@spfn/auth 0.3.0-beta.20 → 0.3.0-beta.21

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, u as OAuthProvider, s as VerificationPurpose, N as NewPasskey, v as Passkey, q as PermissionCategory, w as AuthContext } from './machine-principals-BD4tnASp.js';
-export { x as ApproveDeviceAuthParams, y as AuthProfileOutcome, z as AuthProfileVerifier, B as ChangePasswordParams, E as CompletePasswordResetParams, G as CompleteSignupParams, H as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, J as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, M as DenyDeviceAuthParams, Q as DeviceAuthApprovedResult, T as DeviceAuthInfoParams, D as DeviceAuthInfoResult, W as DeviceAuthPendingResult, X as DeviceAuthPollResponseSchema, Y as DeviceNameSchema, Z as EmailSchema, _ as FingerprintSchema, $ as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, a0 as FinishPasskeyLoginParams, I as IssueOneTimeTokenResult, a1 as KEY_FINGERPRINT_PREFIX_LENGTH, a2 as KeyIdSchema, K as KeySummary, a3 as LoginParams, L as LoginResult, a4 as LogoutParams, a5 as MachinePrincipal, a6 as MachineVerifierRegistration, a7 as NativeVerifyOptions, a8 as NormalizedIdentity, l as OAuth2AuthorizationCodeIssued, a9 as OAuth2AuthorizeParams, k as OAuth2ConsentView, n as OAuth2GrantSummary, aa as OAuth2ScopeDescription, ab as OAuthCallbackParams, ac as OAuthCallbackResult, ad as OAuthCodeExchangeOptions, ae as OAuthNativeParams, i as OAuthNativeResult, af as OAuthStartParams, O as OAuthStartResult, ag as OAuthTokens, ah as PASSKEY_DEVICE_TYPES, ai as PASSKEY_LABEL_MAX_LENGTH, aj as PasskeyDeviceType, f as PasskeySummary, ak as PasswordSchema, al as PhoneSchema, am as PlatformSchema, an as PollDeviceAuthParams, ao as PollDeviceAuthResult, ap as PublicKeySchema, aq as RecentAuthenticationParams, ar as RegisterParams, as as RegisterPublicKeyParams, a as RegisterResult, at as RenamePasskeyParams, au as RequestPasswordResetParams, c as RequestPasswordResetResult, av as RequestSignupLinkParams, b as RequestSignupLinkResult, aw as RevokeAllKeysParams, h as RevokeAllKeysResult, ax as RevokeKeyParams, ay as RevokePasskeyParams, az as RotateKeyParams, g as RotateKeyResult, aA as SendVerificationCodeParams, S as SendVerificationCodeResult, aB as StartDeviceAuthParams, e as StartDeviceAuthResult, aC as StartPasskeyEnrollmentParams, aD as TargetTypeSchema, aE as UnlinkNotification, aF as UnlinkNotifyRejection, aG as UnlinkNotifyRequest, aH as UnlinkNotifyResult, aI as UserCodeSchema, V as VERIFICATION_PURPOSES, r as VERIFICATION_TARGET_TYPES, aJ as VerificationPurposeSchema, t as VerificationTargetType, aK as VerifyCodeParams, aL as VerifyCodeResult, aM as approveDeviceAuthService, aN as approveOAuth2AuthorizeService, aO as assertNotLastRecoveryCredential, aP as assertRecentAuthentication, m as authRouter, aQ as authenticate, aR as buildOAuthErrorUrl, aS as changePasswordService, aT as completePasswordResetService, aU as completeSignupService, aV as confirmPasswordResetService, aW as confirmSignupLinkService, aX as denyDeviceAuthService, aY as denyOAuth2AuthorizeService, aZ as describeOAuth2AuthorizeRequestService, a_ as finishPasskeyEnrollmentService, a$ as finishPasskeyLoginService, b0 as getDeviceAuthInfoService, b1 as getEnabledOAuthProviders, b2 as getGoogleAccessToken, b3 as getMachinePrincipal, b4 as getOAuthProvider, b5 as getRegisteredProviders, b6 as isOAuthProviderEnabled, b7 as issueOneTimeTokenService, b8 as listKeysService, b9 as listOAuth2GrantsService, ba as listPasskeysService, bb as loginService, bc as logoutService, bd as machineAuth, be as oauthCallbackService, bf as oauthNativeService, bg as oauthStartService, bh as oauthUnlinkNotifyService, bi as optionalAuth, bj as passkeys, bk as pollDeviceAuthService, bl as registerAuthProfile, bm as registerMachineVerifier, bn as registerOAuthProvider, bo as registerPublicKeyService, bp as registerService, bq as renamePasskeyService, br as requestPasswordResetService, bs as requestSignupLinkService, bt as requireEnabledProvider, bu as requireMachineScope, bv as resolveAuthenticatedUser, bw as revokeAllKeysService, bx as revokeAllOAuth2GrantsForUser, by as revokeKeyService, bz as revokeOAuth2GrantService, bA as revokePasskeyService, bB as rotateKeyService, bC as runAuthProfile, bD as selectAuthProfile, bE as sendVerificationCodeService, bF as startDeviceAuthService, bG as startPasskeyEnrollmentService, bH as startPasskeyLoginService, bI as verifyCodeService, bJ as verifyOneTimeTokenService } from './machine-principals-BD4tnASp.js';
+import { A as AuthInitOptions, u as OAuthProvider, s as VerificationPurpose, N as NewPasskey, v as Passkey, q as PermissionCategory, w as AuthContext } from './machine-principals-B7N8gux0.js';
+export { x as ApproveDeviceAuthParams, y as AuthDeletionCancelledPayload, z as AuthDeletionCompletedPayload, B as AuthDeletionRequestedPayload, E as AuthDeviceRegisteredPayload, G as AuthLoginPayload, H as AuthPasswordResetPayload, J as AuthProfileOutcome, M as AuthProfileVerifier, Q as AuthProviderSchema, T as AuthRegisterPayload, W as ChangePasswordParams, X as CompletePasswordResetParams, Y as CompleteSignupParams, Z as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, _ as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, $ as DenyDeviceAuthParams, a0 as DeviceAuthApprovedResult, a1 as DeviceAuthInfoParams, D as DeviceAuthInfoResult, a2 as DeviceAuthPendingResult, a3 as DeviceAuthPollResponseSchema, a4 as DeviceNameSchema, a5 as DeviceRegistrationChannel, a6 as EmailSchema, a7 as FingerprintSchema, a8 as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, a9 as FinishPasskeyLoginParams, aa as InvitationAcceptedPayload, ab as InvitationCreatedPayload, I as IssueOneTimeTokenResult, ac as KEY_FINGERPRINT_PREFIX_LENGTH, ad as KeyIdSchema, K as KeySummary, ae as LoginParams, L as LoginResult, af as LogoutParams, ag as MachinePrincipal, ah as MachineVerifierRegistration, ai as NativeVerifyOptions, aj as NormalizedIdentity, l as OAuth2AuthorizationCodeIssued, ak as OAuth2AuthorizeParams, k as OAuth2ConsentView, n as OAuth2GrantSummary, al as OAuth2ScopeDescription, am as OAuthCallbackParams, an as OAuthCallbackResult, ao as OAuthCodeExchangeOptions, ap as OAuthNativeParams, i as OAuthNativeResult, aq as OAuthStartParams, O as OAuthStartResult, ar as OAuthTokens, as as OAuthUnlinkedPayload, at as PASSKEY_DEVICE_TYPES, au as PASSKEY_LABEL_MAX_LENGTH, av as PasskeyDeviceType, f as PasskeySummary, aw as PasswordSchema, ax as PhoneSchema, ay as PlatformSchema, az as PollDeviceAuthParams, aA as PollDeviceAuthResult, aB as PublicKeySchema, aC as RecentAuthenticationParams, aD as RegisterParams, aE as RegisterPublicKeyParams, a as RegisterResult, aF as RenamePasskeyParams, aG as RequestPasswordResetParams, c as RequestPasswordResetResult, aH as RequestSignupLinkParams, b as RequestSignupLinkResult, aI as RevokeAllKeysParams, h as RevokeAllKeysResult, aJ as RevokeKeyParams, aK as RevokePasskeyParams, aL as RotateKeyParams, g as RotateKeyResult, aM as SendVerificationCodeParams, S as SendVerificationCodeResult, aN as StartDeviceAuthParams, e as StartDeviceAuthResult, aO as StartPasskeyEnrollmentParams, aP as TargetTypeSchema, aQ as UnlinkNotification, aR as UnlinkNotifyRejection, aS as UnlinkNotifyRequest, aT as UnlinkNotifyResult, aU as UserCodeSchema, V as VERIFICATION_PURPOSES, r as VERIFICATION_TARGET_TYPES, aV as VerificationPurposeSchema, t as VerificationTargetType, aW as VerifyCodeParams, aX as VerifyCodeResult, aY as approveDeviceAuthService, aZ as approveOAuth2AuthorizeService, a_ as assertNotLastRecoveryCredential, a$ as assertRecentAuthentication, b0 as authDeletionCancelledEvent, b1 as authDeletionCompletedEvent, b2 as authDeletionRequestedEvent, b3 as authDeviceRegisteredEvent, b4 as authLoginEvent, b5 as authPasswordResetEvent, b6 as authRegisterEvent, m as authRouter, b7 as authenticate, b8 as buildOAuthErrorUrl, b9 as changePasswordService, ba as completePasswordResetService, bb as completeSignupService, bc as confirmPasswordResetService, bd as confirmSignupLinkService, be as denyDeviceAuthService, bf as denyOAuth2AuthorizeService, bg as describeOAuth2AuthorizeRequestService, bh as finishPasskeyEnrollmentService, bi as finishPasskeyLoginService, bj as getDeviceAuthInfoService, bk as getEnabledOAuthProviders, bl as getGoogleAccessToken, bm as getMachinePrincipal, bn as getOAuthProvider, bo as getRegisteredProviders, bp as invitationAcceptedEvent, bq as invitationCreatedEvent, br as isOAuthProviderEnabled, bs as issueOneTimeTokenService, bt as listKeysService, bu as listOAuth2GrantsService, bv as listPasskeysService, bw as loginService, bx as logoutService, by as machineAuth, bz as oauthCallbackService, bA as oauthNativeService, bB as oauthStartService, bC as oauthUnlinkNotifyService, bD as oauthUnlinkedEvent, bE as optionalAuth, bF as passkeys, bG as pollDeviceAuthService, bH as registerAuthProfile, bI as registerMachineVerifier, bJ as registerOAuthProvider, bK as registerPublicKeyService, bL as registerService, bM as renamePasskeyService, bN as requestPasswordResetService, bO as requestSignupLinkService, bP as requireEnabledProvider, bQ as requireMachineScope, bR as resolveAuthenticatedUser, bS as revokeAllKeysService, bT as revokeAllOAuth2GrantsForUser, bU as revokeKeyService, bV as revokeOAuth2GrantService, bW as revokePasskeyService, bX as rotateKeyService, bY as runAuthProfile, bZ as selectAuthProfile, b_ as sendVerificationCodeService, b$ as startDeviceAuthService, c0 as startPasskeyEnrollmentService, c1 as startPasskeyLoginService, c2 as verifyCodeService, c3 as verifyOneTimeTokenService } from './machine-principals-B7N8gux0.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { j as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
@@ -15,12 +15,101 @@ import { JWTPayload } from 'jose';
 import { SSETokenManager, SSETokenStore } from '@spfn/core/event/sse';
 import * as _spfn_core_logger from '@spfn/core/logger';
 import * as _spfn_core_job from '@spfn/core/job';
-import * as _spfn_core_event from '@spfn/core/event';
-import * as _sinclair_typebox from '@sinclair/typebox';
 import '@simplewebauthn/server';
+import '@sinclair/typebox';
+import '@spfn/core/event';
 import '@spfn/auth/server';
 import 'jsonwebtoken';
 
+/**
+ * @spfn/auth - Signed Sign-Out-Everywhere Link
+ *
+ * A link an app mails to an account's proven address, which signs every device
+ * of that account out without a session. It exists for the case the rest of the
+ * key surface cannot serve: the owner suspects a device they do not recognise,
+ * and the device they would have to sign in on to do something about it is the
+ * one they no longer trust.
+ *
+ * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
+ * mints the capability and hands the app a URL. `describeRevokeAllLink` says
+ * whether that URL still works and changes nothing, so a mail scanner opening
+ * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
+ * and it takes the owner pressing the button.
+ *
+ * The caller's obligation, which this package cannot enforce: the URL
+ * `createRevokeAllLink` returns carries the plaintext token, because the package
+ * sends no mail here. Do not log it, do not persist it, do not put it in a job
+ * payload — hand it to the mail template and let it go. Every other link in this
+ * package is minted inside the worker that sends it precisely so that no caller
+ * ever holds one; this one cannot be, and the obligation moves to the app.
+ */
+interface CreateRevokeAllLinkOptions {
+    /**
+     * Minutes the link stays valid. Defaults to
+     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
+     */
+    ttlMinutes?: number;
+}
+interface RevokeAllLink {
+    /** Absolute URL of the app page, token in its query string. Never log it. */
+    url: string;
+    expiresAt: Date;
+}
+/** What the describe call tells the page, so it can say what pressing the button does. */
+interface RevokeAllLinkDescription {
+    expiresAt: Date;
+    activeKeyCount: number;
+}
+/**
+ * Mint a sign-out-everywhere link for an account.
+ *
+ * Issuing supersedes every live link the account already has, the rule the
+ * password-reset flow follows: an owner who asks twice must not leave the first
+ * capability working in their mailbox after using the second.
+ *
+ * The row records the account's key generation, so the link dies the moment any
+ * other path signs every device out — a password reset, a password change, a
+ * deletion request, or the ordinary revoke-all route.
+ *
+ * Send it beside a password reset link. It ends the sessions; it does not change
+ * the password that let them start.
+ *
+ * @param userId - The account to issue for
+ * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
+ * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
+ */
+declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
+/**
+ * Say whether a presented link still works, and what pressing the button would
+ * do. Changes nothing — a mail scanner that opens the page has done nothing.
+ *
+ * @throws RevokeAllLinkError every refusal, in one shape
+ */
+declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
+/**
+ * Spend a link and sign every device of the account out.
+ *
+ * The claim is one statement, so of two requests carrying the same token exactly
+ * one revokes and the other is refused as if the token were unknown — which by
+ * then it is. `includeCurrent` is true because there is no current device here:
+ * the caller holds a mailbox, not a session, and sparing something would mean
+ * sparing whatever the owner is trying to cut off.
+ *
+ * @returns how many device keys were revoked; zero is a success, not a refusal
+ * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
+ */
+declare function consumeRevokeAllLink(token: string): Promise<{
+    revokedCount: number;
+}>;
+/**
+ * Delete link rows that can no longer answer anything.
+ *
+ * @returns number of rows deleted
+ */
+declare function purgeRevokeAllTokensService(): Promise<{
+    deleted: number;
+}>;
+
 /**
  * @spfn/auth - Global Configuration
  *
@@ -553,6 +642,21 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        keyEpoch: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
+            name: string;
+            tableName: "users";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         lastLoginAt: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
             tableName: "users";
@@ -599,6 +703,7 @@ declare function getUserByIdService(userId: number): Promise<{
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
+    keyEpoch: number;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -620,6 +725,7 @@ declare function getUserByEmailService(email: string): Promise<{
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
+    keyEpoch: number;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -641,6 +747,7 @@ declare function getUserByPhoneService(phone: string): Promise<{
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
+    keyEpoch: number;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -681,6 +788,7 @@ declare function updateUsernameService(userId: string | number | bigint, usernam
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
+    keyEpoch: number;
     lastLoginAt: Date | null;
 }>;
 
@@ -1514,6 +1622,10 @@ declare function acceptInvitation(params: {
     keyId: string;
     fingerprint: string;
     algorithm: KeyAlgorithmType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
 }): Promise<{
     userId: number;
     email: string;
@@ -3136,6 +3248,36 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        registeredIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        registeredUserAgent: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         clientKind: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["web", "ios", "android"] & [string, ...string[]]>, {
             name: string;
             tableName: "user_public_keys";
@@ -4050,6 +4192,169 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
 type PasswordResetToken = typeof passwordResetTokens.$inferSelect;
 type NewPasswordResetToken = typeof passwordResetTokens.$inferInsert;
 
+/**
+ * @spfn/auth - Revoke-All Link Tokens Entity
+ *
+ * Backs the signed sign-out-everywhere link: a one-time token an app mails to
+ * an account's proven address, which revokes every device key of that account
+ * without a session. It is the action an owner can take from a mailbox when the
+ * device they would otherwise have to sign in on is the one they no longer
+ * trust.
+ *
+ * `key_epoch` is what makes the link dead rather than merely spent. It records
+ * the account's key generation at issue time, and the consume statement joins it
+ * against `users.key_epoch` — so a password reset, a password change, a deletion
+ * request or an earlier revoke-all, every one of which moves the counter, leaves
+ * the outstanding link answering the same 404 an unknown token gets.
+ *
+ * The token is a bearer credential, so only its SHA-256 hash is stored, the same
+ * way the signup and reset links store theirs.
+ */
+declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "key_revoke_all_tokens";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        keyEpoch: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type KeyRevokeAllToken = typeof keyRevokeAllTokens.$inferSelect;
+type NewKeyRevokeAllToken = typeof keyRevokeAllTokens.$inferInsert;
+
 /**
  * @spfn/auth - WebAuthn Challenges Entity
  *
@@ -5657,6 +5962,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5682,6 +5988,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5718,6 +6025,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5750,6 +6058,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5772,6 +6081,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5794,6 +6104,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5816,6 +6127,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5838,6 +6150,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     } | null>;
     /**
@@ -5863,6 +6176,7 @@ declare class UsersRepository extends BaseRepository {
             status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
             emailVerifiedAt: Date | null;
             phoneVerifiedAt: Date | null;
+            keyEpoch: number;
             lastLoginAt: Date | null;
         };
         role: {
@@ -5889,6 +6203,7 @@ declare class UsersRepository extends BaseRepository {
         updatedAt: Date;
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -5958,6 +6273,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5985,6 +6301,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6007,6 +6324,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6029,6 +6347,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6049,6 +6368,7 @@ declare class UsersRepository extends BaseRepository {
         updatedAt: Date;
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
+        keyEpoch: number;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -6118,6 +6438,16 @@ declare const usersRepository: UsersRepository;
  * BaseRepository를 상속받아 자동 트랜잭션 컨텍스트 지원 및 Read/Write 분리
  */
 
+/**
+ * What a global revocation answers with.
+ *
+ * The key id and nothing else: every caller counts the rows or names them, and
+ * the statement that produces them revokes keys and moves the account's key
+ * generation at once, which a typed Drizzle update cannot express.
+ */
+interface RevokedKey {
+    keyId: string;
+}
 /**
  * User Public Keys Repository 클래스
  *
@@ -6140,6 +6470,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6164,6 +6496,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6188,6 +6522,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6220,6 +6556,8 @@ declare class KeysRepository extends BaseRepository {
         lastUsedAt: Date | null;
         expiresAt: Date | null;
         revokedAt: Date | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
     }[]>;
     /**
      * 공개키 생성
@@ -6233,12 +6571,14 @@ declare class KeysRepository extends BaseRepository {
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
         userId: number;
+        expiresAt: Date | null;
         id: number;
         isActive: boolean;
         createdAt: Date;
-        expiresAt: Date | null;
         revokedAt: Date | null;
         lastUsedAt: Date | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6246,7 +6586,13 @@ declare class KeysRepository extends BaseRepository {
         revokedReason: string | null;
     }>;
     /**
-     * 공개키 revoke (비활성화)
+     * 공개키 revoke (비활성화) — 아직 살아 있는 키만
+     *
+     * `isActive`가 조건에 있어야 반환값이 "이 호출이 무언가를 폐기했는가"를 뜻한다.
+     * 없으면 이미 폐기된 키를 다시 지목해도 행이 하나 돌아와, 호출자는 폐기가
+     * 일어났다고 읽는다. 로그인 경로가 그 값으로 "기기 교체인가 새 기기인가"를
+     * 가르므로, 죽은 키를 들이밀어 새 기기 알림을 끄는 길이 된다.
+     * 폐기 시각·사유도 덮어쓰지 않는다 — 처음 끊긴 순간이 답이다.
      * Write primary 사용
      */
     revokeByKeyIdAndUserId(keyId: string, userId: number, reason: string): Promise<{
@@ -6258,6 +6604,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6270,59 +6618,37 @@ declare class KeysRepository extends BaseRepository {
         revokedReason: string | null;
     }>;
     /**
-     * 사용자의 모든 활성 공개키 revoke (비활성화)
+     * 사용자의 모든 활성 공개키 revoke (비활성화) — 그리고 같은 문장에서 key_epoch +1
      *
      * 비번 변경 시 전체 세션 로그아웃에 사용. authenticate는 활성 키만 검증하므로,
      * revoke된 키로 서명한 기존 세션의 요청은 즉시 401이 된다.
      * Write primary 사용
      */
-    revokeAllActiveByUserId(userId: number, reason: string): Promise<{
-        id: number;
-        userId: number;
-        keyId: string;
-        publicKey: string;
-        algorithm: "ES256" | "RS256";
-        fingerprint: string;
-        deviceName: string | null;
-        platform: "ios" | "android" | "web" | "desktop" | null;
-        clientKind: "ios" | "android" | "web" | null;
-        clientVersion: string | null;
-        clientContractVersion: string | null;
-        clientSeenAt: Date | null;
-        isActive: boolean;
-        createdAt: Date;
-        lastUsedAt: Date | null;
-        expiresAt: Date | null;
-        revokedAt: Date | null;
-        revokedReason: string | null;
-    }[]>;
+    revokeAllActiveByUserId(userId: number, reason: string): Promise<RevokedKey[]>;
     /**
-     * 지정한 키 하나만 남기고 사용자의 활성 공개키를 전부 revoke
+     * 지정한 키 하나만 남기고 사용자의 활성 공개키를 전부 revoke — key_epoch도 +1
      *
      * "다른 기기 전부 로그아웃" — 요청을 보낸 기기는 살려 둔다. 남길 키를 별도 조회로
      * 확인하지 않고 조건에 담아, 그 사이에 다른 요청이 키를 바꾸는 경쟁을 만들지 않는다.
+     *
+     * 한 기기를 남기더라도 epoch는 오른다. 미소비 revoke-all 링크가 죽는 쪽이 보수적이고,
+     * 사용자가 "나머지 전부 로그아웃"을 이미 눌렀다면 메일함의 링크는 목적을 다했다.
      * Write primary 사용
      */
-    revokeAllActiveByUserIdExcept(userId: number, keepKeyId: string, reason: string): Promise<{
-        id: number;
-        userId: number;
-        keyId: string;
-        publicKey: string;
-        algorithm: "ES256" | "RS256";
-        fingerprint: string;
-        deviceName: string | null;
-        platform: "ios" | "android" | "web" | "desktop" | null;
-        clientKind: "ios" | "android" | "web" | null;
-        clientVersion: string | null;
-        clientContractVersion: string | null;
-        clientSeenAt: Date | null;
-        isActive: boolean;
-        createdAt: Date;
-        lastUsedAt: Date | null;
-        expiresAt: Date | null;
-        revokedAt: Date | null;
-        revokedReason: string | null;
-    }[]>;
+    revokeAllActiveByUserIdExcept(userId: number, keepKeyId: string, reason: string): Promise<RevokedKey[]>;
+    /**
+     * The one statement behind both global revocations.
+     *
+     * The epoch bump is a data-modifying CTE on the same statement rather than a
+     * second call, so that no caller can revoke every key and forget to move the
+     * counter — and three of the four callers are services that never see the
+     * counter at all. It runs whether or not any key matched: an account with no
+     * active keys still had its generation ended, and an outstanding
+     * sign-out-everywhere link must die with it.
+     *
+     * Write primary 사용
+     */
+    private revokeActive;
     /**
      * 공개키 삭제
      * Write primary 사용
@@ -6335,12 +6661,14 @@ declare class KeysRepository extends BaseRepository {
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
         userId: number;
+        expiresAt: Date | null;
         id: number;
         isActive: boolean;
         createdAt: Date;
-        expiresAt: Date | null;
         revokedAt: Date | null;
         lastUsedAt: Date | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6368,6 +6696,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6392,6 +6722,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6419,6 +6751,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6443,6 +6777,8 @@ declare class KeysRepository extends BaseRepository {
         fingerprint: string;
         deviceName: string | null;
         platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6536,10 +6872,10 @@ declare class VerificationCodesRepository extends BaseRepository {
         targetType: "email" | "phone";
         purpose: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
         code: string;
+        expiresAt: Date;
         id: number;
         createdAt: Date;
         updatedAt: Date;
-        expiresAt: Date;
         usedAt: Date | null;
         attempts: number;
     }>;
@@ -6778,6 +7114,86 @@ declare class PasswordResetTokensRepository extends BaseRepository {
 }
 declare const passwordResetTokensRepository: PasswordResetTokensRepository;
 
+/**
+ * Revoke-All Link Tokens Repository
+ *
+ * Data access for the signed sign-out-everywhere link. Extends BaseRepository
+ * for transaction-context detection and read/write splitting.
+ *
+ * `consume` is one statement and returns the account only if THIS call was the
+ * one that spent the link. Two requests arriving with the same token therefore
+ * produce one revocation and one refusal, rather than both reading an unspent
+ * row and both proceeding — a read-then-write would lose that race, and the
+ * race is the interesting one for a credential sitting in a mailbox.
+ *
+ * Every lookup filters to a usable row rather than returning whatever it finds.
+ * Unknown, expired, spent, superseded, out of generation and not-an-active-
+ * account are one refusal to the caller, so there is nothing to learn from
+ * telling them apart — and a filter in the statement cannot be forgotten the
+ * way a state check can.
+ */
+
+/** What a live link says about itself, for the describe call that changes nothing. */
+interface LiveRevokeAllLink {
+    userId: number;
+    expiresAt: Date;
+}
+declare class KeyRevokeAllTokensRepository extends BaseRepository {
+    /**
+     * Write an issued link row.
+     * Write primary.
+     */
+    create(data: NewKeyRevokeAllToken): Promise<KeyRevokeAllToken>;
+    /**
+     * Supersede every live link for an account, so issuing a new one retires the
+     * previous one rather than leaving two capabilities in a mailbox.
+     *
+     * Write primary.
+     *
+     * @returns number of rows superseded
+     */
+    supersedeAllLiveByUserId(userId: number): Promise<number>;
+    /**
+     * Find a link that could still be spent right now, without spending it.
+     *
+     * Joined to the account on both the generation and an active status, so the
+     * describe call answers exactly what consume would: a link issued before a
+     * password reset, or for an account since suspended or anonymized, is not
+     * live here either.
+     *
+     * Read replica.
+     */
+    findLiveByTokenHash(tokenHash: string): Promise<LiveRevokeAllLink | null>;
+    /**
+     * Spend a link, and answer with the account it belonged to.
+     *
+     * One UPDATE with every condition in it and `RETURNING`, rather than a read
+     * and a write: the row is claimed by whichever request the database serves
+     * first, and the other matches nothing. Nothing opens a transaction around
+     * it, so the claim is not held open across the revocation that follows.
+     *
+     * Write primary.
+     *
+     * @returns the account id, or null if the link was not spendable by this call
+     */
+    consume(tokenHash: string): Promise<number | null>;
+    /**
+     * Delete rows nothing can be learned from any more.
+     *
+     * Two ages, because the two states stop mattering at different times. An
+     * expired row is kept a week so a support question about a link that was
+     * mailed can still be answered; a spent or superseded one is kept a day,
+     * since the refusal it produces is already indistinguishable from the one an
+     * unknown token gets and the row is only bookkeeping after that.
+     *
+     * Write primary.
+     *
+     * @returns number of rows deleted
+     */
+    purge(expiredBefore: Date, settledBefore: Date): Promise<number>;
+}
+declare const keyRevokeAllTokensRepository: KeyRevokeAllTokensRepository;
+
 /**
  * Passkeys Repository
  *
@@ -7352,12 +7768,12 @@ declare class UserPermissionsRepository extends BaseRepository {
      */
     create(data: NewUserPermission): Promise<{
         userId: number;
+        expiresAt: Date | null;
         id: number;
         createdAt: Date;
         updatedAt: Date;
         permissionId: number;
         reason: string | null;
-        expiresAt: Date | null;
         granted: boolean;
     }>;
     /**
@@ -7378,12 +7794,12 @@ declare class UserPermissionsRepository extends BaseRepository {
      */
     deleteByUserIdAndPermissionId(userId: number, permissionId: number): Promise<{
         userId: number;
+        expiresAt: Date | null;
         id: number;
         createdAt: Date;
         updatedAt: Date;
         permissionId: number;
         reason: string | null;
-        expiresAt: Date | null;
         granted: boolean;
     }>;
     /**
@@ -7728,12 +8144,12 @@ declare class InvitationsRepository extends BaseRepository {
         metadata: Record<string, any> | null;
         token: string;
         status: "pending" | "accepted" | "expired" | "cancelled";
+        expiresAt: Date;
         id: number;
         roleId: number;
         createdAt: Date;
         updatedAt: Date;
         invitedBy: number;
-        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -7762,12 +8178,12 @@ declare class InvitationsRepository extends BaseRepository {
         metadata: Record<string, any> | null;
         token: string;
         status: "pending" | "accepted" | "expired" | "cancelled";
+        expiresAt: Date;
         id: number;
         roleId: number;
         createdAt: Date;
         updatedAt: Date;
         invitedBy: number;
-        expiresAt: Date;
         acceptedAt: Date | null;
         cancelledAt: Date | null;
     }>;
@@ -9092,6 +9508,7 @@ declare function getUser(c: Context | {
     updatedAt: Date;
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
+    keyEpoch: number;
     lastLoginAt: Date | null;
     deletedAt: Date | null;
     deletedBy: string | null;
@@ -9973,6 +10390,34 @@ declare function createAuthLifecycle(options?: AuthLifecycleOptions): AuthLifecy
  */
 declare function createAuthDeletionPurgeJob(cronExpression?: string): _spfn_core_job.JobDef<void, void>;
 
+/**
+ * @spfn/auth - Revoke-All Link Token Purge Job
+ *
+ * `key_revoke_all_tokens` gains a row every time an app issues a
+ * sign-out-everywhere link, and a row that can no longer answer anything is
+ * only storage. This sweep deletes them.
+ *
+ * Two ages, because the two states stop mattering at different times. An expired
+ * row is kept a week, so a support question about a link that was mailed can
+ * still be answered from the table. A spent or superseded one is kept a day: the
+ * refusal it produces is already indistinguishable from the one an unknown token
+ * gets, so after that it is bookkeeping.
+ *
+ * Registration is NOT automatic, for the reason `deletion-purge.ts` sets out at
+ * length: `createAuthLifecycle()`'s `afterInfrastructure` hook runs before
+ * `registerJobs` in `@spfn/core`'s startup, so the lifecycle cannot register a
+ * job itself. Applications register `authJobRouter`, which carries this one
+ * beside the deletion purge, the stale-client sweep and the link mailer.
+ */
+/** Daily at 06:00, an hour after the stale-client sweep so the three do not overlap. */
+declare const DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON = "0 6 * * *";
+/**
+ * Build the `auth.revoke-all-token-purge` job with a given cron schedule.
+ *
+ * @param cronExpression - Defaults to daily at 06:00
+ */
+declare function createRevokeAllTokenPurgeJob(cronExpression?: string): _spfn_core_job.JobDef<void, void>;
+
 /**
  * Send the mail one request deferred.
  *
@@ -9994,7 +10439,8 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
 
 /**
  * Build the auth job router: the account-deletion purge sweep, the OAuth 2.1
- * stale-client sweep, and the link-mail sender.
+ * stale-client sweep, the sign-out-everywhere link sweep, and the link-mail
+ * sender.
  *
  * The cron is a parameter because `job(...).cron(expression)` bakes the string in
  * at module-import time, which always happens before `createAuthLifecycle()` runs
@@ -10004,13 +10450,16 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
  *
  * @param options.purgeCron - Deletion purge schedule; defaults to daily at 04:00
  * @param options.oauth2ClientPurgeCron - Stale OAuth client sweep; defaults to daily at 05:00
+ * @param options.revokeAllTokenPurgeCron - Sign-out-everywhere link sweep; defaults to daily at 06:00
  */
 declare function createAuthJobRouter(options?: {
     purgeCron?: string;
     oauth2ClientPurgeCron?: string;
+    revokeAllTokenPurgeCron?: string;
 }): _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
     oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
+    revokeAllTokenPurge: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -10030,6 +10479,7 @@ declare function createAuthJobRouter(options?: {
 declare const authJobRouter: _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
     oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
+    revokeAllTokenPurge: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -10049,216 +10499,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-/**
- * @spfn/auth - Auth Events
- *
- * 인증 관련 이벤트 정의
- * - auth.login: 로그인 성공 시 (기존 사용자만)
- * - auth.register: 회원가입 성공 시 (OAuth 신규 가입 포함)
- */
-/**
- * Auth provider type
- *
- * 직접 인증(email/phone) + 등록 가능한 모든 소셜 provider(SOCIAL_PROVIDERS).
- */
-declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">, ..._sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]]>;
-/**
- * auth.login - 로그인 성공 이벤트
- *
- * 발행 시점:
- * - 이메일/전화 로그인 성공 시
- * - OAuth 기존 사용자 로그인 시
- * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
- *
- * @example
- * ```typescript
- * authLoginEvent.subscribe(async (payload) => {
- *     await analytics.trackLogin(payload.userId, payload.provider);
- * });
- * ```
- */
-declare const authLoginEvent: _spfn_core_event.EventDef<{
-    email?: string | undefined;
-    phone?: string | undefined;
-    userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device" | "passkey";
-}>;
-/**
- * auth.register - 회원가입 성공 이벤트
- *
- * 발행 시점:
- * - 이메일/전화 회원가입 성공 시
- * - OAuth 신규 사용자 가입 시
- *
- * @example
- * ```typescript
- * authRegisterEvent.subscribe(async (payload) => {
- *     await emailService.sendWelcome(payload.email);
- * });
- * ```
- */
-declare const authRegisterEvent: _spfn_core_event.EventDef<{
-    email?: string | undefined;
-    phone?: string | undefined;
-    metadata?: {
-        [x: string]: unknown;
-    } | undefined;
-    userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
-}>;
-/**
- * auth.invitation.created - 초대 생성 이벤트
- *
- * 발행 시점:
- * - createInvitation() 성공 시
- * - resendInvitation() 성공 시
- *
- * @example
- * ```typescript
- * invitationCreatedEvent.subscribe(async (payload) => {
- *     const inviteUrl = `${APP_URL}/invite/${payload.token}`;
- *     await notificationService.send({
- *         channel: 'email',
- *         to: payload.email,
- *         subject: 'You are invited!',
- *         html: renderInviteEmail({ inviteUrl, ...payload.metadata }),
- *     });
- * });
- * ```
- */
-declare const invitationCreatedEvent: _spfn_core_event.EventDef<{
-    metadata?: {
-        [x: string]: unknown;
-    } | undefined;
-    email: string;
-    token: string;
-    roleId: number;
-    invitedBy: string;
-    expiresAt: string;
-    invitationId: string;
-    isResend: boolean;
-}>;
-/**
- * auth.invitation.accepted - 초대 수락 이벤트
- *
- * 발행 시점:
- * - acceptInvitation() 성공 시
- *
- * @example
- * ```typescript
- * invitationAcceptedEvent.subscribe(async (payload) => {
- *     await onboardingService.start(payload.userId);
- * });
- * ```
- */
-declare const invitationAcceptedEvent: _spfn_core_event.EventDef<{
-    metadata?: {
-        [x: string]: unknown;
-    } | undefined;
-    email: string;
-    userId: string;
-    roleId: number;
-    invitedBy: string;
-    invitationId: string;
-}>;
-/**
- * auth.deletion.requested - 계정 탈퇴 요청 이벤트
- *
- * 발행 시점:
- * - requestAccountDeletionService() 성공 시 (self/admin 공통)
- *
- * @example
- * ```typescript
- * authDeletionRequestedEvent.subscribe(async (payload) => {
- *     await analytics.trackChurnRisk(payload.userId);
- * });
- * ```
- */
-declare const authDeletionRequestedEvent: _spfn_core_event.EventDef<{
-    userId: string;
-    purgeScheduledAt: string;
-    userPublicId: string;
-    requestedBy: "admin" | "self";
-}>;
-/**
- * auth.deletion.cancelled - 계정 탈퇴 복구 이벤트
- *
- * 발행 시점:
- * - cancelAccountDeletionService() 성공 시 (유예 기간 내 복구)
- */
-declare const authDeletionCancelledEvent: _spfn_core_event.EventDef<{
-    userId: string;
-    userPublicId: string;
-}>;
-/**
- * auth.deletion.completed - 계정 파기 완료 이벤트
- *
- * 발행 시점:
- * - purge job(또는 즉시 파기 경로)이 유저를 파기한 직후
- *
- * PII를 담지 않는다 — userId(내부 순번)/email/phone 없이 userPublicId만 실어
- * 파기 완료 이후에도 구독자가 식별 정보를 다시 축적하지 않도록 한다.
- */
-declare const authDeletionCompletedEvent: _spfn_core_event.EventDef<{
-    userPublicId: string;
-    purgeStrategy: "anonymize" | "hard-delete";
-}>;
-/**
- * auth.oauth.unlinked - provider발 연동 해제 이벤트
- *
- * 발행 시점:
- * - provider(카카오·네이버 등)가 unlink-notify 웹훅으로 연동 해제를 알려와
- *   소셜 계정 연결과 저장 토큰이 삭제된 직후
- *
- * 연결 삭제까지는 프레임워크가 수행하고, 그 이후(계정 탈퇴로 이어갈지 등)는
- * 앱 정책이므로 이 이벤트를 구독해 처리한다.
- *
- * @example
- * ```typescript
- * oauthUnlinkedEvent.subscribe(async (payload) => {
- *     await requestAccountDeletionService({ userId: payload.userId, requestedBy: 'self' });
- * });
- * ```
- */
-declare const oauthUnlinkedEvent: _spfn_core_event.EventDef<{
-    reason?: string | undefined;
-    userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself";
-    providerUserId: string;
-}>;
-/**
- * auth.password.reset — an account's password was replaced through a reset link
- *
- * 발행 시점:
- * - completePasswordResetService()가 커밋된 직후
- *
- * Distinct from a password *change*, which is made from a session that already
- * proved itself. This one is made by whoever opened a link in a mailbox, so it
- * is the event an app hangs a "your password was reset" notice on — and the
- * signal to look at, if the owner says they did not ask for it.
- *
- * @example
- * ```typescript
- * authPasswordResetEvent.subscribe(async (payload) => {
- *     await notifyOwner(payload.userId, 'Your password was reset');
- * });
- * ```
- */
-declare const authPasswordResetEvent: _spfn_core_event.EventDef<{
-    email: string;
-    userId: string;
-}>;
-/**
- * Auth event payload types
- */
-type AuthLoginPayload = typeof authLoginEvent._payload;
-type AuthRegisterPayload = typeof authRegisterEvent._payload;
-type AuthPasswordResetPayload = typeof authPasswordResetEvent._payload;
-type InvitationCreatedPayload = typeof invitationCreatedEvent._payload;
-type InvitationAcceptedPayload = typeof invitationAcceptedEvent._payload;
-type AuthDeletionRequestedPayload = typeof authDeletionRequestedEvent._payload;
-type AuthDeletionCancelledPayload = typeof authDeletionCancelledEvent._payload;
-type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
-type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
-
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionCancelledPayload, type AuthDeletionCompletedPayload, type AuthDeletionConfig, type AuthDeletionRequestedPayload, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthLoginPayload, type AuthMetadataEntity, AuthMetadataRepository, type AuthPasswordResetPayload, AuthProviderSchema, type AuthRegisterPayload, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, type InvitationAcceptedPayload, type InvitationCreatedPayload, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, KeysRepository, MAX_UNGRANTED_CLIENTS_PER_IP, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, type OAuthUnlinkedPayload, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authDeletionCancelledEvent, authDeletionCompletedEvent, authDeletionRequestedEvent, authJobRouter, authLogger, authLoginEvent, authMetadata, authMetadataRepository, authPasswordResetEvent, authRegisterEvent, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationAcceptedEvent, invitationCreatedEvent, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oauthUnlinkedEvent, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };