale and timezone preferences
+ * - Optional demographic data
+ * - Social links and professional info
+ */
+declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_profiles";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
             tableName: "user_profiles";
             dataType: "object date";
             data: Date;
@@ -3057,23 +3624,25 @@ type VerificationCode = typeof verificationCodes.$inferSelect;
 type NewVerificationCode = typeof verificationCodes.$inferInsert;
 
 /**
- * @spfn/auth - Permissions Entity
+ * @spfn/auth - Signup Link Tokens Entity
  *
- * Granular permissions for RBAC system
+ * Backs the verified-email signup flow: a one-time confirmation link is emailed,
+ * opening it mints a short-lived setup session, and setting a password on that
+ * session creates the account.
  *
- * Features:
- * - Built-in permissions (auth:*, user:*, rbac:*) - required for package
- * - System permissions (preset permissions) - optional
- * - Custom permissions (app-specific) - defined by developers
- * - Category grouping for organization
+ * A separate table from `verification_codes` on purpose. That table stores its
+ * six-digit code in plaintext, which is acceptable for a short-lived numeric code
+ * bounded by an attempt counter, but a link token is a bearer credential sitting
+ * in someone's mailbox and must only ever be stored as a hash. Sharing one table
+ * would make "plaintext or hash" a per-row property that nothing enforces.
  */
-declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "permissions";
+declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "signup_link_tokens";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "permissions";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3086,9 +3655,9 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "permissions";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3101,9 +3670,9 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "permissions";
+            tableName: "signup_link_tokens";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -3116,9 +3685,9 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        name: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        email: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "permissions";
+            tableName: "signup_link_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3131,13 +3700,13 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        displayName: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "permissions";
+            tableName: "signup_link_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3146,9 +3715,9 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        description: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        returnPath: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "permissions";
+            tableName: "signup_link_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3161,29 +3730,44 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        category: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.PgTextBuilder<["auth", "user", "rbac", "system", "custom"] & [string, ...string[]]>, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "permissions";
-            dataType: "string enum";
-            data: "auth" | "custom" | "user" | "rbac" | "system";
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["auth", "user", "rbac", "system", "custom"] & [string, ...string[]];
+            enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        isBuiltin: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "permissions";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3191,14 +3775,14 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        isSystem: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        setupSecretHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "permissions";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
+            tableName: "signup_link_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3206,14 +3790,14 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        isActive: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        setupExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "permissions";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3221,12 +3805,12 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        metadata: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.Set$Type<drizzle_orm_pg_core.PgJsonbBuilder, Record<string, any>>, {
+        completedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "permissions";
-            dataType: "object json";
-            data: Record<string, any>;
-            driverParam: unknown;
+            tableName: "signup_link_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
@@ -3239,27 +3823,35 @@ declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type PermissionEntity = typeof permissions.$inferSelect;
-type NewPermissionEntity = typeof permissions.$inferInsert;
-type Permission = PermissionEntity;
-type NewPermission = NewPermissionEntity;
+type SignupLinkToken = typeof signupLinkTokens.$inferSelect;
+type NewSignupLinkToken = typeof signupLinkTokens.$inferInsert;
 
 /**
- * @spfn/auth - Role-Permissions Mapping Entity
+ * @spfn/auth - Password Reset Tokens Entity
  *
- * Many-to-many relationship between roles and permissions
+ * Backs the password reset flow: a one-time link is emailed to an address the
+ * account has already proved, opening it mints a short-lived setup session, and
+ * setting a password on that session replaces the old one and signs the browser
+ * in.
  *
- * Usage:
- * - Defines which permissions each role has
- * - Cascade delete when role or permission is deleted
+ * A separate table from `signup_link_tokens` even though the two carry the same
+ * columns. They are the same shape, not the same thing: one names an address
+ * that has no account and the other names a user that does, and the setup
+ * secrets they mint must not be interchangeable. Sharing one table would make
+ * "which flow is this row" a per-row property that the lookup would have to
+ * remember to filter on — and a lookup that forgets would accept a signup secret
+ * as a reset secret.
+ *
+ * The link token and the setup secret are bearer credentials, so only their
+ * SHA-256 hashes are stored.
  */
-declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "role_permissions";
+declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "password_reset_tokens";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "role_permissions";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3272,9 +3864,9 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "role_permissions";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3287,9 +3879,9 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "role_permissions";
+            tableName: "password_reset_tokens";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -3302,9 +3894,9 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        roleId: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        userId: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
             name: string;
-            tableName: "role_permissions";
+            tableName: "password_reset_tokens";
             dataType: "number int53";
             data: number;
             driverParam: string | number;
@@ -3317,12 +3909,12 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        permissionId: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        email: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "role_permissions";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
+            tableName: "password_reset_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -3332,38 +3924,14 @@ declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-    };
-    dialect: "pg";
-}>;
-type RolePermission = typeof rolePermissions.$inferSelect;
-type NewRolePermission = typeof rolePermissions.$inferInsert;
-
-/**
- * @spfn/auth - User-Permissions Override Entity
- *
- * Per-user permission grants/revocations
- *
- * Features:
- * - Grant additional permissions to specific users
- * - Revoke role-inherited permissions from specific users
- * - Temporary permissions with expiration
- * - Audit trail with reason field
- *
- * Priority:
- * User permissions override role permissions
- */
-declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_permissions";
-    schema: string;
-    columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "object date";
-            data: Date;
+            tableName: "password_reset_tokens";
+            dataType: "string";
+            data: string;
             driverParam: string;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3371,14 +3939,14 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        returnPath: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "object date";
-            data: Date;
+            tableName: "password_reset_tokens";
+            dataType: "string";
+            data: string;
             driverParam: string;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3386,14 +3954,14 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "number int53";
-            data: number;
-            driverParam: number;
+            tableName: "password_reset_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3401,13 +3969,13 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
+            tableName: "password_reset_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3416,13 +3984,13 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        permissionId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
+            tableName: "password_reset_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3431,14 +3999,14 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        granted: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        setupSecretHash: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
+            tableName: "password_reset_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3446,11 +4014,11 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        reason: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        setupExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "user_permissions";
-            dataType: "string";
-            data: string;
+            tableName: "password_reset_tokens";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -3461,9 +4029,859 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTimestampBuilder, {
+        completedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "user_permissions";
+            tableName: "password_reset_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type PasswordResetToken = typeof passwordResetTokens.$inferSelect;
+type NewPasswordResetToken = typeof passwordResetTokens.$inferInsert;
+
+/**
+ * @spfn/auth - WebAuthn Challenges Entity
+ *
+ * The random value an authenticator signs, parked between the `options` call
+ * that minted it and the `verify` call that spends it.
+ *
+ * In the database rather than in a cookie or in memory, for two reasons: the
+ * check that makes a challenge one-time has to be a conditional UPDATE that two
+ * concurrent verifies cannot both win, and several API instances serve the same
+ * browser — an in-process map would let a replay land on the instance that never
+ * saw the first attempt.
+ *
+ * Only the SHA-256 of the challenge is stored, following the rule the package
+ * already applies to signup link tokens. A challenge is a nonce rather than a
+ * bearer credential, so this buys less than it does there; it costs nothing, and
+ * it keeps "plaintext or hash" from becoming a per-table judgement call.
+ */
+/**
+ * Which ceremony the challenge was minted for.
+ *
+ * Recorded and matched at consume time so a registration challenge cannot be
+ * presented to `login/verify` or the other way round — the two ceremonies
+ * authorize very different things, and only the kind tells them apart once the
+ * value itself is just 32 random bytes.
+ */
+declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication"];
+type WebAuthnChallengeKind = typeof WEBAUTHN_CHALLENGE_KINDS[number];
+declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "webauthn_challenges";
+    schema: string;
+    columns: {
+        id: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        challengeHash: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "string enum";
+            data: "registration" | "authentication";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["registration", "authentication"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.PgBigInt53Builder, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type WebAuthnChallenge = typeof webauthnChallenges.$inferSelect;
+type NewWebAuthnChallenge = typeof webauthnChallenges.$inferInsert;
+
+/**
+ * @spfn/auth - Device Authorizations Entity
+ *
+ * Backs device-code login: a device with no key on file yet parks its public key
+ * here, shows a short code, and an already-authenticated device approves it. The
+ * parked key is registered against the approving user's account when the waiting
+ * device polls.
+ *
+ * The pending key material duplicates the `user_public_keys` columns rather than
+ * writing a row there early. A key in `user_public_keys` can sign requests, and
+ * nothing about a row here has been approved yet — one table means "registered"
+ * and the other means "asked to be", and neither is a state of the other.
+ *
+ * Nothing sweeps this table. Rows are judged by `expiresAt` on read, so a stale
+ * row cannot authorize anything; it only keeps its user code out of circulation,
+ * and 31^8 codes do not run out.
+ */
+/**
+ * Lifecycle of one device-code request.
+ *
+ * Every transition is one-way and the two terminal states differ: `denied` is a
+ * refusal the waiting device is told about, `consumed` is a completed login that
+ * answers as if it never existed. `pending -> approved -> consumed` is the only
+ * path to a registered key.
+ *
+ * `denied` is also where a global revocation puts a record — a revoke-all, a
+ * password change, a deletion request — including one already approved. The
+ * account has withdrawn it, and what the waiting device is owed for that is the
+ * answer a refusal gives.
+ */
+declare const DEVICE_AUTH_STATUSES: readonly ["pending", "approved", "denied", "consumed"];
+type DeviceAuthStatus = typeof DEVICE_AUTH_STATUSES[number];
+declare const deviceAuthorizations: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "device_authorizations";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        deviceCodeHash: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userCode: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        publicKey: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        algorithm: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string enum";
+            data: "ES256" | "RS256";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ES256", "RS256"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        deviceName: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        platform: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string enum";
+            data: "ios" | "android" | "web" | "desktop";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        status: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["pending", "approved", "denied", "consumed"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "string enum";
+            data: "pending" | "approved" | "denied" | "consumed";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["pending", "approved", "denied", "consumed"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgBigInt53Builder, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        approvedAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"device_authorizations", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "device_authorizations";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type DeviceAuthorization = typeof deviceAuthorizations.$inferSelect;
+type NewDeviceAuthorization = typeof deviceAuthorizations.$inferInsert;
+
+/**
+ * @spfn/auth - Permissions Entity
+ *
+ * Granular permissions for RBAC system
+ *
+ * Features:
+ * - Built-in permissions (auth:*, user:*, rbac:*) - required for package
+ * - System permissions (preset permissions) - optional
+ * - Custom permissions (app-specific) - defined by developers
+ * - Category grouping for organization
+ */
+declare const permissions: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "permissions";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        name: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        displayName: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        description: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        category: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.PgTextBuilder<["auth", "user", "rbac", "system", "custom"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "string enum";
+            data: "auth" | "custom" | "user" | "rbac" | "system";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["auth", "user", "rbac", "system", "custom"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        isBuiltin: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        isSystem: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        isActive: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        metadata: drizzle_orm_pg_core.PgBuildColumn<"permissions", drizzle_orm_pg_core.Set$Type<drizzle_orm_pg_core.PgJsonbBuilder, Record<string, any>>, {
+            name: string;
+            tableName: "permissions";
+            dataType: "object json";
+            data: Record<string, any>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type PermissionEntity = typeof permissions.$inferSelect;
+type NewPermissionEntity = typeof permissions.$inferInsert;
+type Permission = PermissionEntity;
+type NewPermission = NewPermissionEntity;
+
+/**
+ * @spfn/auth - Role-Permissions Mapping Entity
+ *
+ * Many-to-many relationship between roles and permissions
+ *
+ * Usage:
+ * - Defines which permissions each role has
+ * - Cascade delete when role or permission is deleted
+ */
+declare const rolePermissions: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "role_permissions";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "role_permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "role_permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "role_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        roleId: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "role_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        permissionId: drizzle_orm_pg_core.PgBuildColumn<"role_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "role_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type RolePermission = typeof rolePermissions.$inferSelect;
+type NewRolePermission = typeof rolePermissions.$inferInsert;
+
+/**
+ * @spfn/auth - User-Permissions Override Entity
+ *
+ * Per-user permission grants/revocations
+ *
+ * Features:
+ * - Grant additional permissions to specific users
+ * - Revoke role-inherited permissions from specific users
+ * - Temporary permissions with expiration
+ * - Audit trail with reason field
+ *
+ * Priority:
+ * User permissions override role permissions
+ */
+declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_permissions";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        permissionId: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        granted: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        reason: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_permissions";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_permissions", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_permissions";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3482,6 +4900,666 @@ declare const userPermissions: drizzle_orm_pg_core.PgTableWithColumns<{
 type UserPermission = typeof userPermissions.$inferSelect;
 type NewUserPermission = typeof userPermissions.$inferInsert;
 
+/**
+ * @spfn/auth - OAuth 2.1 Clients Entity
+ *
+ * One row per public client that registered itself through RFC 7591 dynamic
+ * client registration — a `claude mcp add` on somebody's laptop, a `codex`
+ * install, a second copy of either on the same machine. There is no secret
+ * column because there is no secret: these clients run on the user's own
+ * device, cannot keep one, and authenticate with `token_endpoint_auth_method:
+ * "none"` plus PKCE.
+ *
+ * `oauth2_` and not `oauth_`: the `oauth` prefix in this package belongs to the
+ * social-login client we are on the other side of (Google, Kakao). Everything
+ * named `oauth2` here is the authorization server we run.
+ *
+ * Registration is unauthenticated by definition, so a row here is nothing but a
+ * claim until a user approves it. `auth.oauth2.client-purge` deletes the rows
+ * that never were: a client older than a day with no grant against it.
+ */
+declare const oauth2Clients: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_clients";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        clientId: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        clientName: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        redirectUris: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        createdIp: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_clients", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_clients";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type OAuth2Client = typeof oauth2Clients.$inferSelect;
+type NewOAuth2Client = typeof oauth2Clients.$inferInsert;
+
+/**
+ * @spfn/auth - OAuth 2.1 Grants Entity
+ *
+ * What a user actually consented to: this client, for this resource, with these
+ * scopes. Codes and tokens all hang off a grant, so it is the one row that has
+ * to be revoked to cut a CLI off — `GET /_auth/oauth2/grants` lists them and
+ * `DELETE /_auth/oauth2/grants/:id` is the button.
+ *
+ * One row per (client, user, resource). Re-consenting updates `scopes` rather
+ * than adding a second row, so a user who widens a CLI's access sees one entry
+ * for it and not a pile of them, and revoking that entry revokes everything the
+ * client holds.
+ *
+ * A global revocation — revoke-all, a password change, a password reset, a
+ * deletion request — revokes every grant the user has, for the reason device
+ * codes are refused in the same breath: a live grant still has a refresh token
+ * against it, and "sign me out everywhere" that leaves one alive has not.
+ */
+declare const oauth2Grants: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_grants";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        client: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        user: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        resource: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_grants", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_grants";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type OAuth2Grant = typeof oauth2Grants.$inferSelect;
+type NewOAuth2Grant = typeof oauth2Grants.$inferInsert;
+
+/**
+ * @spfn/auth - OAuth 2.1 Authorization Codes Entity
+ *
+ * The 60-second, single-use ticket the consent screen hands back through the
+ * client's own loopback listener, exchanged at the token endpoint for tokens.
+ *
+ * Only the SHA-256 hash is stored, as with device codes, ops tokens and signup
+ * links: a dump of this table must not let its reader finish somebody's
+ * authorization. The unique constraint on the hash doubles as the lookup index.
+ *
+ * `usedAt` is written by the same statement that reads the row, so of two token
+ * requests arriving together exactly one gets tokens. A code presented twice is
+ * the signature of a stolen code, and the second presentation revokes the whole
+ * grant rather than merely refusing — by then the thief may already hold what
+ * the first exchange produced.
+ */
+declare const oauth2AuthorizationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_authorization_codes";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        codeHash: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        grant: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        redirectUri: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        codeChallenge: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        usedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_authorization_codes", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_authorization_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type OAuth2AuthorizationCode = typeof oauth2AuthorizationCodes.$inferSelect;
+type NewOAuth2AuthorizationCode = typeof oauth2AuthorizationCodes.$inferInsert;
+
+/**
+ * @spfn/auth - OAuth 2.1 Tokens Entity
+ *
+ * Access and refresh tokens alike, one row each, distinguished by `kind`. Both
+ * are opaque — `spfn_at_<64 hex>` and `spfn_rt_<64 hex>` — because whatever
+ * verifies them is in the same process as this table, which is the same reason
+ * ops tokens, device codes and signup links are opaque. A JWT would buy
+ * stateless verification and pay for it by making revocation take effect only
+ * at expiry, and revocation here is a button the user presses.
+ *
+ * Only the SHA-256 hash is stored. The value exists in the clear exactly once,
+ * in the token response.
+ *
+ * `replacedAt` is what makes refresh rotation detectable: a rotated refresh is
+ * not deleted, it is marked, so presenting it again is distinguishable from
+ * presenting one that never existed. That presentation means the token leaked —
+ * either the client or the thief is replaying — and the answer is to revoke the
+ * grant, which kills the replacement as well.
+ */
+/**
+ * Which half of the pair a row is.
+ *
+ * One table rather than two: every rule that matters — revoked, expired, whose
+ * grant, which scopes — is the same for both, and a single `kind` column keeps
+ * "revoke everything under this grant" one statement.
+ */
+declare const OAUTH2_TOKEN_KINDS: readonly ["access", "refresh"];
+type OAuth2TokenKind = typeof OAUTH2_TOKEN_KINDS[number];
+declare const oauth2Tokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "oauth2_tokens";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        kind: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["access", "refresh"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "string enum";
+            data: "access" | "refresh";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["access", "refresh"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        grant: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        scopes: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetDimensions<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, 1>>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "string";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        replacedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"oauth2_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "oauth2_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type OAuth2Token = typeof oauth2Tokens.$inferSelect;
+type NewOAuth2Token = typeof oauth2Tokens.$inferInsert;
+
 /**
  * @spfn/auth - Auth Metadata Entity
  *
@@ -3607,10 +5685,56 @@ declare class UsersRepository extends BaseRepository {
         lastLoginAt: Date | null;
     }>;
     /**
-     * 이메일로 사용자 조회
-     * Read replica 사용
+     * Take a row lock on a user, so callers that read-then-decide serialise.
+     *
+     * `SELECT id ... FOR UPDATE` and nothing else: the value is never used, the
+     * lock is. A caller that counts an account's remaining credentials and then
+     * removes one has a read-modify-write between two statements, and two such
+     * callers racing both read the pre-removal count. Locking the owner row
+     * first makes the second one wait for the first to commit, so it counts
+     * what is actually left.
+     *
+     * Only meaningful inside a transaction — the lock is released at commit.
+     * Write primary.
+     */
+    lockById(id: number): Promise<void>;
+    /**
+     * 이메일로 사용자 조회
+     * Read replica 사용
+     */
+    findByEmail(email: string): Promise<{
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    /**
+     * 이메일로 사용자 조회 — 저장된 형태와 무관하게 찾는다.
+     *
+     * `findByEmail` asks whether a row holds this exact address; this asks
+     * whether any row *is* this address, whatever form it was written in. The
+     * difference matters to a caller that answers "no" by creating an account:
+     * a lookup that misses a row stored in another form would make a second
+     * account for a person who already has one, and the unique constraint
+     * cannot object because the two stored strings differ.
+     *
+     * Folding in the predicate means no index on `email` applies, so this is for
+     * the few addresses a caller decides about — admin seeding — not for a
+     * request path. Write primary: the answer decides whether to insert.
      */
-    findByEmail(email: string): Promise<{
+    findByEmailInAnyStoredForm(email: string): Promise<{
         deletedAt: Date | null;
         deletedBy: string | null;
         createdAt: Date;
@@ -3754,21 +5878,66 @@ declare class UsersRepository extends BaseRepository {
     create(data: NewUser): Promise<{
         email: string | null;
         phone: string | null;
-        id: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
+        passwordChangeRequired: boolean;
+        id: number;
         username: string | null;
         passwordHash: string | null;
-        passwordChangeRequired: boolean;
         roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
     }>;
+    /**
+     * User ids grouped by an address two or more rows share once folded.
+     *
+     * The whole comparison happens in the database and only the colliding groups
+     * come back, so the size of the answer is the size of the problem rather
+     * than the size of the table. `users.email` is unique, so a group of more
+     * than one can only be rows that differ by capitalization or padding —
+     * exactly the ones a rewrite cannot decide between.
+     *
+     * Every member id is returned, including a row already holding the
+     * canonical form, because the operator has to compare the accounts against
+     * each other to settle which is real.
+     *
+     * Write primary: the caller is about to rewrite rows and a replica could
+     * still be showing the pre-fix state.
+     */
+    findEmailConflictGroups(): Promise<number[][]>;
+    /**
+     * Fold every stored address to canonical form, leaving the given ids alone.
+     *
+     * One statement rather than a row at a time: the rewrite is the same
+     * expression the detection uses, so the database can do it in place. A
+     * legacy install with a large users table therefore pays one update instead
+     * of a round trip per row on the boot path, and no list of addresses is ever
+     * carried through the application.
+     *
+     * The excluded ids travel as a single array parameter, so the count of
+     * conflicts cannot run into the protocol's limit on bind parameters.
+     *
+     * One statement also means all or nothing. `users.email` is unique, so if an
+     * instance still running the old code registers a canonical address in the
+     * moment between the conflict query and this update, the update aborts and
+     * nothing is folded on this boot. The next boot sees that pair as a conflict
+     * and folds everything else, so the repair is deferred rather than lost.
+     *
+     * `lower(btrim(...))` is the SQL spelling of `normalizeEmail`. The two agree
+     * on every address this package's validation accepts (ASCII, no interior
+     * whitespace); an address outside that set — reachable only by an app
+     * writing to the repository directly — may fold differently in a database
+     * whose collation lower-cases non-ASCII letters.
+     *
+     * @param excludedIds - Rows to leave untouched, normally the conflict groups
+     * @returns How many rows were rewritten
+     */
+    normalizeEmailsExcept(excludedIds: number[]): Promise<number>;
     /**
      * 사용자 정보 업데이트
      * Write primary 사용
@@ -3869,15 +6038,15 @@ declare class UsersRepository extends BaseRepository {
     deleteById(id: number): Promise<{
         email: string | null;
         phone: string | null;
-        id: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
+        passwordChangeRequired: boolean;
+        id: number;
         username: string | null;
         passwordHash: string | null;
-        passwordChangeRequired: boolean;
         roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         lastLoginAt: Date | null;
@@ -4307,125 +6476,538 @@ declare class KeysRepository extends BaseRepository {
      */
     updateLastUsedById(id: number, identity?: ClientIdentity | null): Promise<void>;
 }
-declare const keysRepository: KeysRepository;
+declare const keysRepository: KeysRepository;
+
+/**
+ * Verification Codes Repository
+ *
+ * 인증 코드 관리를 위한 Repository
+ * BaseRepository를 상속받아 자동 트랜잭션 컨텍스트 지원 및 Read/Write 분리
+ */
+
+/**
+ * Verification Codes Repository 클래스
+ *
+ * BaseRepository를 상속받아 다음 기능을 제공:
+ * - 자동 트랜잭션 컨텍스트 감지 및 사용
+ * - Read/Write 연결 분리 (replica 활용)
+ * - 타입 안전성
+ */
+declare class VerificationCodesRepository extends BaseRepository {
+    /**
+     * Target과 Purpose로 유효한 인증 코드 조회
+     * (만료되지 않고, 사용되지 않은 코드)
+     * Read replica 사용
+     */
+    findValidByTargetAndPurpose(target: string, purpose: VerificationPurpose): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        target: string;
+        targetType: "email" | "phone";
+        code: string;
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
+        expiresAt: Date;
+        usedAt: Date | null;
+        attempts: number;
+    }>;
+    /**
+     * ID로 인증 코드 조회
+     * Read replica 사용
+     */
+    findById(id: number): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        target: string;
+        targetType: "email" | "phone";
+        code: string;
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
+        expiresAt: Date;
+        usedAt: Date | null;
+        attempts: number;
+    }>;
+    /**
+     * 인증 코드 생성
+     * Write primary 사용
+     */
+    create(data: NewVerificationCode): Promise<{
+        target: string;
+        targetType: "email" | "phone";
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
+        code: string;
+        id: number;
+        createdAt: Date;
+        updatedAt: Date;
+        expiresAt: Date;
+        usedAt: Date | null;
+        attempts: number;
+    }>;
+    /**
+     * 인증 코드 사용 처리
+     * Write primary 사용
+     */
+    markAsUsed(id: number): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        target: string;
+        targetType: "email" | "phone";
+        code: string;
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
+        expiresAt: Date;
+        usedAt: Date | null;
+        attempts: number;
+    }>;
+    /**
+     * 시도 횟수 증가
+     * Write primary 사용
+     */
+    incrementAttempts(id: number): Promise<{
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        target: string;
+        targetType: "email" | "phone";
+        code: string;
+        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
+        expiresAt: Date;
+        usedAt: Date | null;
+        attempts: number;
+    } | null>;
+    /**
+     * 만료된 코드 삭제
+     * Write primary 사용
+     */
+    deleteExpired(): Promise<number>;
+    /**
+     * Target(email/phone)의 모든 인증 코드 삭제 (계정 파기용)
+     *
+     * verificationCodes는 userId FK가 없고 target 텍스트로만 연결되므로, 파기 시
+     * 원래 email/phone을 이 메서드로 직접 정리해야 한다.
+     * Write primary 사용
+     */
+    deleteByTarget(target: string): Promise<number>;
+    /**
+     * Target의 모든 이전 코드 무효화 (새 코드 발급 시)
+     * Write primary 사용
+     */
+    invalidatePreviousCodes(target: string, purpose: VerificationPurpose): Promise<number>;
+}
+declare const verificationCodesRepository: VerificationCodesRepository;
+
+/**
+ * Signup Link Tokens Repository
+ *
+ * Data access for the verified-email signup flow. Extends BaseRepository for
+ * transaction-context detection and read/write splitting.
+ *
+ * The two claim methods (`claimLink`, `claimSetupSession`) update conditionally
+ * and return the row only if THIS call was the one that moved it. Two concurrent
+ * confirms — or two concurrent password submits — therefore produce one winner
+ * and one refusal, rather than both proceeding on a row they each read as
+ * unclaimed. Read-then-write would lose that race.
+ */
+
+declare class SignupLinkTokensRepository extends BaseRepository {
+    /**
+     * Create a signup link row.
+     * Write primary.
+     */
+    create(data: NewSignupLinkToken): Promise<SignupLinkToken>;
+    /**
+     * Create a signup link row that has no token yet.
+     *
+     * The link is minted by the `auth.link-mail` job, not by the request, so the
+     * row starts without a hash and `issue` writes one. Both delivery modes take
+     * this path, which is what keeps "a hash lands only through `issue`" true.
+     *
+     * Write primary.
+     */
+    createPending(data: {
+        email: string;
+        returnPath: string | null;
+        expiresAt: Date;
+    }): Promise<SignupLinkToken>;
+    /**
+     * Write the token hash onto a pending row, but only if the link may still be
+     * delivered: not consumed, not superseded, not completed, not expired.
+     *
+     * One statement rather than a read and a write, so a row superseded by a
+     * newer request between the two never receives a credential — the worker
+     * simply finds nothing to issue and sends no mail.
+     *
+     * @returns the issued row, or null if the row is no longer deliverable
+     */
+    issue(id: number, tokenHash: string): Promise<SignupLinkToken | null>;
+    /**
+     * Find a row by the hash of an emailed token, in any state.
+     *
+     * Deliberately unfiltered: the caller decides why a link is refused, and a
+     * row filtered out here would be indistinguishable from an unknown token in
+     * the logs.
+     *
+     * Read replica.
+     */
+    findByTokenHash(tokenHash: string): Promise<SignupLinkToken | null>;
+    /**
+     * Find a row by the hash of a setup session secret, in any state.
+     * Read replica.
+     */
+    findBySetupSecretHash(setupSecretHash: string): Promise<SignupLinkToken | null>;
+    /**
+     * Consume a link and open a setup session on it, but only if it is still
+     * unconsumed and not superseded.
+     *
+     * @returns the updated row, or null if another request claimed it first
+     */
+    claimLink(id: number, setupSecretHash: string, setupExpiresAt: Date): Promise<SignupLinkToken | null>;
+    /**
+     * Mark a setup session as completed, but only if it has not completed
+     * already.
+     *
+     * @returns the updated row, or null if another request completed it first
+     */
+    claimSetupSession(id: number): Promise<SignupLinkToken | null>;
+    /**
+     * Supersede every live link for an address, so requesting a new one
+     * invalidates the previous one and any setup session opened from it.
+     *
+     * Write primary.
+     *
+     * @returns number of rows superseded
+     */
+    supersedeLiveForEmail(email: string): Promise<number>;
+    /**
+     * Delete every signup link row for an address (account destruction).
+     *
+     * Rows key on the email text and carry no user FK, so destruction has to
+     * clean them up by address the way verification codes are cleaned up.
+     *
+     * Write primary.
+     */
+    deleteByEmail(email: string): Promise<number>;
+}
+declare const signupLinkTokensRepository: SignupLinkTokensRepository;
+
+/**
+ * Password Reset Tokens Repository
+ *
+ * Data access for the password reset flow. Extends BaseRepository for
+ * transaction-context detection and read/write splitting.
+ *
+ * `consume` and `complete` update conditionally and return the row only if THIS
+ * call was the one that moved it. Two concurrent confirms — or two concurrent
+ * password submits — therefore produce one winner and one refusal, rather than
+ * both proceeding on a row they each read as unclaimed. Read-then-write would
+ * lose that race.
+ *
+ * The `findLive*` lookups filter to usable rows rather than returning anything
+ * they find. Every refusal on this flow is the same 401 whatever caused it, so
+ * there is nothing for a caller to learn from the difference — and a filter in
+ * the query cannot be forgotten by a caller the way a state check can.
+ */
+
+declare class PasswordResetTokensRepository extends BaseRepository {
+    /**
+     * Create a reset link row.
+     * Write primary.
+     */
+    create(data: NewPasswordResetToken): Promise<PasswordResetToken>;
+    /**
+     * Create a reset link row that has no token yet.
+     *
+     * The link is minted by the `auth.link-mail` job, not by the request, so the
+     * row starts without a hash and `issue` writes one. Both delivery modes take
+     * this path, which is what keeps "a hash lands only through `issue`" true.
+     *
+     * Write primary.
+     */
+    createPending(data: {
+        userId: number;
+        email: string;
+        returnPath: string | null;
+        expiresAt: Date;
+    }): Promise<PasswordResetToken>;
+    /**
+     * Write the token hash onto a pending row, but only if the link may still be
+     * delivered: not consumed, not superseded, not completed, not expired.
+     *
+     * One statement rather than a read and a write, so a row superseded by a
+     * newer request between the two never receives a credential — the worker
+     * simply finds nothing to issue and sends no mail.
+     *
+     * @returns the issued row, or null if the row is no longer deliverable
+     */
+    issue(id: number, tokenHash: string): Promise<PasswordResetToken | null>;
+    /**
+     * Find a link that can still be exchanged for a setup session: unconsumed,
+     * not superseded, not completed, not expired.
+     *
+     * Read replica.
+     */
+    findLiveByTokenHash(tokenHash: string): Promise<PasswordResetToken | null>;
+    /**
+     * Find a setup session that can still be used to set a password.
+     * Read replica.
+     */
+    findLiveSetupBySecretHash(setupSecretHash: string): Promise<PasswordResetToken | null>;
+    /**
+     * Consume a link and open a setup session on it, but only if it is still
+     * unconsumed and not superseded.
+     *
+     * @returns the updated row, or null if another request claimed it first
+     */
+    consume(id: number, setupSecretHash: string, setupExpiresAt: Date): Promise<PasswordResetToken | null>;
+    /**
+     * Mark a setup session as completed, but only if it has not completed
+     * already.
+     *
+     * @returns the updated row, or null if another request completed it first
+     */
+    complete(id: number): Promise<PasswordResetToken | null>;
+    /**
+     * Supersede every live link for an account, so requesting a new one
+     * invalidates the previous one and any setup session opened from it.
+     *
+     * Write primary.
+     *
+     * @returns number of rows superseded
+     */
+    supersedeAllLiveByUserId(userId: number): Promise<number>;
+}
+declare const passwordResetTokensRepository: PasswordResetTokensRepository;
+
+/**
+ * Passkeys Repository
+ *
+ * Data access for enrolled WebAuthn credentials. Extends BaseRepository for
+ * transaction-context detection and read/write splitting.
+ *
+ * Two lookups by credential id, deliberately separate. `findLiveByCredentialId`
+ * is the login path and must see only credentials that can still sign.
+ * `existsByCredentialId` is the enrollment path and must see revoked rows too,
+ * because a credential someone cut off stays reserved forever (D5) — one query
+ * serving both would have to pick a filter, and each caller needs the other one.
+ */
+
+declare class PasskeysRepository extends BaseRepository {
+    /**
+     * Enroll a credential.
+     * Write primary.
+     */
+    create(data: NewPasskey): Promise<Passkey>;
+    /**
+     * The live credential with this id, whoever owns it.
+     *
+     * Unfiltered by user on purpose: a discoverable sign-in names no account, so
+     * the credential is what identifies the owner.
+     *
+     * Write primary — the login path reads it inside the transaction that then
+     * moves its counter.
+     */
+    findLiveByCredentialId(credentialId: string): Promise<Passkey | null>;
+    /**
+     * Whether this credential id is taken on any account, live or revoked.
+     * Write primary — enrollment decides on it inside its own transaction.
+     */
+    existsByCredentialId(credentialId: string): Promise<boolean>;
+    /**
+     * One owner's live credentials, newest first.
+     * Write primary — both callers (the exclude list, the last-credential guard)
+     * decide something inside a transaction on what they read here.
+     */
+    listLiveByUserId(userId: number): Promise<Passkey[]>;
+    /**
+     * One live credential owned by this user.
+     * Owner-scoped, so an id belonging to someone else answers null rather than
+     * a row — a management route can only ever say "not yours".
+     */
+    findLiveByIdAndUserId(id: number, userId: number): Promise<Passkey | null>;
+    /**
+     * Record a successful assertion.
+     * Write primary.
+     */
+    recordUse(id: number, counter: number): Promise<void>;
+    /**
+     * Rename, but only a credential this user still owns and has not revoked.
+     *
+     * @returns the updated row, or null if it is not theirs or already revoked
+     */
+    renameByIdAndUserId(id: number, userId: number, label: string): Promise<Passkey | null>;
+    /**
+     * Retire a credential, but only if THIS call is the one that retired it.
+     *
+     * Conditional on `revokedAt IS NULL`, so two concurrent revokes produce one
+     * winner and one 404 rather than both reporting success on a row only one of
+     * them moved.
+     *
+     * @returns the updated row, or null if it is not theirs or already revoked
+     */
+    revokeByIdAndUserId(id: number, userId: number, reason: string): Promise<Passkey | null>;
+    /**
+     * Delete every passkey of an account (account destruction).
+     * Write primary.
+     *
+     * @returns number of rows deleted
+     */
+    deleteAllByUserId(userId: number): Promise<number>;
+}
+declare const passkeysRepository: PasskeysRepository;
 
 /**
- * Verification Codes Repository
+ * WebAuthn Challenges Repository
  *
- * 인증 코드 관리를 위한 Repository
- * BaseRepository를 상속받아 자동 트랜잭션 컨텍스트 지원 및 Read/Write 분리
+ * Data access for the one-time nonces the two WebAuthn ceremonies hand out.
+ * Extends BaseRepository for transaction-context detection and read/write
+ * splitting.
+ *
+ * `consume` is one conditional UPDATE and returns the row only if THIS call was
+ * the one that spent it. Read-then-write would lose that race: two verifies
+ * arriving with the same challenge would both read it as live and both proceed,
+ * which is the replay the challenge exists to stop.
  */
 
+declare class WebAuthnChallengesRepository extends BaseRepository {
+    /**
+     * Park a freshly minted challenge.
+     * Write primary.
+     */
+    create(data: NewWebAuthnChallenge): Promise<WebAuthnChallenge>;
+    /**
+     * Spend a challenge, if it is still live and was minted for this ceremony.
+     *
+     * The whole refusal — unknown, expired, already spent, wrong kind — is this
+     * one statement's WHERE clause, so nothing can read a challenge as usable in
+     * one step and spend it in another. The caller compares `userId` on the row
+     * it gets back; that is the one condition left outside, because a
+     * discoverable login has no user to match and must still spend the row.
+     *
+     * @returns the row this call spent, or null if there was nothing to spend
+     */
+    consume(challengeHash: string, kind: WebAuthnChallengeKind): Promise<WebAuthnChallenge | null>;
+    /**
+     * Drop challenges nobody can present any more.
+     *
+     * Write primary.
+     *
+     * @returns number of rows deleted
+     */
+    deleteExpired(): Promise<number>;
+}
+declare const webauthnChallengesRepository: WebAuthnChallengesRepository;
+
 /**
- * Verification Codes Repository 클래스
+ * Device Authorizations Repository
  *
- * BaseRepository를 상속받아 다음 기능을 제공:
- * - 자동 트랜잭션 컨텍스트 감지 및 사용
- * - Read/Write 연결 분리 (replica 활용)
- * - 타입 안전성
+ * Data access for device-code login. Extends BaseRepository for transaction
+ * context detection and read/write splitting.
+ *
+ * Every state change here is a conditional UPDATE naming the exact state it is
+ * allowed to move from, returning the row only when THIS call was the one that
+ * moved it. That is what makes the operations safe to race: two polls on one
+ * approved record, or a deny arriving while an approve is in flight, produce one
+ * winner and one refusal instead of both callers acting on a row they each read
+ * as still theirs to move. Read-then-write would lose that.
+ *
+ * Each of those transitions also carries the TTL, as `now()` evaluated by the
+ * database. The service reads a record before it acts on it, and a record can
+ * pass its expiry in the gap between that read and this UPDATE — an approved one
+ * most of all, since the poll that spends it is the one call that registers a
+ * key. Judging the clock only in the read would let that key be registered after
+ * the code was dead.
  */
-declare class VerificationCodesRepository extends BaseRepository {
-    /**
-     * Target과 Purpose로 유효한 인증 코드 조회
-     * (만료되지 않고, 사용되지 않은 코드)
-     * Read replica 사용
-     */
-    findValidByTargetAndPurpose(target: string, purpose: VerificationPurpose): Promise<{
-        createdAt: Date;
-        updatedAt: Date;
-        id: number;
-        target: string;
-        targetType: "email" | "phone";
-        code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-        expiresAt: Date;
-        usedAt: Date | null;
-        attempts: number;
-    }>;
+
+declare class DeviceAuthorizationsRepository extends BaseRepository {
     /**
-     * ID로 인증 코드 조회
-     * Read replica 사용
+     * Insert a pending authorization, unless one of its codes is already taken.
+     *
+     * `onConflictDoNothing` rather than letting the unique index raise: the start
+     * route runs inside a transaction, and a raised unique violation aborts it,
+     * so the retry that a generated-code collision calls for could not run — every
+     * statement after it would fail with "current transaction is aborted" instead.
+     * An empty result is the collision signal, and the caller draws a fresh code.
+     *
+     * Write primary.
+     *
+     * @returns the inserted row, or null if either code collided
      */
-    findById(id: number): Promise<{
-        createdAt: Date;
-        updatedAt: Date;
-        id: number;
-        target: string;
-        targetType: "email" | "phone";
-        code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-        expiresAt: Date;
-        usedAt: Date | null;
-        attempts: number;
-    }>;
+    create(data: NewDeviceAuthorization): Promise<DeviceAuthorization | null>;
     /**
-     * 인증 코드 생성
-     * Write primary 사용
+     * Find a record by its normalized user code, in any state.
+     *
+     * Deliberately unfiltered: which refusal a caller is owed — expired, already
+     * handled, unknown — is the service's decision, and a row filtered out here
+     * would be indistinguishable from a code that was never issued.
+     *
+     * Read replica.
      */
-    create(data: NewVerificationCode): Promise<{
-        target: string;
-        targetType: "email" | "phone";
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-        code: string;
-        id: number;
-        createdAt: Date;
-        updatedAt: Date;
-        expiresAt: Date;
-        usedAt: Date | null;
-        attempts: number;
-    }>;
+    findByUserCode(userCode: string): Promise<DeviceAuthorization | null>;
     /**
-     * 인증 코드 사용 처리
-     * Write primary 사용
+     * Find a record by the hash of a device code, in any state.
+     * Unfiltered for the same reason as `findByUserCode`.
+     *
+     * Read replica.
      */
-    markAsUsed(id: number): Promise<{
-        createdAt: Date;
-        updatedAt: Date;
-        id: number;
-        target: string;
-        targetType: "email" | "phone";
-        code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-        expiresAt: Date;
-        usedAt: Date | null;
-        attempts: number;
-    }>;
+    findByDeviceCodeHash(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
     /**
-     * 시도 횟수 증가
-     * Write primary 사용
+     * Bind the approving user and move the record to `approved`, but only from
+     * `pending`.
+     *
+     * `userId` comes from the approver's authenticated session — never from a
+     * request body — so this is the point where the record gains an owner.
+     *
+     * @returns the updated row, or null if it was no longer pending, or expired
      */
-    incrementAttempts(id: number): Promise<{
-        createdAt: Date;
-        updatedAt: Date;
-        id: number;
-        target: string;
-        targetType: "email" | "phone";
-        code: string;
-        purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-        expiresAt: Date;
-        usedAt: Date | null;
-        attempts: number;
-    } | null>;
+    approve(id: number, userId: number): Promise<DeviceAuthorization | null>;
     /**
-     * 만료된 코드 삭제
-     * Write primary 사용
+     * Move the record to `denied`, but only from `pending`.
+     *
+     * No user is bound: a refusal should leave no record of who was asked.
+     *
+     * @returns the updated row, or null if it was no longer pending, or expired
      */
-    deleteExpired(): Promise<number>;
+    deny(id: number): Promise<DeviceAuthorization | null>;
     /**
-     * Target(email/phone)의 모든 인증 코드 삭제 (계정 파기용)
+     * Refuse every authorization a user still has in flight.
      *
-     * verificationCodes는 userId FK가 없고 target 텍스트로만 연결되므로, 파기 시
-     * 원래 email/phone을 이 메서드로 직접 정리해야 한다.
-     * Write primary 사용
+     * This is the device-code half of a global revocation. Revoking
+     * `user_public_keys` alone leaves an approved-but-uncollected record behind,
+     * and the next poll on it registers a brand-new active key — so "sign every
+     * device out" would hand one straight back to whoever was still waiting,
+     * which is exactly the person a revoke-all is usually aimed at.
+     *
+     * `denied` rather than a status of its own: a swept record owes its holder
+     * the answer a refused one owes, on all four operations — the waiting device
+     * is told no and stops polling, and info/approve/deny say the request was
+     * already answered. Adding a fourth live status would add a migration and a
+     * case-table row to record a distinction nothing acts on.
+     *
+     * Expired rows are swept too. A global revoke is not the place to reason
+     * about which dead rows were about to die anyway.
+     *
+     * `pending` alongside `approved` even though a pending row carries no
+     * `userId` today, so only approved rows can match: the state list says which
+     * states this is meant to close, and a later change that binds the user
+     * earlier should not silently reopen the hole.
+     *
+     * @returns the rows this call refused
      */
-    deleteByTarget(target: string): Promise<number>;
+    denyAllActiveByUserId(userId: number): Promise<DeviceAuthorization[]>;
     /**
-     * Target의 모든 이전 코드 무효화 (새 코드 발급 시)
-     * Write primary 사용
+     * Spend an approved record, but only from `approved`, and address it by the
+     * device code hash the caller actually presented.
+     *
+     * This is the one-shot: the winner of two concurrent polls registers the key,
+     * and the loser sees no approved record and is answered as if the code were
+     * unknown. Matching on the hash rather than on an id read a moment ago keeps
+     * the whole decision in one statement.
+     *
+     * @returns the spent row, or null if it was not approved (any more), or expired
      */
-    invalidatePreviousCodes(target: string, purpose: VerificationPurpose): Promise<number>;
+    consumeApproved(deviceCodeHash: string): Promise<DeviceAuthorization | null>;
 }
-declare const verificationCodesRepository: VerificationCodesRepository;
+declare const deviceAuthorizationsRepository: DeviceAuthorizationsRepository;
 
 /**
  * Roles Repository
@@ -5144,12 +7726,12 @@ declare class InvitationsRepository extends BaseRepository {
     create(data: NewInvitation): Promise<{
         email: string;
         metadata: Record<string, any> | null;
+        token: string;
+        status: "pending" | "accepted" | "expired" | "cancelled";
         id: number;
         roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "pending" | "accepted" | "expired" | "cancelled";
-        token: string;
         invitedBy: number;
         expiresAt: Date;
         acceptedAt: Date | null;
@@ -5178,12 +7760,12 @@ declare class InvitationsRepository extends BaseRepository {
     deleteById(id: number): Promise<{
         email: string;
         metadata: Record<string, any> | null;
+        token: string;
+        status: "pending" | "accepted" | "expired" | "cancelled";
         id: number;
         roleId: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "pending" | "accepted" | "expired" | "cancelled";
-        token: string;
         invitedBy: number;
         expiresAt: Date;
         acceptedAt: Date | null;
@@ -5572,18 +8154,18 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
      * Write primary 사용
      */
     create(data: NewAccountDeletionRequest): Promise<{
+        status: "pending" | "cancelled" | "completed";
         userId: number | null;
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        status: "pending" | "cancelled" | "completed";
         reason: string | null;
         purgeScheduledAt: Date;
         cancelledAt: Date | null;
+        completedAt: Date | null;
         userPublicId: string;
         requestedAt: Date;
         requestedBy: "admin" | "self";
-        completedAt: Date | null;
         purgeStrategy: "anonymize" | "hard-delete" | null;
     }>;
     /**
@@ -5668,6 +8250,279 @@ declare class OpsTokensRepository extends BaseRepository {
 }
 declare const opsTokensRepository: OpsTokensRepository;
 
+/**
+ * OAuth 2.1 Clients Repository
+ *
+ * Data access for dynamically registered public clients. Extends BaseRepository
+ * for transaction context and read/write splitting like every other auth
+ * repository.
+ */
+
+declare class OAuth2ClientsRepository extends BaseRepository {
+    create(data: NewOAuth2Client): Promise<OAuth2Client>;
+    /**
+     * Lookup by the public `client_id` — the authorize and token paths.
+     *
+     * Reads the primary, not the replica, for the reason the ops-token lookup
+     * does: a client registered a moment ago is immediately used, and a replica
+     * read would answer "unknown client" for the length of the replication lag,
+     * at the one moment a CLI is being connected.
+     */
+    findByClientId(clientId: string): Promise<OAuth2Client | null>;
+    /** Fire-and-forget from the token-issuing path. */
+    updateLastUsedById(id: number): Promise<void>;
+    /**
+     * Register a client unless this address is already at its standing cap.
+     *
+     * The count and the insert are one transaction whose first statement takes
+     * an advisory lock on the address, and all three parts are load-bearing.
+     * Counting on the replica lets replication lag hand out slots that are
+     * already taken. Counting and inserting in two statements lets a second
+     * registration read the same total between them. And a transaction alone
+     * does not close that: under READ COMMITTED each concurrent transaction
+     * counts the rows the others have not committed yet, so twenty requests
+     * arriving together all see zero. The lock is the only part that makes the
+     * cap a number rather than an average, and it is per address, so it costs
+     * nobody else anything.
+     *
+     * @param data - The row to write when there is room for it
+     * @param limit - The address, its cap, and how far back the cap looks
+     * @returns the registered client, or null when the address is at its cap
+     */
+    createWithinStandingCap(data: NewOAuth2Client, limit: {
+        ip: string;
+        max: number;
+        windowMs: number;
+    }): Promise<OAuth2Client | null>;
+    /**
+     * How many clients this IP registered within the window that nobody has
+     * approved yet.
+     *
+     * The window is what makes this a standing-population cap rather than a
+     * permanent quota. Rows are only freed by the purge job, which sweeps once
+     * a day against a 24-hour threshold — so without a window a row registered
+     * a minute after one sweep holds its slot for nearly two days, and twenty
+     * developers behind one NAT lock their whole office out of registering.
+     * A grant against the client takes it out of the count at any age: a client
+     * somebody approved is not junk.
+     *
+     * Reads the primary, inside the caller's transaction, for the reason
+     * `findByClientId` does — a row written a moment ago is exactly the row this
+     * count exists to see.
+     */
+    private countRecentUngrantedByIp;
+    /**
+     * Delete clients older than `before` that no user ever approved.
+     *
+     * A registration is an unauthenticated write, so the table fills with rows
+     * from installs that were abandoned at the consent screen. A row with a
+     * grant against it is never touched, whatever its age — that is somebody's
+     * connected CLI.
+     *
+     * @returns how many rows this sweep removed
+     */
+    deleteStaleUngranted(before: Date): Promise<number>;
+}
+declare const oauth2ClientsRepository: OAuth2ClientsRepository;
+
+/**
+ * OAuth 2.1 Grants Repository
+ *
+ * Data access for the consent records every code and token hangs off.
+ *
+ * Revocation is the operation that matters here, and it is always one statement
+ * per table rather than a read-then-write: a grant being revoked at the same
+ * moment as a refresh rotation must not let the rotation's successor survive,
+ * and `where revoked_at is null` in the UPDATE is what makes the two orderings
+ * produce the same end state.
+ */
+
+/** A grant with the client it belongs to — what every list and lookup needs. */
+interface OAuth2GrantWithClient {
+    grant: OAuth2Grant;
+    client: OAuth2Client;
+}
+declare class OAuth2GrantsRepository extends BaseRepository {
+    /**
+     * Record a consent, or refresh the scopes of the one already there.
+     *
+     * Re-consenting is an upsert and not an insert: the unique index on
+     * (client, user, resource) says one consent per triple, and a user who
+     * approves a wider scope set is amending the consent they already gave, not
+     * giving a second one. Revoking the entry they can see must revoke
+     * everything the client holds, which a second row would break.
+     *
+     * `revokedAt: null` in the update is deliberate — approving again after
+     * revoking is how a user reconnects a CLI they cut off.
+     */
+    upsert(data: NewOAuth2Grant): Promise<OAuth2Grant>;
+    /**
+     * A grant and its client in one read — the shape the token and verification
+     * paths need, since both have to check the client the caller claims and the
+     * grant's revocation at once.
+     *
+     * Read primary: revocation is documented as taking effect immediately.
+     */
+    findWithClientById(id: number): Promise<OAuth2GrantWithClient | null>;
+    /** What the user's "connected apps" screen lists. Read replica. */
+    listActiveByUserId(userId: number): Promise<OAuth2GrantWithClient[]>;
+    /**
+     * Revoke one live grant belonging to one user.
+     *
+     * The user id is part of the condition rather than checked beforehand: the
+     * id in the URL comes from a caller, and a grant that is not theirs must not
+     * be revocable by guessing a number. A miss is indistinguishable from an id
+     * that does not exist, which is the answer the route gives.
+     *
+     * @returns the revoked row, or null if there was no live grant of that id
+     *          for that user
+     */
+    revokeByIdForUser(id: number, userId: number): Promise<OAuth2Grant | null>;
+    /** Revoke one grant by id, whoever it belongs to — the replay detections. */
+    revokeById(id: number): Promise<OAuth2Grant | null>;
+    /**
+     * Revoke every live grant a user has — the authorization-server half of a
+     * global revocation, beside `denyAllActiveByUserId`.
+     *
+     * @returns the grant ids this call revoked
+     */
+    revokeAllActiveByUserId(userId: number): Promise<number[]>;
+    /**
+     * Revoke every live token under the given grants.
+     *
+     * Verification already refuses a token whose grant is revoked, so this is
+     * belt and braces — but the belt is what a `SELECT` against this table shows
+     * an operator, and a live-looking row under a dead grant reads as a hole.
+     *
+     * @returns how many tokens this call revoked
+     */
+    revokeTokensOfGrants(grantIds: number[]): Promise<number>;
+}
+declare const oauth2GrantsRepository: OAuth2GrantsRepository;
+
+/**
+ * OAuth 2.1 Authorization Codes Repository
+ *
+ * Two operations and one of them is the whole point. `consume` is a conditional
+ * UPDATE that names unspent and not-expired and writes `used_at` in the same
+ * statement that reads the row, so of two token requests racing on one code
+ * exactly one comes back with a row. Read-then-write would hand both of them
+ * tokens.
+ *
+ * The TTL travels in that statement as `now()` evaluated by the database, for
+ * the reason the device-code transitions carry theirs: the row is judged by the
+ * same clock that stores it, so an app server whose clock drifted cannot extend
+ * a code's life.
+ *
+ * `findByCodeHash` exists only to explain a miss. A code that is simply unknown
+ * and one that was already spent get the same answer at the endpoint —
+ * `invalid_grant` either way — but the spent one also revokes the grant, and
+ * that decision needs the row.
+ */
+
+declare class OAuth2AuthorizationCodesRepository extends BaseRepository {
+    create(data: NewOAuth2AuthorizationCode): Promise<OAuth2AuthorizationCode>;
+    /**
+     * Spend a code, addressed by the hash the caller actually presented.
+     *
+     * @returns the row this call spent, or null when it was unknown, already
+     *          spent, or past its 60 seconds
+     */
+    consume(codeHash: string): Promise<OAuth2AuthorizationCode | null>;
+    /**
+     * The row behind a miss, in any state. Deliberately unfiltered — which
+     * refusal is owed is the service's decision, and a row filtered out here
+     * would be indistinguishable from a code that never existed.
+     */
+    findByCodeHash(codeHash: string): Promise<OAuth2AuthorizationCode | null>;
+}
+declare const oauth2AuthorizationCodesRepository: OAuth2AuthorizationCodesRepository;
+
+/**
+ * OAuth 2.1 Tokens Repository
+ *
+ * Access and refresh rows, and the rotation that turns one refresh into the
+ * next.
+ *
+ * `rotate` is the code-consuming statement again, in the other table: mark the
+ * presented refresh `replaced_at` only if it is live, and return it only when
+ * THIS call was the one that marked it. Two clients refreshing the same token at
+ * once therefore produce one rotation and one refusal, instead of two token
+ * pairs off one refresh.
+ *
+ * Nothing is deleted. A rotated refresh keeps its row so that presenting it
+ * again is distinguishable from presenting a token that never existed, which is
+ * the entire reuse detection.
+ */
+
+declare class OAuth2TokensRepository extends BaseRepository {
+    create(data: NewOAuth2Token): Promise<OAuth2Token>;
+    /**
+     * Lookup by the token's hash — the verification and refresh paths.
+     *
+     * Primary, not replica: revocation is a button the user presses and is
+     * documented as taking effect immediately, so a replica read would keep
+     * authenticating a revoked token for the length of the replication lag.
+     * Unfiltered, so the service can tell revoked from expired from unknown.
+     */
+    findByTokenHash(tokenHash: string): Promise<OAuth2Token | null>;
+    /**
+     * Mark a live refresh token as replaced, addressed by its hash.
+     *
+     * @returns the row this call replaced, or null when it was unknown, already
+     *          rotated, revoked, or expired
+     */
+    rotate(tokenHash: string): Promise<OAuth2Token | null>;
+    /**
+     * Revoke a live token by hash — RFC 7009.
+     *
+     * @returns the revoked row, or null when there was nothing live to revoke.
+     *          The endpoint answers 200 either way; the caller learns nothing
+     *          about whether the value it presented ever existed.
+     */
+    revokeByTokenHash(tokenHash: string): Promise<OAuth2Token | null>;
+    /** Fire-and-forget from the verification path, as ops tokens do. */
+    updateLastUsedById(id: number): Promise<void>;
+}
+declare const oauth2TokensRepository: OAuth2TokensRepository;
+
+/**
+ * @spfn/auth - Email address normalization
+ *
+ * One canonical form for an address, applied on the way in AND on the way out,
+ * so `Foo@Example.com` and `foo@example.com` are the same account everywhere.
+ *
+ * Both sides have to agree or normalization makes things worse rather than
+ * better: normalizing only the lookup means an address stored in mixed case can
+ * no longer be found, and normalizing only the write means an old row stays
+ * unreachable. `UsersRepository` therefore applies this to every read and every
+ * write of `users.email`, which is what keeps a call site from forgetting.
+ */
+/**
+ * Trim and lower-case an address.
+ *
+ * Nothing else. Two normalizations that look tempting are deliberately absent:
+ * stripping dots and cutting at `+` are Gmail delivery rules, not internet ones,
+ * and applying them would merge addresses that other providers treat as
+ * genuinely different people.
+ *
+ * The local part is technically case-sensitive per RFC 5321, but no mail
+ * provider in practice treats it that way, while users routinely retype their
+ * address with different capitalization. Matching the practice avoids duplicate
+ * accounts; honouring the RFC creates them.
+ *
+ * @param email - Address as supplied
+ * @returns The canonical form used for storage and lookup
+ */
+declare function normalizeEmail(email: string): string;
+/**
+ * Normalize when there is an address, pass null/undefined through untouched.
+ *
+ * Accounts registered by phone have no email, and `null` is meaningfully
+ * different from `''` in that column.
+ */
+declare function normalizeOptionalEmail<T extends string | null | undefined>(email: T): T;
+
 /**
  * @spfn/auth - Password Helpers
  *
@@ -5864,6 +8719,23 @@ declare function decodeToken(token: string): TokenPayload | null;
  * ```
  */
 declare function verifyKeyFingerprint(publicKeyB64: string, expectedFingerprint: string): boolean;
+/**
+ * Refuses a public key whose SPKI type is not the one its declared algorithm
+ * needs, before the key is stored.
+ *
+ * The algorithm column is what proof verification later reads, and nothing
+ * re-derives it from the key material — so an EC key parked as RS256 is
+ * accepted at enrollment and fails on every request afterwards, with the device
+ * already believing it is enrolled. Refusing at registration is what keeps that
+ * mismatch from ever being written.
+ *
+ * Bytes that are no SPKI public key at all are refused the same way: the parser
+ * throws on them, and an unreadable key is the same defect as a mismatched one.
+ * Neither is a server fault, so both answer 400 rather than falling out as a 500.
+ *
+ * @throws KeyAlgorithmMismatchError when the key is not the algorithm's type.
+ */
+declare function assertKeyMatchesAlgorithm(publicKeyB64: string, algorithm: KeyAlgorithmType): void;
 
 /**
  * @spfn/auth - Permission Middleware
@@ -6061,6 +8933,86 @@ declare const opsTokenAuth: _spfn_core_route.NamedMiddleware<"opsTokenAuth">;
  */
 declare const requireOpsScope: _spfn_core_route.NamedMiddlewareFactory<"opsScope", string[]>;
 
+/**
+ * @spfn/auth - One route, two credentials
+ *
+ * An operator action is scripted today (the CLI, holding an ops token) and
+ * driven from an admin console tomorrow (a browser, holding a user session).
+ * That is one route with two admissible credentials, and neither existing
+ * middleware admits both: `authenticate` refuses an `spfn_ops_` bearer before
+ * any scope guard runs (#79 — the user path never admits a machine
+ * credential), and `opsTokenAuth` admits nothing else. `opsOrUser` composes
+ * the two existing pairs behind one middleware so an application does not
+ * hand-write the branch.
+ *
+ * The rules it keeps:
+ *
+ * - **The branch is chosen by credential shape, never by caller choice.** The
+ *   raw `Authorization` bearer is tested with `isOpsToken`; a match takes the
+ *   ops branch, everything else (user JWT, another machine namespace,
+ *   malformed, absent) takes the user branch. A caller cannot select the
+ *   weaker check by asking for it, because nothing in the request selects a
+ *   branch except the credential it presents.
+ * - **`roles` and `permissions` are AND, roles first.** Two lists only ever
+ *   narrow. An OR would mean one added role voids the whole permission list,
+ *   which is the opposite of what a reader of the two lists expects. Roles run
+ *   first because the role is already on the auth context while permissions
+ *   cost a lookup — and so a caller with the wrong role is refused for the
+ *   wrong role.
+ * - **No implicit admin bypass.** Permissions match by name only, and the ops
+ *   branch has no role concept, so neither branch has a principal that passes
+ *   by virtue of being an administrator.
+ * - **A refusal is the selected branch's own refusal.** No error class and no
+ *   wire message is introduced here; whichever guard refused answers exactly
+ *   what it answers on a single-credential route.
+ * - **It is a `NamedMiddleware`, not a `defineMiddleware` factory.** A factory
+ *   produces a bare handler, and `register-routes` reads `skips` only off a
+ *   `NamedMiddleware` object — so a factory form would put `.skip(['auth'])`
+ *   back on every route, which is the hand-written workaround this exists to
+ *   remove. Carrying `skips: ['auth']` makes the global `auth` middleware
+ *   auto-skip, exactly as `optionalAuth` and `opsTokenAuth` do.
+ *
+ * The backend never reads cookies. A browser session reaches here as a Bearer
+ * token because `@spfn/auth/nextjs/api` forwards it as one; a request carrying
+ * only a `Cookie` header is an unauthenticated request on this route.
+ *
+ * @example
+ * ```typescript
+ * import { opsOrUser } from '@spfn/auth/server';
+ *
+ * export const exportSignups = route.get('/admin/signups/export')
+ *     .use([opsOrUser({ opsScopes: ['waitlist:read'], permissions: ['admin.waitlist'] })])
+ *     .handler(async (c) =>
+ *     {
+ *         // exactly one of these is set
+ *         const ops = getOpsToken(c.raw);
+ *         const user = getAuth(c.raw);
+ *     });
+ * ```
+ */
+
+/** What a route admits, on each of the two branches. */
+interface OpsOrUserConfig {
+    /** scopes an ops token must carry (all of them; '*' grants all, as requireOpsScope does) */
+    opsScopes: string[];
+    /** the session user's role must be one of these */
+    roles?: string[];
+    /** the session user must hold every one of these */
+    permissions?: string[];
+}
+/**
+ * A middleware admitting either an ops token or a user session on one route.
+ *
+ * Validation is definition-time and fails closed: a route that names no ops
+ * scope, or no session guard at all, would admit one credential unchecked, so
+ * it is a boot-time error rather than a request-time surprise — the same
+ * posture `registerMachineVerifier` takes.
+ *
+ * @throws Error when `opsScopes` is empty, or when neither `roles` nor
+ *   `permissions` names anything.
+ */
+declare function opsOrUser(config: OpsOrUserConfig): NamedMiddleware<'opsOrUser'>;
+
 /**
  * Auth Context Helpers
  *
@@ -6129,15 +9081,15 @@ declare function getUser(c: Context | {
 }): {
     email: string | null;
     phone: string | null;
-    id: number;
+    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     publicId: string;
+    passwordChangeRequired: boolean;
+    id: number;
     username: string | null;
     passwordHash: string | null;
-    passwordChangeRequired: boolean;
     roleId: number;
     createdAt: Date;
     updatedAt: Date;
-    status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     lastLoginAt: Date | null;
@@ -6206,160 +9158,311 @@ declare function getKeyId(c: Context | {
 }): string;
 
 /**
- * @spfn/auth - Global Configuration
+ * @spfn/auth - CSRF token derivation
  *
- * Manages global auth configuration including session TTL
+ * The token is an HMAC of the session's key id under a subkey derived from the
+ * session secret. Two properties follow from that shape:
+ *
+ * - The proxy recomputes it from the session it just unsealed, so a value an
+ *   attacker planted in the readable cookie (sibling-subdomain cookie tossing)
+ *   never verifies. Nothing here compares a cookie against a header.
+ * - It is bound to the key id, so rotating the session key invalidates it.
+ *
+ * No new secret: the subkey is a labelled HMAC of SPFN_AUTH_SESSION_SECRET, so
+ * the key that encrypts sessions is never used verbatim as the token key.
  */
+/** Header the readable CSRF cookie is mirrored into by the client. */
+declare const CSRF_HEADER = "x-spfn-csrf";
+/**
+ * Derive the CSRF token for a session key id.
+ *
+ * @param keyId - Session key id (`SessionData.keyId`)
+ * @returns 64-char hex token — safe to put in a readable cookie, it reveals
+ *          neither the secret nor the key id
+ */
+declare function deriveCsrfToken(keyId: string): Promise<string>;
+/**
+ * Whether a presented header value carries the expected token.
+ *
+ * The header may carry several comma-separated candidates — a browser sees every
+ * `spfn_csrf*` cookie set on the host and cannot tell which dev instance owns
+ * which, nor which of two same-named cookies a sibling subdomain tossed in.
+ *
+ * Every candidate the client is allowed to send is checked — the cap here is the
+ * one it selects against — so a genuine value is never evicted by tossed ones
+ * that happen to sort ahead of it. A header longer than that can only come from a
+ * client that ignored the shared bound, and its surplus is dropped. Accepting any
+ * match is no weaker than accepting one: a candidate the attacker chose still has
+ * to equal a value recomputed from the session.
+ */
+declare function matchesCsrfToken(expected: string, presented: string | null | undefined): boolean;
 
 /**
- * Cookie names used by SPFN Auth
+ * OAuth 2.1 Authorization Server Configuration
  *
- * Names include a port-based suffix so that multiple dev instances
- * on different ports don't overwrite each other's cookies.
+ * Singleton config, mirroring `lib/device-auth-config.ts`: a mutable
+ * module-level value, set once from `createAuthLifecycle()` and read at request
+ * time.
+ *
+ * Unlike the device-auth block this one has no defaults to fall back on, and
+ * that is the feature: an application that does not pass `authorizationServer`
+ * is not running an authorization server, and every route under
+ * `/_auth/oauth2/*` answers 404 for it. Nothing here can be derived — the scope
+ * names are the application's vocabulary, and inventing a set would publish
+ * scopes in the metadata document that nothing honours.
  */
-declare const COOKIE_NAMES: {
-    /** Encrypted session data (userId, privateKey, keyId, algorithm) */
-    readonly SESSION: string;
-    /** Current key ID (for key rotation) */
-    readonly SESSION_KEY_ID: string;
-    /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
-    readonly OAUTH_PENDING: string;
-    /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
-    readonly OAUTH_CSRF: string;
+/**
+ * Everything the authorization server needs, resolved.
+ *
+ * `issuer` and `authorizeUrl` are absolute; the defaults are derived here, once,
+ * rather than at each use — the metadata document publishes them and a client
+ * that read one value must not meet another on the next request.
+ */
+interface AuthorizationServerConfig {
+    /** Origin the tokens are issued by, no path. `SPFN_API_URL` by default. */
+    issuer: string;
+    /**
+     * Where `issuer` came from — the option name or the variable name — so the
+     * boot refusal can tell an operator which one to edit.
+     */
+    issuerSource: string;
+    /** Consent screen, on the web app: `${appUrl}/oauth/authorize` by default. */
+    authorizeUrl: string;
+    /** Scope name to the one-line description the consent screen shows. */
+    scopes: Record<string, string>;
+    /** What an authorize request with no `scope` asks for. All of them by default. */
+    defaultScopes: string[];
+    /** `https://` origins a client may register a redirect URI on. Loopback needs no entry. */
+    allowedRedirectOrigins: string[];
+    accessTokenTtlMs: number;
+    refreshTokenTtlMs: number;
+    codeTtlMs: number;
+}
+/** Options as an application writes them. Everything but `scopes` has a default. */
+interface AuthorizationServerOptions {
+    issuer?: string;
+    authorizeUrl?: string;
+    scopes: Record<string, string>;
+    defaultScopes?: string[];
+    allowedRedirectOrigins?: string[];
+    accessTokenTtlMs?: number;
+    refreshTokenTtlMs?: number;
+    codeTtlMs?: number;
+}
+/** Eight hours. Long enough for a working session, short enough to matter. */
+declare const DEFAULT_ACCESS_TOKEN_TTL_MS: number;
+/** Thirty days. The CLI is expected to be reconnected about that often. */
+declare const DEFAULT_REFRESH_TOKEN_TTL_MS: number;
+/** Sixty seconds — the code travels from a browser redirect to a local listener. */
+declare const DEFAULT_CODE_TTL_MS: number;
+/** Path the consent screen is served at on the web app. */
+declare const AUTHORIZE_PATH = "/oauth/authorize";
+/** The API origin every default is derived from, and the boot check's subject. */
+declare function resolveIssuerSource(env?: Record<string, string | undefined>): {
+    value: string | undefined;
+    variable: string;
 };
 /**
- * OAuth CSRF 쿠키를 PORT 접미사와 무관하게 전부 수집한다.
+ * Resolve the authorization server config, or clear it when the application
+ * passed none. Called synchronously from `createAuthLifecycle()` for the reason
+ * `configureDeviceAuth` is: nothing may serve a request under half a config.
  *
- * 쿠키를 심는 쪽은 Next.js 프로세스, 읽는 쪽은 API 프로세스라 분리 배포에서는
- * 두 프로세스의 PORT가 달라 COOKIE_NAMES.OAUTH_CSRF 정확 일치 조회가 빗나간다.
- * nonce 자체가 랜덤값이고 암호화된 state의 nonce와 대조되므로, 접미사가 다른
- * spfn_oauth_csrf* 후보를 모두 대조 대상으로 넘겨도 안전하다.
+ * The issuer is reduced to the form this server publishes here, where every
+ * other default is resolved, so the config is publishable in exactly one state
+ * whether or not a lifecycle hook has run. It is not *validated* here: a value
+ * this cannot reduce is stored as the operator wrote it and refused by
+ * `assertAuthorizationServerIssuer` from `afterInfrastructure`, where a throw
+ * exits the process instead of leaving a server listening without routes. See
+ * `lifecycle.ts`.
  */
-declare function matchOAuthCsrfCookies(cookies: Record<string, string>): {
-    name: string;
-    value: string;
-}[];
+declare function configureAuthorizationServer(options?: AuthorizationServerOptions, env?: Record<string, string | undefined>): void;
 /**
- * Parse duration string to seconds
+ * The resolved config, or null when this application runs no authorization
+ * server. Every route under `/_auth/oauth2/*` reads it and answers 404 on null.
+ */
+declare function getAuthorizationServerConfig(): AuthorizationServerConfig | null;
+/**
+ * `localhost`, `127.0.0.1` and `[::1]` — the hosts a browser treats as a secure
+ * context over plain http, which is why the issuer may be `http://` on them and
+ * nowhere else. `URL.hostname` normalises every IPv6 spelling to `[::1]`.
+ */
+declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Refuse boot on an issuer no client could use.
  *
- * Supports: '30d', '12h', '45m', '3600s', or plain number
+ * `.well-known/*` lives at an origin's root, so an issuer carrying a path has no
+ * place to publish its metadata and every discovery request 404s. An issuer that
+ * is neither https nor loopback http means tokens crossing the network in the
+ * clear. Both are configuration drift between environments, so the deploy that
+ * introduces them is where they have to surface — the posture, the place and the
+ * voice of `assertOAuthRedirectUris`, one door down.
  *
- * @example
- * parseDuration('30d')   // 2592000 (30 days in seconds)
- * parseDuration('12h')   // 43200
- * parseDuration('45m')   // 2700
- * parseDuration('3600')  // 3600
+ * This only asserts. `configureAuthorizationServer` reduced the value it reads
+ * if it could, so anything reaching here that is not an origin is one the
+ * reduction deliberately left alone.
+ *
+ * Silent when no authorization server is configured: an application that does
+ * not run one must boot exactly as it did before this feature existed.
+ *
+ * @throws When the resolved issuer cannot be honoured. The message names the
+ *         variable or the option the value came from.
  */
-declare function parseDuration(duration: string | number): number;
+declare function assertAuthorizationServerIssuer(): void;
+
 /**
- * Registration channel passed to the beforeRegister hook
+ * OAuth 2.1 redirect URI rules
  *
- * - credentials: email/phone + password registration
- * - oauth: new-user signup through a social provider (web or native flow)
- * - invitation: invitation acceptance
+ * Two jobs, and they are not the same job. Registration decides whether a URI
+ * may be written down at all; matching decides whether the URI on an authorize
+ * request is one that was. Registration is where policy lives (no plain http off
+ * loopback, https only on origins the application allows, no fragment ever), and
+ * matching is deliberately dumb: exact, on everything except a loopback port.
+ *
+ * The loopback exception is the whole reason a CLI can use this flow. `claude`
+ * opens a listener on whatever port the OS hands it and cannot know that port
+ * when it registers, so RFC 8252 §7.3 lets the port vary — and nothing else.
+ * `localhost`, `127.0.0.1` and `[::1]` are three different registrations that do
+ * not stand in for one another: they resolve differently on a machine with a
+ * split-horizon resolver, and a client that registered one and is answered on
+ * another is a client something redirected.
+ *
+ * IPv6 arrives in as many spellings as there are ways to write zeroes, so both
+ * sides are read through `new URL(...).hostname`, which answers `[::1]` for
+ * every one of them. The registered value is stored verbatim — the registration
+ * response echoes it back and must not answer a client with a URI it did not
+ * write — so the normalisation happens here, on both sides, at every comparison.
  */
-type RegisterChannel = 'credentials' | 'oauth' | 'invitation';
+/** Why a redirect URI cannot be registered, in RFC 7591 §3.2.2 terms. */
+type RedirectUriRefusal = 'invalid_redirect_uri';
 /**
- * Context passed to the beforeRegister hook
+ * Whether a URI may be registered, given the https origins this application
+ * allows.
  *
- * Credentials (password, keys) are intentionally excluded — the hook is a
- * policy gate, not a credential handler.
+ * @param uri - The value exactly as the client wrote it
+ * @param allowedRedirectOrigins - `https://` origins from the lifecycle config
+ * @returns null when it may; the refusal detail when it may not
  */
-interface BeforeRegisterContext {
-    channel: RegisterChannel;
-    /** Social provider — only set when channel is 'oauth' */
-    provider?: SocialProvider;
-    email?: string;
-    /**
-     * Whether the email is verified — only set when channel is 'oauth'.
-     * OAuth providers may report an unverified (spoofable) email; the created
-     * account stores it as null in that case, so email-based policies must
-     * check this flag. credentials/invitation emails are already verified.
-     */
-    emailVerified?: boolean;
-    phone?: string;
-    /** App-supplied registration metadata (register params / OAuth start params / invitation) */
-    metadata?: Record<string, unknown>;
-}
+declare function refuseRedirectUriRegistration(uri: string, allowedRedirectOrigins: string[]): string | null;
 /**
- * Auth configuration
+ * Whether a presented redirect URI is one of the registered ones.
+ *
+ * Host, path and query must be identical; the port may differ only when both
+ * sides are loopback http. A presented URI carrying a fragment or a dot segment
+ * matches nothing — registration already refuses both, so this is the request
+ * side of the same two rules.
  */
-interface AuthConfig {
-    /**
-     * Default session TTL in seconds or duration string
-     *
-     * Supports:
-     * - Number: seconds (e.g., 2592000)
-     * - String: '30d', '12h', '45m', '3600s'
-     *
-     * @default 7d (7 days)
-     */
-    sessionTtl?: string | number;
-    /**
-     * App-injected validator that runs before a new user row is created,
-     * on every registration channel (credentials, oauth, invitation).
-     *
-     * Throw to reject the registration — RegistrationRejectedError (403) is
-     * the recommended error; any HttpError subclass keeps its own status.
-     * Runs after built-in checks (verification token, duplicate account),
-     * so existing error precedence is unchanged. Not called for admin
-     * seeding (initializeAuth) or when linking a social account to an
-     * existing user.
-     *
-     * Runs inside the registration DB transaction on every channel — keep it
-     * fast. A slow call (e.g. an external policy API) holds a pooled DB
-     * connection open for its full duration on every signup.
-     *
-     * @example
-     * ```typescript
-     * configureAuth({
-     *     beforeRegister: async ({ channel, metadata }) =>
-     *     {
-     *         if (channel === 'credentials' && !isOldEnough(metadata?.birthDate))
-     *         {
-     *             throw new RegistrationRejectedError({ message: 'Age requirement not met' });
-     *         }
-     *     },
-     * });
-     * ```
-     */
-    beforeRegister?: (context: BeforeRegisterContext) => void | Promise<void>;
-}
+declare function matchesRegisteredRedirectUri(presented: string, registered: string[]): boolean;
 /**
- * Configure global auth settings
+ * The host shown on the consent screen, so the person approving can see where
+ * the code is about to be sent.
+ */
+declare function redirectHostOf(uri: string): string;
+
+/**
+ * OAuth 2.1 resource indicator (RFC 8707)
  *
- * @param config - Auth configuration
+ * The one string that says which API an access token is good against. It is
+ * required at authorize, defaulted from the grant at token, and compared again
+ * at verification — and the three comparisons have to agree, or a token minted
+ * for one spelling of a URL is refused by another.
  *
- * @example
- * ```typescript
- * configureAuth({
- *   sessionTtl: '30d',  // 30 days
- * });
- * ```
+ * So there is one rule and it is applied at every entry point: parse and
+ * re-serialise with `new URL(...).toString()`, store that, and compare the
+ * normalised strings exactly. That folds away the differences a URL parser is
+ * allowed to fold — a default port written out, a percent-encoding case, an
+ * empty path becoming `/` — and folds away nothing else. A trailing slash is
+ * not noise: `https://api.example.com/mcp` and `https://api.example.com/mcp/`
+ * are different paths and stay different resources.
+ *
+ * A fragment is refused rather than stripped. RFC 8707 §2 forbids one, and
+ * stripping would quietly hand back a token for a target the client did not ask
+ * for.
  */
-declare function configureAuth(config: AuthConfig): void;
 /**
- * Get current auth configuration
+ * The canonical form of a resource indicator, or null when the value is not one.
+ *
+ * @param value - The `resource` parameter as it arrived
  */
-declare function getAuthConfig(): AuthConfig;
+declare function normalizeResource(value: string): string | null;
 /**
- * Run the app-injected beforeRegister hook if configured — throws to reject.
+ * Whether a presented resource names the same target as a grant's.
  *
- * Single entry point for every registration channel so a new channel cannot
- * forget the configured-check. Callers invoke this right before creating the
- * user row.
+ * Both sides go through `normalizeResource`: the grant's value was normalised
+ * when it was stored, and normalising it again costs one parse and removes the
+ * chance that a row written by an older rule is compared raw.
  */
-declare function runBeforeRegister(context: BeforeRegisterContext): Promise<void>;
+declare function sameResource(presented: string, granted: string): boolean;
+
 /**
- * Get session TTL in seconds
+ * OAuth 2.1 token, code and clock helpers
  *
- * Priority:
- * 1. Runtime override (remember parameter)
- * 2. Global config (configureAuth)
- * 3. Environment variable (SPFN_AUTH_SESSION_TTL) - via config module
- * 4. Default (7 days)
+ * Every secret this server issues is generated, hashed and compared here, so
+ * there is one answer to "how long is it, what does it start with, and how is it
+ * checked" rather than one per call site.
+ *
+ * Lookup is by the hash and the hash column is unique, so the database finds at
+ * most one row — but the equality that actually authorizes is done here, in
+ * constant time, over the hex digests. It costs a string comparison of 64
+ * characters and it means the decision never depends on how an index compared.
+ *
+ * The clock helpers are the other half. Three places express a moment and they
+ * disagree about the unit — the row stores a timestamp, `verifyAccessToken`
+ * answers seconds since the epoch, and a token response carries the seconds
+ * remaining — so all three go through one function each rather than three
+ * divisions by 1000 that can each be wrong on their own.
  */
-declare function getSessionTtl(override?: string | number): number;
+/** Shape of an access token. Paired with `isAccessTokenShaped` below. */
+declare const OAUTH2_ACCESS_TOKEN_PREFIX = "spfn_at_";
+/** Shape of a refresh token. */
+declare const OAUTH2_REFRESH_TOKEN_PREFIX = "spfn_rt_";
+/** SHA-256 hex of a token or code. The only form either is ever stored in. */
+declare function hashOAuth2Secret(secret: string): string;
+/** Constant-time equality for two hex digests. */
+declare function sameOAuth2Hash(a: string, b: string): boolean;
+declare function generateAccessToken(): string;
+declare function generateRefreshToken(): string;
+/** 43 url-safe characters, which is 32 bytes of base64url with no padding. */
+declare function generateAuthorizationCode(): string;
+/**
+ * Whether a presented bearer credential has the access-token shape.
+ *
+ * Shape only — the token may still be unknown, revoked or expired, which
+ * `verifyAccessToken` decides. Callers read a raw header, so a missing or
+ * non-string argument answers false rather than throwing, exactly as
+ * `isOpsToken` does.
+ */
+declare function isAccessTokenShaped(bearer: string): boolean;
+/** The PKCE S256 transform: base64url of SHA-256 over the verifier's ASCII. */
+declare function pkceChallengeFor(codeVerifier: string): string;
+/**
+ * Whether a presented verifier is one RFC 7636 describes.
+ *
+ * Conformance rather than defence — the S256 comparison is what authorizes, and
+ * a verifier of any length still has to hash to the stored challenge. What this
+ * catches is a client that built its verifier wrong: 22 characters of entropy
+ * carries less than the transform promises, and an oversized one is a client
+ * that will be refused by the next server it talks to for a reason this one
+ * never told it.
+ */
+declare function isPkceVerifierShaped(codeVerifier: string): boolean;
+/**
+ * Whether a presented challenge could have come out of the S256 transform.
+ *
+ * A challenge of any other shape is a client that sent something else in the
+ * field — its verifier, most often, which is `plain` PKCE wearing the S256
+ * label and is exactly what the method check exists to refuse.
+ */
+declare function isPkceS256ChallengeShaped(codeChallenge: string): boolean;
+/** A moment as seconds since the epoch — what `verifyAccessToken` answers with. */
+declare function toEpochSeconds(at: Date): number;
+/**
+ * Whole seconds from now until a moment — what `expires_in` carries.
+ *
+ * Floored at zero: a token that expired while the response was being built is
+ * answered as zero rather than as a negative number a client would read as an
+ * enormous unsigned one.
+ */
+declare function secondsUntil(at: Date, from?: Date): number;
 
 /**
  * One-Time Token Manager
@@ -6462,6 +9565,107 @@ declare function configureDeletion(options?: Partial<AuthDeletionConfig>): void;
  */
 declare function getDeletionConfig(): AuthDeletionConfig;
 
+/**
+ * Device-code Login Configuration
+ *
+ * Singleton config for device-code login, mirroring `lib/deletion-config.ts`: a
+ * mutable module-level value, set once during `createAuthLifecycle()` and read at
+ * request time.
+ *
+ * Both knobs are answers the server hands to a client that cannot ask again — the
+ * waiting device is told its expiry and its poll interval in the `start` response
+ * and then just obeys them — so they have to be resolved before any request is
+ * served, not read from an environment variable at each use.
+ */
+interface AuthDeviceAuthConfig {
+    /** How long a device code stays usable, in milliseconds. */
+    ttlMs: number;
+    /** How long the waiting device should wait between polls, in milliseconds. */
+    intervalMs: number;
+}
+/**
+ * Ten minutes. Long enough to walk to the other device and type the code, short
+ * enough that a code glimpsed over a shoulder is worthless soon after.
+ */
+declare const DEFAULT_DEVICE_AUTH_TTL_MS: number;
+/** Five seconds. The interval the server asks for; the rate limit is what enforces it. */
+declare const DEFAULT_DEVICE_AUTH_INTERVAL_MS: number;
+/**
+ * Set the resolved device-auth config. Called synchronously from
+ * `createAuthLifecycle()` for the same reason `configureDeletion` is: it must
+ * take effect before any handler that reads `getDeviceAuthConfig()` can run.
+ *
+ * Both knobs are whole millisecond counts, and one that is not is refused here
+ * rather than served. `intervalMs` is the reason the check exists: it leaves as
+ * `intervalMillis` in the start and poll answers, which `DeviceAuthPollResponseSchema`
+ * declares an integer and the mobile contract exports as one, so a fractional
+ * value configured here would reach a generated client as a number its decoder
+ * refuses — at the one moment the flow depends on that client asking again.
+ */
+declare function configureDeviceAuth(options?: Partial<AuthDeviceAuthConfig>): void;
+/**
+ * Read the current device-auth config. Safe to call any time — defaults apply
+ * even if `createAuthLifecycle()` was never given a `deviceAuth` block.
+ */
+declare function getDeviceAuthConfig(): AuthDeviceAuthConfig;
+
+/**
+ * @spfn/auth - Device code generation
+ *
+ * The two codes device-code login runs on, and the one-way function between the
+ * device code and what is stored for it.
+ *
+ * They are different kinds of value and are treated differently everywhere. The
+ * device code is a credential: the polling device holds it, nothing else proves
+ * who that device is, so it is long, random, and stored only as a hash. The user
+ * code is read off one screen and typed on another, so it is short and stored in
+ * the clear — it authorizes nothing on its own, since only an already
+ * authenticated caller can act on it.
+ */
+/**
+ * Alphabet the user code is drawn from.
+ *
+ * 0/O and 1/I/L are the pairs a person mistypes when copying a code between two
+ * screens, so neither member of either pair is in the set. 31 characters over 8
+ * positions is ~2^39 codes, which the per-IP and per-account rate limits on
+ * every route that accepts one make unguessable in the ten minutes a code lives.
+ */
+declare const USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+/** Characters in a user code, not counting the dash it is displayed with. */
+declare const USER_CODE_LENGTH = 8;
+/**
+ * A fresh user code in stored form — uppercase, no dash.
+ *
+ * `randomInt` rather than `Math.random`: this is drawn from the same CSPRNG the
+ * device code is, and a predictable user code lets an attacker have a victim
+ * approve a code the attacker is polling.
+ */
+declare function generateUserCode(): string;
+/** The stored form as a person reads it: `XXXX-XXXX`. */
+declare function formatUserCode(userCode: string): string;
+/**
+ * Fold a typed user code back to the stored form.
+ *
+ * Someone reading `WXYZ-2345` off a screen types the dash, or spaces, or lower
+ * case. All of those name the same code, so all of them have to reach the same
+ * lookup — the alternative is a code that is on screen and still refused.
+ *
+ * Only the user code is normalized. The device code is a credential and is
+ * matched byte for byte: accepting variant spellings of a credential is how one
+ * token becomes several strings and a one-shot record is used twice.
+ */
+declare function normalizeUserCode(input: string): string;
+/** A fresh device code, returned to the new device once and never stored. */
+declare function generateDeviceCode(): string;
+/**
+ * What the row holds instead of the device code.
+ *
+ * Unsalted SHA-256, as with the ops-token and signup-link secrets: the input is
+ * 256 bits of CSPRNG output, so there is no dictionary to defend against and a
+ * per-row salt would only stop the exact-match lookup this has to support.
+ */
+declare function hashDeviceCode(deviceCode: string): string;
+
 /**
  * @spfn/auth - Centralized Logger
  *
@@ -6475,6 +9679,7 @@ declare const authLogger: {
         login: _spfn_core_logger.Logger;
         keyRotation: _spfn_core_logger.Logger;
         oauth: _spfn_core_logger.Logger;
+        csrf: _spfn_core_logger.Logger;
     };
     session: _spfn_core_logger.Logger;
     service: _spfn_core_logger.Logger;
@@ -6667,6 +9872,65 @@ interface AuthLifecycleOptions extends AuthInitOptions {
          */
         onBeforePurge?: (user: AccountDeletionPurgeUser) => Promise<void>;
     };
+    /**
+     * Device-code login configuration
+     *
+     * Controls the codes handed out by `POST /_auth/device/start` and obeyed by
+     * `POST /_auth/device/poll`. Both values are announced to the waiting device
+     * in the start response, so they are resolved here rather than read per call,
+     * and both must be a positive whole number of milliseconds — the interval is
+     * published as an integer and a fraction is refused at startup rather than
+     * handed to a client that cannot decode it.
+     *
+     * @example
+     * ```typescript
+     * createAuthLifecycle({
+     *     deviceAuth: {
+     *         ttlMs: 5 * 60 * 1000,   // a code lives 5 minutes
+     *         intervalMs: 3000,       // poll every 3 seconds
+     *     },
+     * })
+     * ```
+     */
+    deviceAuth?: {
+        /**
+         * How long a device code stays usable, in milliseconds.
+         * @default 600000 (10 minutes)
+         */
+        ttlMs?: number;
+        /**
+         * Poll interval the server asks the waiting device to keep, in milliseconds.
+         * @default 5000
+         */
+        intervalMs?: number;
+    };
+    /**
+     * OAuth 2.1 authorization server for MCP clients
+     *
+     * Opt-in, and the opt-in is this block. Without it `/_auth/oauth2/*` and
+     * `/.well-known/oauth-authorization-server` answer 404, the boot check does
+     * not run, and the application boots exactly as it did before this feature
+     * existed. With it, Claude Code and Codex can register themselves, send the
+     * account owner to a consent screen, and hold a token against `/mcp`.
+     *
+     * `scopes` is the one thing with no default: the names are the
+     * application's own vocabulary, they are published in the metadata document
+     * and shown on the consent screen, and there is nothing to derive them from.
+     *
+     * @example
+     * ```typescript
+     * createAuthLifecycle({
+     *     authorizationServer: {
+     *         scopes: {
+     *             'mcp:read': 'Read your projects and tasks',
+     *             'mcp:write': 'Create and edit your tasks',
+     *         },
+     *         defaultScopes: ['mcp:read'],
+     *     },
+     * })
+     * ```
+     */
+    authorizationServer?: AuthorizationServerOptions;
 }
 declare function createAuthLifecycle(options?: AuthLifecycleOptions): AuthLifecycleConfig;
 
@@ -6698,8 +9962,9 @@ declare function createAuthLifecycle(options?: AuthLifecycleOptions): AuthLifecy
  * statements). So the static `authJobRouter` export below always uses the default
  * cron — `deletion.purgeCron` passed to `createAuthLifecycle()` cannot reach it.
  * To use a custom cron, build the router yourself, after calling
- * `createAuthLifecycle()`, with `createAuthDeletionJobRouter({ purgeCron })` and
- * register that instead of the static export.
+ * `createAuthLifecycle()`, with `createAuthJobRouter({ purgeCron })` and register
+ * that instead of the static export. The router itself lives in `./index.ts`,
+ * which also carries `auth.link-mail`.
  */
 /**
  * Build the `auth.deletion.purge` job with a given cron schedule.
@@ -6707,24 +9972,82 @@ declare function createAuthLifecycle(options?: AuthLifecycleOptions): AuthLifecy
  * @param cronExpression - Defaults to `deletion-config`'s default (daily at 04:00).
  */
 declare function createAuthDeletionPurgeJob(cronExpression?: string): _spfn_core_job.JobDef<void, void>;
+
+/**
+ * Send the mail one request deferred.
+ *
+ * The three kinds share a queue because they share a reason to exist: each is a
+ * mail whose presence or absence would otherwise be visible in how long a
+ * request took.
+ */
+declare const linkMailJob: _spfn_core_job.JobDef<{
+    kind: "signup-link";
+    rowId: number;
+} | {
+    kind: "password-reset";
+    rowId: number;
+} | {
+    target: string;
+    targetType: "email" | "phone";
+    kind: "account-exists";
+}, void>;
+
 /**
- * Build a job router containing only the deletion purge job, with a given cron.
- * Use this (after calling `createAuthLifecycle({ deletion: { purgeCron } })`) when
- * you need a non-default schedule — see the module doc comment above for why the
- * static `authJobRouter` export can't pick up `deletion.purgeCron` automatically.
+ * Build the auth job router: the account-deletion purge sweep, the OAuth 2.1
+ * stale-client sweep, and the link-mail sender.
+ *
+ * The cron is a parameter because `job(...).cron(expression)` bakes the string in
+ * at module-import time, which always happens before `createAuthLifecycle()` runs
+ * in the app's own module — so the static `authJobRouter` export below cannot
+ * pick up a `deletion.purgeCron` given to the lifecycle. Build the router here,
+ * after that call, when the schedule is not the default.
+ *
+ * @param options.purgeCron - Deletion purge schedule; defaults to daily at 04:00
+ * @param options.oauth2ClientPurgeCron - Stale OAuth client sweep; defaults to daily at 05:00
  */
-declare function createAuthDeletionJobRouter(options?: {
+declare function createAuthJobRouter(options?: {
     purgeCron?: string;
+    oauth2ClientPurgeCron?: string;
 }): _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
+    oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
+    linkMail: _spfn_core_job.JobDef<{
+        kind: "signup-link";
+        rowId: number;
+    } | {
+        kind: "password-reset";
+        rowId: number;
+    } | {
+        target: string;
+        targetType: "email" | "phone";
+        kind: "account-exists";
+    }, void>;
 }>;
 /**
- * Default job router — the default cron (`0 4 * * *`). Register with
+ * Default job router — the default purge cron (`0 4 * * *`). Register with
  * `.jobs(authJobRouter)` in `server.config.ts`.
  */
 declare const authJobRouter: _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
+    oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
+    linkMail: _spfn_core_job.JobDef<{
+        kind: "signup-link";
+        rowId: number;
+    } | {
+        kind: "password-reset";
+        rowId: number;
+    } | {
+        target: string;
+        targetType: "email" | "phone";
+        kind: "account-exists";
+    }, void>;
 }>;
+/**
+ * @deprecated Renamed to `createAuthJobRouter` — the router has carried more than
+ * the deletion purge since `auth.link-mail` joined it. Same arguments, same
+ * result; register only one auth router either way.
+ */
+declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
 /**
  * @spfn/auth - Auth Events
@@ -6745,6 +10068,7 @@ declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TL
  * 발행 시점:
  * - 이메일/전화 로그인 성공 시
  * - OAuth 기존 사용자 로그인 시
+ * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
  *
  * @example
  * ```typescript
@@ -6757,7 +10081,7 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device" | "passkey";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -6807,8 +10131,8 @@ declare const invitationCreatedEvent: _spfn_core_event.EventDef<{
         [x: string]: unknown;
     } | undefined;
     email: string;
-    roleId: number;
     token: string;
+    roleId: number;
     invitedBy: string;
     expiresAt: string;
     invitationId: string;
@@ -6902,11 +10226,34 @@ declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
     provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
     providerUserId: string;
 }>;
+/**
+ * auth.password.reset — an account's password was replaced through a reset link
+ *
+ * 발행 시점:
+ * - completePasswordResetService()가 커밋된 직후
+ *
+ * Distinct from a password *change*, which is made from a session that already
+ * proved itself. This one is made by whoever opened a link in a mailbox, so it
+ * is the event an app hangs a "your password was reset" notice on — and the
+ * signal to look at, if the owner says they did not ask for it.
+ *
+ * @example
+ * ```typescript
+ * authPasswordResetEvent.subscribe(async (payload) => {
+ *     await notifyOwner(payload.userId, 'Your password was reset');
+ * });
+ * ```
+ */
+declare const authPasswordResetEvent: _spfn_core_event.EventDef<{
+    email: string;
+    userId: string;
+}>;
 /**
  * Auth event payload types
  */
 type AuthLoginPayload = typeof authLoginEvent._payload;
 type AuthRegisterPayload = typeof authRegisterEvent._payload;
+type AuthPasswordResetPayload = typeof authPasswordResetEvent._payload;
 type InvitationCreatedPayload = typeof invitationCreatedEvent._payload;
 type InvitationAcceptedPayload = typeof invitationAcceptedEvent._payload;
 type AuthDeletionRequestedPayload = typeof authDeletionRequestedEvent._payload;
@@ -6914,4 +10261,4 @@ type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
 type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
 type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
 
-export { type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, AuthProviderSchema, type AuthRegisterPayload, type BeforeRegisterContext, COOKIE_NAMES, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, type DecryptedOAuthToken, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewInvitation, type NewOpsToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, type OpsToken, OpsTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, type SessionPayload, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOpsToken, type VerifyIdTokenParams, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertCanAssignRole, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureDeletion, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, encryptToken, exchangeCodeForTokens, expireOldInvitations, generateOAuthNonce, generateToken, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getDeletionConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isEncrypted, isGoogleOAuthEnabled, issueOpsTokenService, kakaoProvider, keysRepository, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, naverProvider, oauthUnlinkedEvent, oneTimeTokenAuth, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, permissions, permissionsRepository, purgeUserService, refreshAccessToken, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, setRolePermissions, socialAccountsRepository, sweepDuePurges, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, type AuthPasswordResetPayload, AuthProviderSchema, type AuthRegisterPayload, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, MAX_UNGRANTED_CLIENTS_PER_IP, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authPasswordResetEvent, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oauthUnlinkedEvent, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };