@spfn/auth 0.3.0-beta.21 → 0.3.0-beta.23

package/dist/{machine-principals-B7N8gux0.d.ts → machine-principals-CaEFq61K.d.ts}

@@ -148,6 +148,14 @@ interface LogoutParams {
 }
 interface ChangePasswordParams {
     userId: number;
+    /**
+     * The device key this request is signed with.
+     *
+     * Only read to measure the second-factor window of an enrolled account —
+     * an account with nothing enrolled is answered exactly as before, so this
+     * adds no refusal for anybody who has not opted in.
+     */
+    keyId: string;
     currentPassword?: string;
     newPassword: string;
     passwordHash?: string;
@@ -166,6 +174,11 @@ declare function loginService(params: LoginParams): Promise<LoginResult>;
 declare function logoutService(params: LogoutParams): Promise<void>;
 /**
  * Change user password
+ *
+ * An enrolled account steps up first (#95): a stolen session must not be able
+ * to take the account over by setting a new password. An unenrolled account is
+ * unaffected — including the OAuth-only account with no password and a key
+ * older than ten minutes, which still sets a first password and gets a 200.
  */
 declare function changePasswordService(params: ChangePasswordParams): Promise<void>;
 
@@ -822,6 +835,21 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        secondFactor: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
             tableName: "passkeys";
@@ -953,6 +981,11 @@ interface StartPasskeyEnrollmentParams {
 /**
  * Step 1 of enrollment — options for `navigator.credentials.create()`.
  *
+ * An enrolled account steps up first, and every account then meets the
+ * recent-authentication rule this route has always had (#95). The order is what
+ * makes the two independent: `assertStepUp` is a no-op for an unenrolled
+ * account, so the answer such a caller gets is byte-for-byte today's.
+ *
  * `excludeCredentials` lists the caller's **live** passkeys only, so the
  * authenticator quietly refuses one already enrolled here. Revoked ones are left
  * out on purpose: they must not be re-enrolled either, and the check that
@@ -1040,8 +1073,10 @@ interface RevokePasskeyParams {
 /**
  * Retire a passkey.
  *
- * Gated on recent authentication, because someone who walked up to an unlocked
- * laptop should not be able to strip the account's credentials; and on the
+ * Gated on the second factor for an enrolled account, and then — for every
+ * account, enrolled or not — on recent authentication, because someone who
+ * walked up to an unlocked laptop should not be able to strip the account's
+ * credentials; and on the
  * last-recovery-credential guard, because there is no undo for the state that
  * would leave.
  *
@@ -1056,6 +1091,318 @@ declare function revokePasskeyService(params: RevokePasskeyParams): Promise<{
     passkeyId: string;
 }>;
 
+/**
+ * @spfn/auth - Second-Factor Verification Entity
+ *
+ * When each device last proved the account's second factor. One row per device
+ * key, which is what makes the step-up window mean "this device, recently"
+ * rather than "somebody, somewhere, recently".
+ *
+ * `key_id` is the primary key and a foreign key onto `user_public_keys.key_id`,
+ * so the row dies with the device it belongs to — a revoked key cannot leave a
+ * verification behind for the next key that reuses its id, and deleting an
+ * account takes these with it. A rotation is the one moment the row moves
+ * rather than dying: rotating is already proof of the same device, so
+ * `rotateKeyService` and the login rotation carry the verification across, or
+ * the window would silently expire every time the proxy rotated a key.
+ */
+/**
+ * Which credential satisfied the step-up.
+ *
+ * Recorded for the owner-facing audit an app may build on it, and for support:
+ * "recovery" is the one that should be rare, and an account stepping up with
+ * recovery codes repeatedly has lost its authenticator.
+ */
+declare const MFA_VERIFICATION_METHODS: readonly ["totp", "recovery", "passkey"];
+type MfaVerificationMethod = typeof MFA_VERIFICATION_METHODS[number];
+declare const mfaVerifications: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_verifications";
+    schema: string;
+    columns: {
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        method: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["totp", "recovery", "passkey"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "string enum";
+            data: "totp" | "recovery" | "passkey";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["totp", "recovery", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        verifiedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type MfaVerification = typeof mfaVerifications.$inferSelect;
+type NewMfaVerification = typeof mfaVerifications.$inferInsert;
+
+/**
+ * @spfn/auth - Second Factor Service
+ *
+ * An optional second step the owner enrols, that the package then asks for at
+ * the moments a stolen first credential would be used. Two forms: a TOTP
+ * authenticator app, or a passkey the owner already enrolled and has marked as
+ * satisfying a step-up. Ten single-use recovery codes come with either.
+ *
+ * The rule the whole feature hangs on is the one in `assertStepUp`: an account
+ * that never enrolled is answered exactly as it is today, on every route. That
+ * is why the enrolment check comes first and returns, before any passkey
+ * configuration is read and before any second query is made — an app with no
+ * passkeys configured must still be able to change a password.
+ *
+ * The step-up window is per **device key**, not per account: "this device
+ * proved the second factor recently" is the claim a sensitive change needs, and
+ * a verification made on a phone must not authorize a change from a laptop. A
+ * key rotation carries the row across, because rotating is already proof of the
+ * same device.
+ *
+ * A secret and a recovery code appear in exactly three response bodies —
+ * `totp/enroll`, `totp/confirm` and `recovery/regenerate` — and nowhere else:
+ * not in `status`, not in an event, and not in a log line.
+ */
+
+/**
+ * Does this account have a second factor at all?
+ *
+ * One statement (`repositories/mfa-enrolment.repository.ts`), because every
+ * sensitive route and every device registration asks it, including the
+ * overwhelming majority that will answer false.
+ */
+declare function mfaEnrolledForUser(userId: number): Promise<boolean>;
+interface AssertStepUpParams {
+    userId: number;
+    /** The device key this request is signed with — the window is its window. */
+    keyId: string;
+    /** Override the configured window. Callers needing a tighter one pass it. */
+    maxAgeMs?: number;
+}
+/**
+ * Refuse a sensitive change unless this device proved the second factor recently.
+ *
+ * **No-op for an account with no second factor.** That is the contract of the
+ * whole feature: `changePassword` and `revokeAllKeys` have no recency gate
+ * today, and adding one for people who never opted in would be a new refusal on
+ * routes that never had one. Two of the callers do have a gate of their own —
+ * the passkey routes' `assertRecentAuthentication` — and they still run it
+ * afterwards; this adds a rule for enrolled accounts rather than replacing one.
+ *
+ * The unenrolled path therefore costs one indexed lookup and touches no passkey
+ * configuration, which is what lets an app with no passkeys at all call it.
+ *
+ * @throws StepUpRequiredError when the account is enrolled and the window has passed
+ */
+declare function assertStepUp(params: AssertStepUpParams): Promise<void>;
+/**
+ * Carry a device's verification onto the key that replaces it.
+ *
+ * Called from the two rotation seams — `rotateKeyService`, and the `oldKeyId`
+ * rotation every login path runs through `registerPublicKeyService`. Without
+ * it the window would expire silently on every rotation, which the web proxy
+ * does at each login: a user who stepped up a minute ago would be asked again
+ * with nothing to connect it to.
+ */
+declare function carryStepUpVerification(userId: number, fromKeyId: string, toKeyId: string): Promise<void>;
+interface TotpEnrolmentResult {
+    /** The base32 secret, shown once. Never logged, never returned again. */
+    secret: string;
+    /** The same secret as the URI an authenticator app scans. */
+    otpauthUri: string;
+}
+/**
+ * Mint a secret and park it unconfirmed.
+ *
+ * Calling this twice replaces the unconfirmed row and its failure counter — a
+ * user who closed the app before scanning starts over, which is also the
+ * documented remedy for a row that spent its five confirm attempts. A
+ * **confirmed** enrolment is refused instead: replacing a working second factor
+ * is `disable` followed by a fresh enrolment, both step-up gated, so nobody
+ * holding only a stolen session can swap an authenticator for their own.
+ *
+ * @throws MfaAlreadyEnrolledError when a confirmed enrolment already exists
+ */
+declare function startTotpEnrolmentService(userId: number): Promise<TotpEnrolmentResult>;
+interface ConfirmTotpParams {
+    userId: number;
+    /** The device this enrolment is being confirmed from — it gets the first verification. */
+    keyId: string;
+    code: string;
+}
+interface ConfirmTotpResult {
+    /** The ten plaintext codes, shown once. */
+    recoveryCodes: string[];
+}
+/**
+ * Spend the first code, which is what turns an enrolment into a second factor.
+ *
+ * Five wrong codes delete the unconfirmed row: at that point the person is
+ * reading the wrong entry in their app, and a fresh `enroll` is both the remedy
+ * and what resets the counter. A confirmed row is never deleted this way.
+ *
+ * The route deliberately runs this outside a transaction, so the counter
+ * survives the refusal that raised it; the success path opens its own, because
+ * the confirmation, the first verification and the recovery codes have to
+ * commit together or not at all.
+ *
+ * @throws MfaNotEnrolledError | MfaVerificationFailedError
+ */
+declare function confirmTotpEnrolmentService(params: ConfirmTotpParams): Promise<ConfirmTotpResult>;
+/**
+ * Replace the account's recovery codes, retiring every earlier one.
+ *
+ * The old generation's rows stay, unspent and unreachable: a code written down
+ * last year is refused with the same body as one that never existed, and the
+ * record of which generation a spent code came from survives.
+ *
+ * @throws MfaNotEnrolledError on an account with no second factor
+ */
+declare function regenerateRecoveryCodesService(userId: number): Promise<{
+    recoveryCodes: string[];
+}>;
+/**
+ * Take the second factor off the account entirely.
+ *
+ * Idempotent: an account with nothing enrolled is a success, because "make sure
+ * MFA is off" has already happened. The passkeys themselves are untouched —
+ * only their second-factor marks go, since a credential that signs the owner in
+ * is not something this route may remove.
+ */
+declare function disableMfaService(userId: number): Promise<void>;
+interface MarkPasskeyParams {
+    userId: number;
+    passkeyId: string;
+    secondFactor: boolean;
+}
+/**
+ * Mark or unmark one of the caller's passkeys as their second factor.
+ *
+ * Unmarking the last one is allowed, and leaves the account unenrolled. It is
+ * deliberately independent of `assertNotLastRecoveryCredential`, which guards
+ * `passkeys/revoke`: that rule protects a way *into* the account, and a
+ * second-factor mark is not one — the credential still signs the owner in
+ * afterwards, unchanged.
+ *
+ * @throws PasskeyNotFoundError for a credential that is not theirs, or revoked
+ */
+declare function markPasskeySecondFactorService(params: MarkPasskeyParams): Promise<MfaStatus>;
+/** What the account surface shows about the second factor. No secret is in it. */
+interface MfaStatus {
+    enrolled: boolean;
+    /** Which second factors are live: `'totp'`, `'passkey'`, or both. */
+    methods: ('totp' | 'passkey')[];
+    /** Unspent codes of the current generation, for the "2 left" warning. */
+    recoveryCodesRemaining: number;
+}
+/**
+ * The account's second-factor state.
+ *
+ * Carries no secret, no otpauth URI and no recovery code — only the counts and
+ * names an account screen needs. An unconfirmed enrolment is not a method: it
+ * gates nothing, so reporting it would tell the owner they are protected when
+ * they are not.
+ */
+declare function mfaStatusService(userId: number): Promise<MfaStatus>;
+/**
+ * Options for a step-up by passkey assertion.
+ *
+ * `allowCredentials` is empty, as it is for a sign-in and for the same reason
+ * (D3): the discoverable credential on the device names itself, and the owner
+ * and the second-factor mark are checked when the assertion comes back. The
+ * challenge is minted with kind `'mfa'` and this account's id, so it cannot be
+ * presented to `passkeys/login/verify` and a sign-in challenge cannot be
+ * presented here.
+ */
+declare function startStepUpService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
+interface StepUpParams {
+    userId: number;
+    /** The device the verification is recorded against. */
+    keyId: string;
+    code?: string;
+    recoveryCode?: string;
+    response?: AuthenticationResponseJSON;
+}
+/**
+ * Re-prove the second factor on this device, refreshing its window.
+ *
+ * The escape hatch the exempt registration channels need: a device-code
+ * approval and a passkey sign-in register a key with no verification against
+ * it, by design, so the session they create would otherwise fail every
+ * sensitive change with no way forward.
+ *
+ * @throws ValidationError when the body names none or more than one input
+ * @throws MfaNotEnrolledError | MfaVerificationFailedError
+ */
+declare function stepUpService(params: StepUpParams): Promise<void>;
+/**
+ * Check exactly one of the three proofs, and say which one it was.
+ *
+ * Exactly one: two inputs in a body is a caller trying combinations, and none
+ * is a malformed request. Neither is a failed verification, so both are a 400
+ * rather than the uniform 401 a wrong proof gets.
+ *
+ * @throws ValidationError | MfaVerificationFailedError
+ */
+declare function verifySecondFactor(params: StepUpParams): Promise<MfaVerificationMethod>;
+/**
+ * Drop enrolments nobody ever confirmed.
+ *
+ * A secret handed out and abandoned is a credential sitting in a table doing
+ * nothing; a day is long enough for anyone who meant to finish.
+ *
+ * @returns number of rows deleted
+ */
+declare function sweepUnconfirmedMfaService(): Promise<{
+    deleted: number;
+}>;
+
 /**
  * Auth provider type
  *
@@ -1070,10 +1417,16 @@ declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TL
  * - OAuth 기존 사용자 로그인 시
  * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
  *
+ * `mfaEnrolled` is computed as the event is emitted (#95) and is the whole of
+ * the package's opinion about the second factor: it never blocks an account
+ * that has none, and this is the hook an app uses to offer enrolment at a first
+ * login. It says nothing about *which* factor and carries no secret.
+ *
  * @example
  * ```typescript
  * authLoginEvent.subscribe(async (payload) => {
  *     await analytics.trackLogin(payload.userId, payload.provider);
+ *     if (!payload.mfaEnrolled) await suggestSecondFactor(payload.userId);
  * });
  * ```
  */
@@ -1081,7 +1434,8 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device" | "passkey";
+    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "passkey" | "device";
+    mfaEnrolled: boolean;
 }>;
 /**
  * Where a device key was registered — the door the new device came through.
@@ -1116,6 +1470,10 @@ type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
  * Neither the full fingerprint nor the public key is carried. The prefix is
  * enough to point at one entry of `listKeys`, which is what a notice needs.
  *
+ * `mfaEnrolled` is computed as the event is emitted (#95), so a notice about a
+ * new device can also be the moment an app offers a second factor to the
+ * accounts that have none.
+ *
  * @example
  * ```typescript
  * authDeviceRegisteredEvent.subscribe(async ({ userId, deviceName, ip, channel }) => {
@@ -1133,7 +1491,8 @@ declare const authDeviceRegisteredEvent: _spfn_core_event.EventDef<{
     userId: string;
     fingerprintPrefix: string;
     createdAtMillis: number;
-    channel: "password" | "register" | "oauth-native" | "oauth" | "invitation" | "signup-link" | "password-reset" | "passkey" | "device-code";
+    mfaEnrolled: boolean;
+    channel: "password" | "register" | "oauth-native" | "passkey" | "oauth" | "invitation" | "signup-link" | "password-reset" | "device-code";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -2272,6 +2631,39 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         passkeyId: string;
     }>;
+    mfaTotpEnroll: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, TotpEnrolmentResult>;
+    mfaTotpConfirm: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TString;
+        }>;
+    }, {}, ConfirmTotpResult>;
+    mfaDisable: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, void>;
+    mfaMarkPasskey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            passkeyId: _sinclair_typebox.TString;
+            secondFactor: _sinclair_typebox.TBoolean;
+        }>;
+    }, {}, MfaStatus>;
+    mfaRegenerateRecoveryCodes: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, {
+        recoveryCodes: string[];
+    }>;
+    mfaStatus: _spfn_core_route.RouteDef<{}, {}, MfaStatus>;
+    mfaStepUp: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            recoveryCode: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            response: _sinclair_typebox.TOptional<_sinclair_typebox.TUnknown>;
+        }>;
+    }, {}, void>;
+    mfaStepUpOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
     rotateKey: _spfn_core_route.RouteDef<{}, {
         body: _sinclair_typebox.TObject<{
@@ -3084,4 +3476,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { type DenyDeviceAuthParams as $, type AuthInitOptions as A, type AuthDeletionRequestedPayload as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type AuthDeviceRegisteredPayload as E, type FinishPasskeyEnrollmentResult as F, type AuthLoginPayload as G, type AuthPasswordResetPayload as H, type IssueOneTimeTokenResult as I, type AuthProfileOutcome as J, type KeySummary as K, type LoginResult as L, type AuthProfileVerifier as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, AuthProviderSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type AuthRegisterPayload as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type ChangePasswordParams as W, type CompletePasswordResetParams as X, type CompleteSignupParams as Y, type ConfirmPasswordResetParams as Z, type ConfirmSignupLinkParams as _, type RegisterResult as a, assertRecentAuthentication as a$, type DeviceAuthApprovedResult as a0, type DeviceAuthInfoParams as a1, type DeviceAuthPendingResult as a2, DeviceAuthPollResponseSchema as a3, DeviceNameSchema as a4, type DeviceRegistrationChannel as a5, EmailSchema as a6, FingerprintSchema as a7, type FinishPasskeyEnrollmentParams as a8, type FinishPasskeyLoginParams as a9, type PollDeviceAuthResult as aA, PublicKeySchema as aB, type RecentAuthenticationParams as aC, type RegisterParams as aD, type RegisterPublicKeyParams as aE, type RenamePasskeyParams as aF, type RequestPasswordResetParams as aG, type RequestSignupLinkParams as aH, type RevokeAllKeysParams as aI, type RevokeKeyParams as aJ, type RevokePasskeyParams as aK, type RotateKeyParams as aL, type SendVerificationCodeParams as aM, type StartDeviceAuthParams as aN, type StartPasskeyEnrollmentParams as aO, TargetTypeSchema as aP, type UnlinkNotification as aQ, UnlinkNotifyRejection as aR, type UnlinkNotifyRequest as aS, type UnlinkNotifyResult as aT, UserCodeSchema as aU, VerificationPurposeSchema as aV, type VerifyCodeParams as aW, type VerifyCodeResult as aX, approveDeviceAuthService as aY, approveOAuth2AuthorizeService as aZ, assertNotLastRecoveryCredential as a_, type InvitationAcceptedPayload as aa, type InvitationCreatedPayload as ab, KEY_FINGERPRINT_PREFIX_LENGTH as ac, KeyIdSchema as ad, type LoginParams as ae, type LogoutParams as af, type MachinePrincipal as ag, type MachineVerifierRegistration as ah, type NativeVerifyOptions as ai, type NormalizedIdentity as aj, type OAuth2AuthorizeParams as ak, type OAuth2ScopeDescription as al, type OAuthCallbackParams as am, type OAuthCallbackResult as an, type OAuthCodeExchangeOptions as ao, type OAuthNativeParams as ap, type OAuthStartParams as aq, type OAuthTokens as ar, type OAuthUnlinkedPayload as as, PASSKEY_DEVICE_TYPES as at, PASSKEY_LABEL_MAX_LENGTH as au, type PasskeyDeviceType as av, PasswordSchema as aw, PhoneSchema as ax, PlatformSchema as ay, type PollDeviceAuthParams as az, type RequestSignupLinkResult as b, startDeviceAuthService as b$, authDeletionCancelledEvent as b0, authDeletionCompletedEvent as b1, authDeletionRequestedEvent as b2, authDeviceRegisteredEvent as b3, authLoginEvent as b4, authPasswordResetEvent as b5, authRegisterEvent as b6, authenticate as b7, buildOAuthErrorUrl as b8, changePasswordService as b9, oauthNativeService as bA, oauthStartService as bB, oauthUnlinkNotifyService as bC, oauthUnlinkedEvent as bD, optionalAuth as bE, passkeys as bF, pollDeviceAuthService as bG, registerAuthProfile as bH, registerMachineVerifier as bI, registerOAuthProvider as bJ, registerPublicKeyService as bK, registerService as bL, renamePasskeyService as bM, requestPasswordResetService as bN, requestSignupLinkService as bO, requireEnabledProvider as bP, requireMachineScope as bQ, resolveAuthenticatedUser as bR, revokeAllKeysService as bS, revokeAllOAuth2GrantsForUser as bT, revokeKeyService as bU, revokeOAuth2GrantService as bV, revokePasskeyService as bW, rotateKeyService as bX, runAuthProfile as bY, selectAuthProfile as bZ, sendVerificationCodeService as b_, completePasswordResetService as ba, completeSignupService as bb, confirmPasswordResetService as bc, confirmSignupLinkService as bd, denyDeviceAuthService as be, denyOAuth2AuthorizeService as bf, describeOAuth2AuthorizeRequestService as bg, finishPasskeyEnrollmentService as bh, finishPasskeyLoginService as bi, getDeviceAuthInfoService as bj, getEnabledOAuthProviders as bk, getGoogleAccessToken as bl, getMachinePrincipal as bm, getOAuthProvider as bn, getRegisteredProviders as bo, invitationAcceptedEvent as bp, invitationCreatedEvent as bq, isOAuthProviderEnabled as br, issueOneTimeTokenService as bs, listKeysService as bt, listOAuth2GrantsService as bu, listPasskeysService as bv, loginService as bw, logoutService as bx, machineAuth as by, oauthCallbackService as bz, type RequestPasswordResetResult as c, startPasskeyEnrollmentService as c0, startPasskeyLoginService as c1, verifyCodeService as c2, verifyOneTimeTokenService as c3, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type OAuth2ConsentView as k, type OAuth2AuthorizationCodeIssued as l, mainAuthRouter as m, type OAuth2GrantSummary as n, type AuthSession as o, PERMISSION_CATEGORIES as p, type PermissionCategory as q, VERIFICATION_TARGET_TYPES as r, type VerificationPurpose as s, type VerificationTargetType as t, type OAuthProvider as u, type Passkey as v, type AuthContext as w, type ApproveDeviceAuthParams as x, type AuthDeletionCancelledPayload as y, type AuthDeletionCompletedPayload as z };
+export { type AuthRegisterPayload as $, type AuthInitOptions as A, type ApproveDeviceAuthParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type AssertStepUpParams as E, type FinishPasskeyEnrollmentResult as F, type AuthDeletionCancelledPayload as G, type AuthDeletionCompletedPayload as H, type IssueOneTimeTokenResult as I, type AuthDeletionRequestedPayload as J, type KeySummary as K, type LoginResult as L, type MfaStatus as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, type AuthDeviceRegisteredPayload as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type AuthLoginPayload as W, type AuthPasswordResetPayload as X, type AuthProfileOutcome as Y, type AuthProfileVerifier as Z, AuthProviderSchema as _, type RegisterResult as a, type UnlinkNotification as a$, type ChangePasswordParams as a0, type CompletePasswordResetParams as a1, type CompleteSignupParams as a2, type ConfirmPasswordResetParams as a3, type ConfirmSignupLinkParams as a4, type ConfirmTotpParams as a5, type DenyDeviceAuthParams as a6, type DeviceAuthApprovedResult as a7, type DeviceAuthInfoParams as a8, type DeviceAuthPendingResult as a9, type OAuthStartParams as aA, type OAuthTokens as aB, type OAuthUnlinkedPayload as aC, PASSKEY_DEVICE_TYPES as aD, PASSKEY_LABEL_MAX_LENGTH as aE, type PasskeyDeviceType as aF, PasswordSchema as aG, PhoneSchema as aH, PlatformSchema as aI, type PollDeviceAuthParams as aJ, type PollDeviceAuthResult as aK, PublicKeySchema as aL, type RecentAuthenticationParams as aM, type RegisterParams as aN, type RegisterPublicKeyParams as aO, type RenamePasskeyParams as aP, type RequestPasswordResetParams as aQ, type RequestSignupLinkParams as aR, type RevokeAllKeysParams as aS, type RevokeKeyParams as aT, type RevokePasskeyParams as aU, type RotateKeyParams as aV, type SendVerificationCodeParams as aW, type StartDeviceAuthParams as aX, type StartPasskeyEnrollmentParams as aY, type StepUpParams as aZ, TargetTypeSchema as a_, DeviceAuthPollResponseSchema as aa, DeviceNameSchema as ab, type DeviceRegistrationChannel as ac, EmailSchema as ad, FingerprintSchema as ae, type FinishPasskeyEnrollmentParams as af, type FinishPasskeyLoginParams as ag, type InvitationAcceptedPayload as ah, type InvitationCreatedPayload as ai, KEY_FINGERPRINT_PREFIX_LENGTH as aj, KeyIdSchema as ak, type LoginParams as al, type LogoutParams as am, MFA_VERIFICATION_METHODS as an, type MachinePrincipal as ao, type MachineVerifierRegistration as ap, type MarkPasskeyParams as aq, type NativeVerifyOptions as ar, type NewMfaVerification as as, type NormalizedIdentity as at, type OAuth2AuthorizeParams as au, type OAuth2ScopeDescription as av, type OAuthCallbackParams as aw, type OAuthCallbackResult as ax, type OAuthCodeExchangeOptions as ay, type OAuthNativeParams as az, type RequestSignupLinkResult as b, registerAuthProfile as b$, UnlinkNotifyRejection as b0, type UnlinkNotifyRequest as b1, type UnlinkNotifyResult as b2, UserCodeSchema as b3, VerificationPurposeSchema as b4, type VerifyCodeParams as b5, type VerifyCodeResult as b6, approveDeviceAuthService as b7, approveOAuth2AuthorizeService as b8, assertNotLastRecoveryCredential as b9, getGoogleAccessToken as bA, getMachinePrincipal as bB, getOAuthProvider as bC, getRegisteredProviders as bD, invitationAcceptedEvent as bE, invitationCreatedEvent as bF, isOAuthProviderEnabled as bG, issueOneTimeTokenService as bH, listKeysService as bI, listOAuth2GrantsService as bJ, listPasskeysService as bK, loginService as bL, logoutService as bM, machineAuth as bN, markPasskeySecondFactorService as bO, mfaEnrolledForUser as bP, mfaStatusService as bQ, mfaVerifications as bR, oauthCallbackService as bS, oauthNativeService as bT, oauthStartService as bU, oauthUnlinkNotifyService as bV, oauthUnlinkedEvent as bW, optionalAuth as bX, passkeys as bY, pollDeviceAuthService as bZ, regenerateRecoveryCodesService as b_, assertRecentAuthentication as ba, assertStepUp as bb, authDeletionCancelledEvent as bc, authDeletionCompletedEvent as bd, authDeletionRequestedEvent as be, authDeviceRegisteredEvent as bf, authLoginEvent as bg, authPasswordResetEvent as bh, authRegisterEvent as bi, authenticate as bj, buildOAuthErrorUrl as bk, carryStepUpVerification as bl, changePasswordService as bm, completePasswordResetService as bn, completeSignupService as bo, confirmPasswordResetService as bp, confirmSignupLinkService as bq, confirmTotpEnrolmentService as br, denyDeviceAuthService as bs, denyOAuth2AuthorizeService as bt, describeOAuth2AuthorizeRequestService as bu, disableMfaService as bv, finishPasskeyEnrollmentService as bw, finishPasskeyLoginService as bx, getDeviceAuthInfoService as by, getEnabledOAuthProviders as bz, type RequestPasswordResetResult as c, registerMachineVerifier as c0, registerOAuthProvider as c1, registerPublicKeyService as c2, registerService as c3, renamePasskeyService as c4, requestPasswordResetService as c5, requestSignupLinkService as c6, requireEnabledProvider as c7, requireMachineScope as c8, resolveAuthenticatedUser as c9, revokeAllKeysService as ca, revokeAllOAuth2GrantsForUser as cb, revokeKeyService as cc, revokeOAuth2GrantService as cd, revokePasskeyService as ce, rotateKeyService as cf, runAuthProfile as cg, selectAuthProfile as ch, sendVerificationCodeService as ci, startDeviceAuthService as cj, startPasskeyEnrollmentService as ck, startPasskeyLoginService as cl, startStepUpService as cm, startTotpEnrolmentService as cn, stepUpService as co, sweepUnconfirmedMfaService as cp, verifyCodeService as cq, verifyOneTimeTokenService as cr, verifySecondFactor as cs, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type ConfirmTotpResult as g, type RotateKeyResult as h, type RevokeAllKeysResult as i, type OAuthNativeResult as j, type ProfileInfo as k, type OAuth2ConsentView as l, mainAuthRouter as m, type OAuth2AuthorizationCodeIssued as n, type OAuth2GrantSummary as o, type AuthSession as p, PERMISSION_CATEGORIES as q, type PermissionCategory as r, VERIFICATION_TARGET_TYPES as s, type VerificationPurpose as t, type VerificationTargetType as u, type OAuthProvider as v, type Passkey as w, type MfaVerification as x, type MfaVerificationMethod as y, type AuthContext as z };