@spfn/auth 0.3.0-beta.20 → 0.3.0-beta.21

package/dist/{machine-principals-BD4tnASp.d.ts → machine-principals-B7N8gux0.d.ts}

@@ -5,6 +5,7 @@ import { K as KeyAlgorithmType, h as KeyPlatformType, j as SocialProvider } from
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
+import * as _spfn_core_event from '@spfn/core/event';
 import { Context } from 'hono';
 import { User } from '@spfn/auth/server';
 
@@ -107,6 +108,10 @@ interface RegisterParams {
     deviceName?: string;
     platform?: KeyPlatformType;
     metadata?: Record<string, unknown>;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
 }
 interface RegisterResult {
     userId: string;
@@ -125,6 +130,10 @@ interface LoginParams {
     algorithm?: KeyAlgorithmType;
     deviceName?: string;
     platform?: KeyPlatformType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
 }
 interface LoginResult {
     userId: string;
@@ -351,6 +360,10 @@ interface CompleteSignupParams {
     deviceName?: string;
     platform?: KeyPlatformType;
     metadata?: Record<string, unknown>;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
 }
 /**
  * Step 3 — set the password, which is what creates the account.
@@ -446,6 +459,10 @@ interface CompletePasswordResetParams {
     algorithm?: KeyAlgorithmType;
     deviceName?: string;
     platform?: KeyPlatformType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
 }
 /**
  * Step 3 — set the new password, which is what completes the reset.
@@ -530,6 +547,10 @@ interface DenyDeviceAuthParams {
 }
 interface PollDeviceAuthParams {
     deviceCode: string;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
 }
 /** Nobody has answered yet. Not an error — the waiting device waits. */
 interface DeviceAuthPendingResult {
@@ -975,6 +996,10 @@ interface FinishPasskeyLoginParams {
     oldKeyId?: string;
     deviceName?: string;
     platform?: KeyPlatformType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
 }
 /**
  * Step 2 of sign-in — verify the assertion, then sign in exactly as a password
@@ -1031,6 +1056,264 @@ declare function revokePasskeyService(params: RevokePasskeyParams): Promise<{
     passkeyId: string;
 }>;
 
+/**
+ * Auth provider type
+ *
+ * 직접 인증(email/phone) + 등록 가능한 모든 소셜 provider(SOCIAL_PROVIDERS).
+ */
+declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">, ..._sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]]>;
+/**
+ * auth.login - 로그인 성공 이벤트
+ *
+ * 발행 시점:
+ * - 이메일/전화 로그인 성공 시
+ * - OAuth 기존 사용자 로그인 시
+ * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
+ *
+ * @example
+ * ```typescript
+ * authLoginEvent.subscribe(async (payload) => {
+ *     await analytics.trackLogin(payload.userId, payload.provider);
+ * });
+ * ```
+ */
+declare const authLoginEvent: _spfn_core_event.EventDef<{
+    email?: string | undefined;
+    phone?: string | undefined;
+    userId: string;
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device" | "passkey";
+}>;
+/**
+ * Where a device key was registered — the door the new device came through.
+ *
+ * Required on `RegisterPublicKeyParams` rather than optional with a default: a
+ * new *call site* for key registration must choose one, and a default would let
+ * it inherit somebody else's answer silently. `'register'` and `'signup-link'`
+ * both arrive at `createVerifiedAccount`, so the two name themselves there;
+ * `'invitation'` is the one path that stores a key without the key service.
+ */
+declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">]>;
+/** The nine doors a device key is registered through. */
+type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
+/**
+ * auth.device.registered — a new device key was added to an account
+ *
+ * 발행 시점:
+ * - a key row was created for an account and the transaction that created it
+ *   committed, on every one of the nine channels above
+ *
+ * This is the notice an account owner needs and could not get before: a stolen
+ * password used to sign in on a new device was silent, because a login event
+ * says a session began and not what it began on. Rotation is deliberately not
+ * announced — replacing the key of a device that is already signed in is not a
+ * new device, and a notice for it would train the owner to ignore the ones that
+ * matter.
+ *
+ * `ip` and `userAgent` are what the registering request said about itself. Both
+ * are unauthenticated display material: nothing is decided by them, and a field
+ * is absent rather than carrying a placeholder when the request resolved none.
+ *
+ * Neither the full fingerprint nor the public key is carried. The prefix is
+ * enough to point at one entry of `listKeys`, which is what a notice needs.
+ *
+ * @example
+ * ```typescript
+ * authDeviceRegisteredEvent.subscribe(async ({ userId, deviceName, ip, channel }) => {
+ *     await notifyOwner(userId, `A new device signed in (${deviceName ?? channel})`);
+ * });
+ * ```
+ */
+declare const authDeviceRegisteredEvent: _spfn_core_event.EventDef<{
+    deviceName?: string | undefined;
+    platform?: string | undefined;
+    ip?: string | undefined;
+    userAgent?: string | undefined;
+    keyId: string;
+    algorithm: string;
+    userId: string;
+    fingerprintPrefix: string;
+    createdAtMillis: number;
+    channel: "password" | "register" | "oauth-native" | "oauth" | "invitation" | "signup-link" | "password-reset" | "passkey" | "device-code";
+}>;
+/**
+ * auth.register - 회원가입 성공 이벤트
+ *
+ * 발행 시점:
+ * - 이메일/전화 회원가입 성공 시
+ * - OAuth 신규 사용자 가입 시
+ *
+ * @example
+ * ```typescript
+ * authRegisterEvent.subscribe(async (payload) => {
+ *     await emailService.sendWelcome(payload.email);
+ * });
+ * ```
+ */
+declare const authRegisterEvent: _spfn_core_event.EventDef<{
+    email?: string | undefined;
+    phone?: string | undefined;
+    metadata?: {
+        [x: string]: unknown;
+    } | undefined;
+    userId: string;
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+}>;
+/**
+ * auth.invitation.created - 초대 생성 이벤트
+ *
+ * 발행 시점:
+ * - createInvitation() 성공 시
+ * - resendInvitation() 성공 시
+ *
+ * @example
+ * ```typescript
+ * invitationCreatedEvent.subscribe(async (payload) => {
+ *     const inviteUrl = `${APP_URL}/invite/${payload.token}`;
+ *     await notificationService.send({
+ *         channel: 'email',
+ *         to: payload.email,
+ *         subject: 'You are invited!',
+ *         html: renderInviteEmail({ inviteUrl, ...payload.metadata }),
+ *     });
+ * });
+ * ```
+ */
+declare const invitationCreatedEvent: _spfn_core_event.EventDef<{
+    metadata?: {
+        [x: string]: unknown;
+    } | undefined;
+    email: string;
+    token: string;
+    expiresAt: string;
+    roleId: number;
+    invitedBy: string;
+    invitationId: string;
+    isResend: boolean;
+}>;
+/**
+ * auth.invitation.accepted - 초대 수락 이벤트
+ *
+ * 발행 시점:
+ * - acceptInvitation() 성공 시
+ *
+ * @example
+ * ```typescript
+ * invitationAcceptedEvent.subscribe(async (payload) => {
+ *     await onboardingService.start(payload.userId);
+ * });
+ * ```
+ */
+declare const invitationAcceptedEvent: _spfn_core_event.EventDef<{
+    metadata?: {
+        [x: string]: unknown;
+    } | undefined;
+    email: string;
+    userId: string;
+    roleId: number;
+    invitedBy: string;
+    invitationId: string;
+}>;
+/**
+ * auth.deletion.requested - 계정 탈퇴 요청 이벤트
+ *
+ * 발행 시점:
+ * - requestAccountDeletionService() 성공 시 (self/admin 공통)
+ *
+ * @example
+ * ```typescript
+ * authDeletionRequestedEvent.subscribe(async (payload) => {
+ *     await analytics.trackChurnRisk(payload.userId);
+ * });
+ * ```
+ */
+declare const authDeletionRequestedEvent: _spfn_core_event.EventDef<{
+    userId: string;
+    purgeScheduledAt: string;
+    userPublicId: string;
+    requestedBy: "admin" | "self";
+}>;
+/**
+ * auth.deletion.cancelled - 계정 탈퇴 복구 이벤트
+ *
+ * 발행 시점:
+ * - cancelAccountDeletionService() 성공 시 (유예 기간 내 복구)
+ */
+declare const authDeletionCancelledEvent: _spfn_core_event.EventDef<{
+    userId: string;
+    userPublicId: string;
+}>;
+/**
+ * auth.deletion.completed - 계정 파기 완료 이벤트
+ *
+ * 발행 시점:
+ * - purge job(또는 즉시 파기 경로)이 유저를 파기한 직후
+ *
+ * PII를 담지 않는다 — userId(내부 순번)/email/phone 없이 userPublicId만 실어
+ * 파기 완료 이후에도 구독자가 식별 정보를 다시 축적하지 않도록 한다.
+ */
+declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
+    userPublicId: string;
+    purgeStrategy: "anonymize" | "hard-delete";
+}>;
+/**
+ * auth.oauth.unlinked - provider발 연동 해제 이벤트
+ *
+ * 발행 시점:
+ * - provider(카카오·네이버 등)가 unlink-notify 웹훅으로 연동 해제를 알려와
+ *   소셜 계정 연결과 저장 토큰이 삭제된 직후
+ *
+ * 연결 삭제까지는 프레임워크가 수행하고, 그 이후(계정 탈퇴로 이어갈지 등)는
+ * 앱 정책이므로 이 이벤트를 구독해 처리한다.
+ *
+ * @example
+ * ```typescript
+ * oauthUnlinkedEvent.subscribe(async (payload) => {
+ *     await requestAccountDeletionService({ userId: payload.userId, requestedBy: 'self' });
+ * });
+ * ```
+ */
+declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
+    reason?: string | undefined;
+    userId: string;
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
+    providerUserId: string;
+}>;
+/**
+ * auth.password.reset — an account's password was replaced through a reset link
+ *
+ * 발행 시점:
+ * - completePasswordResetService()가 커밋된 직후
+ *
+ * Distinct from a password *change*, which is made from a session that already
+ * proved itself. This one is made by whoever opened a link in a mailbox, so it
+ * is the event an app hangs a "your password was reset" notice on — and the
+ * signal to look at, if the owner says they did not ask for it.
+ *
+ * @example
+ * ```typescript
+ * authPasswordResetEvent.subscribe(async (payload) => {
+ *     await notifyOwner(payload.userId, 'Your password was reset');
+ * });
+ * ```
+ */
+declare const authPasswordResetEvent: _spfn_core_event.EventDef<{
+    email: string;
+    userId: string;
+}>;
+/**
+ * Auth event payload types
+ */
+type AuthLoginPayload = typeof authLoginEvent._payload;
+type AuthRegisterPayload = typeof authRegisterEvent._payload;
+type AuthPasswordResetPayload = typeof authPasswordResetEvent._payload;
+type AuthDeviceRegisteredPayload = typeof authDeviceRegisteredEvent._payload;
+type InvitationCreatedPayload = typeof invitationCreatedEvent._payload;
+type InvitationAcceptedPayload = typeof invitationAcceptedEvent._payload;
+type AuthDeletionRequestedPayload = typeof authDeletionRequestedEvent._payload;
+type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
+type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
+type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
+
 /**
  * @spfn/auth - Key Service
  *
@@ -1046,6 +1329,26 @@ interface RegisterPublicKeyParams {
     /** Device label for the key list. Display only — nothing is authorized by it. */
     deviceName?: string;
     platform?: KeyPlatformType;
+    /**
+     * Which door this device came through. Required, so that a registration path
+     * added later has to say what it is rather than inherit an answer.
+     */
+    channel: DeviceRegistrationChannel;
+    /** Client address of the registering request, absent when none resolved. */
+    ip?: string;
+    /** `user-agent` of the registering request, already truncated. */
+    userAgent?: string;
+    /**
+     * The key this one replaces on the same device, when a revocation actually
+     * happened. Its presence is what makes this a rotation rather than a new
+     * device, so no event is announced for it.
+     *
+     * Only ever set from a `revokeKeyService` that returned true: an `oldKeyId`
+     * naming somebody else's key, an already-revoked key or nothing at all
+     * revokes nothing, and treating that as a rotation would be a way to
+     * register a device with the owner's notice switched off.
+     */
+    replacesKeyId?: string;
 }
 interface RotateKeyParams {
     userId: number;
@@ -1069,8 +1372,17 @@ interface RevokeKeyParams {
 }
 interface RevokeAllKeysParams {
     userId: number;
-    /** The key the request itself is signed with — spared unless includeCurrent. */
-    currentKeyId: string;
+    /**
+     * The key the request itself is signed with — spared unless includeCurrent.
+     *
+     * Optional because the two branches have different needs and always did: the
+     * sparing branch has to know what to spare, and the `includeCurrent` branch
+     * never reads it. The signed revoke-all link is the caller with no current
+     * key to name — it arrives with no session at all — and requiring a value it
+     * would have to invent is how a claim about a device that made no request
+     * gets into a result.
+     */
+    currentKeyId?: string;
     /** true signs the caller out too. Default false: "my other devices". */
     includeCurrent?: boolean;
     reason: string;
@@ -1105,6 +1417,15 @@ interface KeySummary {
     isActive: boolean;
     /** When it was revoked, for the "what did I cut off, and when" reading. */
     revokedAtMillis?: number;
+    /**
+     * Client address the key was registered from, absent when none was resolved
+     * or the key predates the column. Registration only — it does not move when
+     * the device authenticates from somewhere else, which is what makes it
+     * useful for recognising a device that was never yours.
+     */
+    registeredIp?: string;
+    /** `user-agent` of the registering request, on the same terms as above. */
+    registeredUserAgent?: string;
 }
 interface ListKeysParams {
     userId: number;
@@ -1136,10 +1457,13 @@ declare function rotateKeyService(params: RotateKeyParams): Promise<RotateKeyRes
 /**
  * Revoke a user's public key.
  *
- * Returns false when the key does not belong to this user, so a caller acting
- * on a key id from outside (the device list) can answer "not found" instead of
- * reporting a revocation that never happened. The repository already scopes the
- * update by userId, so someone else's key is never touched either way.
+ * Returns false when this call revoked nothing: the key belongs to somebody
+ * else, or it was already revoked, or there is no such key. A caller acting on
+ * a key id from outside (the device list) can therefore answer "not found"
+ * instead of reporting a revocation that never happened — and the login paths
+ * can tell a device replacement from a brand-new device, which is what decides
+ * whether the owner is told about it. The repository scopes the update by
+ * userId, so someone else's key is never touched either way.
  */
 declare function revokeKeyService(params: RevokeKeyParams): Promise<boolean>;
 /**
@@ -1476,6 +1800,10 @@ interface OAuthCallbackParams {
      * an empty array when absent; verification then fails closed.
      */
     expectedNonce: string | string[] | undefined;
+    /** Client address of the callback request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the callback request, already truncated at the route. */
+    userAgent?: string;
 }
 interface OAuthCallbackResult {
     redirectUrl: string;
@@ -1573,6 +1901,10 @@ interface OAuthNativeParams {
      * id_token이 담은 정보만으로 신원을 정규화한다.
      */
     accessToken?: string;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
     /** Apple은 첫 로그인에만 이름을 별도로 주므로 클라이언트가 전달할 수 있다. */
     profile?: {
         name?: string;
@@ -1971,6 +2303,21 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             includeCurrent: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
         }>;
     }, {}, RevokeAllKeysResult>;
+    confirmRevokeAllLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        expiresAt: string;
+        activeKeyCount: number;
+    }>;
+    consumeRevokeAllLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        revokedCount: number;
+    }>;
     changePassword: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -2272,6 +2619,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     updateLocale: _spfn_core_route.RouteDef<{
@@ -2736,4 +3084,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { type FinishPasskeyEnrollmentParams as $, type AuthInitOptions as A, type ChangePasswordParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type CompletePasswordResetParams as E, type FinishPasskeyEnrollmentResult as F, type CompleteSignupParams as G, type ConfirmPasswordResetParams as H, type IssueOneTimeTokenResult as I, type ConfirmSignupLinkParams as J, type KeySummary as K, type LoginResult as L, type DenyDeviceAuthParams as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, type DeviceAuthApprovedResult as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type DeviceAuthInfoParams as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type DeviceAuthPendingResult as W, DeviceAuthPollResponseSchema as X, DeviceNameSchema as Y, EmailSchema as Z, FingerprintSchema as _, type RegisterResult as a, finishPasskeyLoginService as a$, type FinishPasskeyLoginParams as a0, KEY_FINGERPRINT_PREFIX_LENGTH as a1, KeyIdSchema as a2, type LoginParams as a3, type LogoutParams as a4, type MachinePrincipal as a5, type MachineVerifierRegistration as a6, type NativeVerifyOptions as a7, type NormalizedIdentity as a8, type OAuth2AuthorizeParams as a9, type SendVerificationCodeParams as aA, type StartDeviceAuthParams as aB, type StartPasskeyEnrollmentParams as aC, TargetTypeSchema as aD, type UnlinkNotification as aE, UnlinkNotifyRejection as aF, type UnlinkNotifyRequest as aG, type UnlinkNotifyResult as aH, UserCodeSchema as aI, VerificationPurposeSchema as aJ, type VerifyCodeParams as aK, type VerifyCodeResult as aL, approveDeviceAuthService as aM, approveOAuth2AuthorizeService as aN, assertNotLastRecoveryCredential as aO, assertRecentAuthentication as aP, authenticate as aQ, buildOAuthErrorUrl as aR, changePasswordService as aS, completePasswordResetService as aT, completeSignupService as aU, confirmPasswordResetService as aV, confirmSignupLinkService as aW, denyDeviceAuthService as aX, denyOAuth2AuthorizeService as aY, describeOAuth2AuthorizeRequestService as aZ, finishPasskeyEnrollmentService as a_, type OAuth2ScopeDescription as aa, type OAuthCallbackParams as ab, type OAuthCallbackResult as ac, type OAuthCodeExchangeOptions as ad, type OAuthNativeParams as ae, type OAuthStartParams as af, type OAuthTokens as ag, PASSKEY_DEVICE_TYPES as ah, PASSKEY_LABEL_MAX_LENGTH as ai, type PasskeyDeviceType as aj, PasswordSchema as ak, PhoneSchema as al, PlatformSchema as am, type PollDeviceAuthParams as an, type PollDeviceAuthResult as ao, PublicKeySchema as ap, type RecentAuthenticationParams as aq, type RegisterParams as ar, type RegisterPublicKeyParams as as, type RenamePasskeyParams as at, type RequestPasswordResetParams as au, type RequestSignupLinkParams as av, type RevokeAllKeysParams as aw, type RevokeKeyParams as ax, type RevokePasskeyParams as ay, type RotateKeyParams as az, type RequestSignupLinkResult as b, getDeviceAuthInfoService as b0, getEnabledOAuthProviders as b1, getGoogleAccessToken as b2, getMachinePrincipal as b3, getOAuthProvider as b4, getRegisteredProviders as b5, isOAuthProviderEnabled as b6, issueOneTimeTokenService as b7, listKeysService as b8, listOAuth2GrantsService as b9, revokePasskeyService as bA, rotateKeyService as bB, runAuthProfile as bC, selectAuthProfile as bD, sendVerificationCodeService as bE, startDeviceAuthService as bF, startPasskeyEnrollmentService as bG, startPasskeyLoginService as bH, verifyCodeService as bI, verifyOneTimeTokenService as bJ, listPasskeysService as ba, loginService as bb, logoutService as bc, machineAuth as bd, oauthCallbackService as be, oauthNativeService as bf, oauthStartService as bg, oauthUnlinkNotifyService as bh, optionalAuth as bi, passkeys as bj, pollDeviceAuthService as bk, registerAuthProfile as bl, registerMachineVerifier as bm, registerOAuthProvider as bn, registerPublicKeyService as bo, registerService as bp, renamePasskeyService as bq, requestPasswordResetService as br, requestSignupLinkService as bs, requireEnabledProvider as bt, requireMachineScope as bu, resolveAuthenticatedUser as bv, revokeAllKeysService as bw, revokeAllOAuth2GrantsForUser as bx, revokeKeyService as by, revokeOAuth2GrantService as bz, type RequestPasswordResetResult as c, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type OAuth2ConsentView as k, type OAuth2AuthorizationCodeIssued as l, mainAuthRouter as m, type OAuth2GrantSummary as n, type AuthSession as o, PERMISSION_CATEGORIES as p, type PermissionCategory as q, VERIFICATION_TARGET_TYPES as r, type VerificationPurpose as s, type VerificationTargetType as t, type OAuthProvider as u, type Passkey as v, type AuthContext as w, type ApproveDeviceAuthParams as x, type AuthProfileOutcome as y, type AuthProfileVerifier as z };
+export { type DenyDeviceAuthParams as $, type AuthInitOptions as A, type AuthDeletionRequestedPayload as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type AuthDeviceRegisteredPayload as E, type FinishPasskeyEnrollmentResult as F, type AuthLoginPayload as G, type AuthPasswordResetPayload as H, type IssueOneTimeTokenResult as I, type AuthProfileOutcome as J, type KeySummary as K, type LoginResult as L, type AuthProfileVerifier as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, AuthProviderSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type AuthRegisterPayload as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type ChangePasswordParams as W, type CompletePasswordResetParams as X, type CompleteSignupParams as Y, type ConfirmPasswordResetParams as Z, type ConfirmSignupLinkParams as _, type RegisterResult as a, assertRecentAuthentication as a$, type DeviceAuthApprovedResult as a0, type DeviceAuthInfoParams as a1, type DeviceAuthPendingResult as a2, DeviceAuthPollResponseSchema as a3, DeviceNameSchema as a4, type DeviceRegistrationChannel as a5, EmailSchema as a6, FingerprintSchema as a7, type FinishPasskeyEnrollmentParams as a8, type FinishPasskeyLoginParams as a9, type PollDeviceAuthResult as aA, PublicKeySchema as aB, type RecentAuthenticationParams as aC, type RegisterParams as aD, type RegisterPublicKeyParams as aE, type RenamePasskeyParams as aF, type RequestPasswordResetParams as aG, type RequestSignupLinkParams as aH, type RevokeAllKeysParams as aI, type RevokeKeyParams as aJ, type RevokePasskeyParams as aK, type RotateKeyParams as aL, type SendVerificationCodeParams as aM, type StartDeviceAuthParams as aN, type StartPasskeyEnrollmentParams as aO, TargetTypeSchema as aP, type UnlinkNotification as aQ, UnlinkNotifyRejection as aR, type UnlinkNotifyRequest as aS, type UnlinkNotifyResult as aT, UserCodeSchema as aU, VerificationPurposeSchema as aV, type VerifyCodeParams as aW, type VerifyCodeResult as aX, approveDeviceAuthService as aY, approveOAuth2AuthorizeService as aZ, assertNotLastRecoveryCredential as a_, type InvitationAcceptedPayload as aa, type InvitationCreatedPayload as ab, KEY_FINGERPRINT_PREFIX_LENGTH as ac, KeyIdSchema as ad, type LoginParams as ae, type LogoutParams as af, type MachinePrincipal as ag, type MachineVerifierRegistration as ah, type NativeVerifyOptions as ai, type NormalizedIdentity as aj, type OAuth2AuthorizeParams as ak, type OAuth2ScopeDescription as al, type OAuthCallbackParams as am, type OAuthCallbackResult as an, type OAuthCodeExchangeOptions as ao, type OAuthNativeParams as ap, type OAuthStartParams as aq, type OAuthTokens as ar, type OAuthUnlinkedPayload as as, PASSKEY_DEVICE_TYPES as at, PASSKEY_LABEL_MAX_LENGTH as au, type PasskeyDeviceType as av, PasswordSchema as aw, PhoneSchema as ax, PlatformSchema as ay, type PollDeviceAuthParams as az, type RequestSignupLinkResult as b, startDeviceAuthService as b$, authDeletionCancelledEvent as b0, authDeletionCompletedEvent as b1, authDeletionRequestedEvent as b2, authDeviceRegisteredEvent as b3, authLoginEvent as b4, authPasswordResetEvent as b5, authRegisterEvent as b6, authenticate as b7, buildOAuthErrorUrl as b8, changePasswordService as b9, oauthNativeService as bA, oauthStartService as bB, oauthUnlinkNotifyService as bC, oauthUnlinkedEvent as bD, optionalAuth as bE, passkeys as bF, pollDeviceAuthService as bG, registerAuthProfile as bH, registerMachineVerifier as bI, registerOAuthProvider as bJ, registerPublicKeyService as bK, registerService as bL, renamePasskeyService as bM, requestPasswordResetService as bN, requestSignupLinkService as bO, requireEnabledProvider as bP, requireMachineScope as bQ, resolveAuthenticatedUser as bR, revokeAllKeysService as bS, revokeAllOAuth2GrantsForUser as bT, revokeKeyService as bU, revokeOAuth2GrantService as bV, revokePasskeyService as bW, rotateKeyService as bX, runAuthProfile as bY, selectAuthProfile as bZ, sendVerificationCodeService as b_, completePasswordResetService as ba, completeSignupService as bb, confirmPasswordResetService as bc, confirmSignupLinkService as bd, denyDeviceAuthService as be, denyOAuth2AuthorizeService as bf, describeOAuth2AuthorizeRequestService as bg, finishPasskeyEnrollmentService as bh, finishPasskeyLoginService as bi, getDeviceAuthInfoService as bj, getEnabledOAuthProviders as bk, getGoogleAccessToken as bl, getMachinePrincipal as bm, getOAuthProvider as bn, getRegisteredProviders as bo, invitationAcceptedEvent as bp, invitationCreatedEvent as bq, isOAuthProviderEnabled as br, issueOneTimeTokenService as bs, listKeysService as bt, listOAuth2GrantsService as bu, listPasskeysService as bv, loginService as bw, logoutService as bx, machineAuth as by, oauthCallbackService as bz, type RequestPasswordResetResult as c, startPasskeyEnrollmentService as c0, startPasskeyLoginService as c1, verifyCodeService as c2, verifyOneTimeTokenService as c3, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type OAuth2ConsentView as k, type OAuth2AuthorizationCodeIssued as l, mainAuthRouter as m, type OAuth2GrantSummary as n, type AuthSession as o, PERMISSION_CATEGORIES as p, type PermissionCategory as q, VERIFICATION_TARGET_TYPES as r, type VerificationPurpose as s, type VerificationTargetType as t, type OAuthProvider as u, type Passkey as v, type AuthContext as w, type ApproveDeviceAuthParams as x, type AuthDeletionCancelledPayload as y, type AuthDeletionCompletedPayload as z };