@spfn/auth 0.3.0-beta.21 → 0.3.0-beta.23

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { A as AuthInitOptions, u as OAuthProvider, s as VerificationPurpose, N as NewPasskey, v as Passkey, q as PermissionCategory, w as AuthContext } from './machine-principals-B7N8gux0.js';
-export { x as ApproveDeviceAuthParams, y as AuthDeletionCancelledPayload, z as AuthDeletionCompletedPayload, B as AuthDeletionRequestedPayload, E as AuthDeviceRegisteredPayload, G as AuthLoginPayload, H as AuthPasswordResetPayload, J as AuthProfileOutcome, M as AuthProfileVerifier, Q as AuthProviderSchema, T as AuthRegisterPayload, W as ChangePasswordParams, X as CompletePasswordResetParams, Y as CompleteSignupParams, Z as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, _ as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, $ as DenyDeviceAuthParams, a0 as DeviceAuthApprovedResult, a1 as DeviceAuthInfoParams, D as DeviceAuthInfoResult, a2 as DeviceAuthPendingResult, a3 as DeviceAuthPollResponseSchema, a4 as DeviceNameSchema, a5 as DeviceRegistrationChannel, a6 as EmailSchema, a7 as FingerprintSchema, a8 as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, a9 as FinishPasskeyLoginParams, aa as InvitationAcceptedPayload, ab as InvitationCreatedPayload, I as IssueOneTimeTokenResult, ac as KEY_FINGERPRINT_PREFIX_LENGTH, ad as KeyIdSchema, K as KeySummary, ae as LoginParams, L as LoginResult, af as LogoutParams, ag as MachinePrincipal, ah as MachineVerifierRegistration, ai as NativeVerifyOptions, aj as NormalizedIdentity, l as OAuth2AuthorizationCodeIssued, ak as OAuth2AuthorizeParams, k as OAuth2ConsentView, n as OAuth2GrantSummary, al as OAuth2ScopeDescription, am as OAuthCallbackParams, an as OAuthCallbackResult, ao as OAuthCodeExchangeOptions, ap as OAuthNativeParams, i as OAuthNativeResult, aq as OAuthStartParams, O as OAuthStartResult, ar as OAuthTokens, as as OAuthUnlinkedPayload, at as PASSKEY_DEVICE_TYPES, au as PASSKEY_LABEL_MAX_LENGTH, av as PasskeyDeviceType, f as PasskeySummary, aw as PasswordSchema, ax as PhoneSchema, ay as PlatformSchema, az as PollDeviceAuthParams, aA as PollDeviceAuthResult, aB as PublicKeySchema, aC as RecentAuthenticationParams, aD as RegisterParams, aE as RegisterPublicKeyParams, a as RegisterResult, aF as RenamePasskeyParams, aG as RequestPasswordResetParams, c as RequestPasswordResetResult, aH as RequestSignupLinkParams, b as RequestSignupLinkResult, aI as RevokeAllKeysParams, h as RevokeAllKeysResult, aJ as RevokeKeyParams, aK as RevokePasskeyParams, aL as RotateKeyParams, g as RotateKeyResult, aM as SendVerificationCodeParams, S as SendVerificationCodeResult, aN as StartDeviceAuthParams, e as StartDeviceAuthResult, aO as StartPasskeyEnrollmentParams, aP as TargetTypeSchema, aQ as UnlinkNotification, aR as UnlinkNotifyRejection, aS as UnlinkNotifyRequest, aT as UnlinkNotifyResult, aU as UserCodeSchema, V as VERIFICATION_PURPOSES, r as VERIFICATION_TARGET_TYPES, aV as VerificationPurposeSchema, t as VerificationTargetType, aW as VerifyCodeParams, aX as VerifyCodeResult, aY as approveDeviceAuthService, aZ as approveOAuth2AuthorizeService, a_ as assertNotLastRecoveryCredential, a$ as assertRecentAuthentication, b0 as authDeletionCancelledEvent, b1 as authDeletionCompletedEvent, b2 as authDeletionRequestedEvent, b3 as authDeviceRegisteredEvent, b4 as authLoginEvent, b5 as authPasswordResetEvent, b6 as authRegisterEvent, m as authRouter, b7 as authenticate, b8 as buildOAuthErrorUrl, b9 as changePasswordService, ba as completePasswordResetService, bb as completeSignupService, bc as confirmPasswordResetService, bd as confirmSignupLinkService, be as denyDeviceAuthService, bf as denyOAuth2AuthorizeService, bg as describeOAuth2AuthorizeRequestService, bh as finishPasskeyEnrollmentService, bi as finishPasskeyLoginService, bj as getDeviceAuthInfoService, bk as getEnabledOAuthProviders, bl as getGoogleAccessToken, bm as getMachinePrincipal, bn as getOAuthProvider, bo as getRegisteredProviders, bp as invitationAcceptedEvent, bq as invitationCreatedEvent, br as isOAuthProviderEnabled, bs as issueOneTimeTokenService, bt as listKeysService, bu as listOAuth2GrantsService, bv as listPasskeysService, bw as loginService, bx as logoutService, by as machineAuth, bz as oauthCallbackService, bA as oauthNativeService, bB as oauthStartService, bC as oauthUnlinkNotifyService, bD as oauthUnlinkedEvent, bE as optionalAuth, bF as passkeys, bG as pollDeviceAuthService, bH as registerAuthProfile, bI as registerMachineVerifier, bJ as registerOAuthProvider, bK as registerPublicKeyService, bL as registerService, bM as renamePasskeyService, bN as requestPasswordResetService, bO as requestSignupLinkService, bP as requireEnabledProvider, bQ as requireMachineScope, bR as resolveAuthenticatedUser, bS as revokeAllKeysService, bT as revokeAllOAuth2GrantsForUser, bU as revokeKeyService, bV as revokeOAuth2GrantService, bW as revokePasskeyService, bX as rotateKeyService, bY as runAuthProfile, bZ as selectAuthProfile, b_ as sendVerificationCodeService, b$ as startDeviceAuthService, c0 as startPasskeyEnrollmentService, c1 as startPasskeyLoginService, c2 as verifyCodeService, c3 as verifyOneTimeTokenService } from './machine-principals-B7N8gux0.js';
+import { A as AuthInitOptions, v as OAuthProvider, t as VerificationPurpose, N as NewPasskey, w as Passkey, x as MfaVerification, y as MfaVerificationMethod, r as PermissionCategory, z as AuthContext } from './machine-principals-CaEFq61K.js';
+export { B as ApproveDeviceAuthParams, E as AssertStepUpParams, G as AuthDeletionCancelledPayload, H as AuthDeletionCompletedPayload, J as AuthDeletionRequestedPayload, Q as AuthDeviceRegisteredPayload, W as AuthLoginPayload, X as AuthPasswordResetPayload, Y as AuthProfileOutcome, Z as AuthProfileVerifier, _ as AuthProviderSchema, $ as AuthRegisterPayload, a0 as ChangePasswordParams, a1 as CompletePasswordResetParams, a2 as CompleteSignupParams, a3 as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, a4 as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, a5 as ConfirmTotpParams, g as ConfirmTotpResult, a6 as DenyDeviceAuthParams, a7 as DeviceAuthApprovedResult, a8 as DeviceAuthInfoParams, D as DeviceAuthInfoResult, a9 as DeviceAuthPendingResult, aa as DeviceAuthPollResponseSchema, ab as DeviceNameSchema, ac as DeviceRegistrationChannel, ad as EmailSchema, ae as FingerprintSchema, af as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, ag as FinishPasskeyLoginParams, ah as InvitationAcceptedPayload, ai as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aj as KEY_FINGERPRINT_PREFIX_LENGTH, ak as KeyIdSchema, K as KeySummary, al as LoginParams, L as LoginResult, am as LogoutParams, an as MFA_VERIFICATION_METHODS, ao as MachinePrincipal, ap as MachineVerifierRegistration, aq as MarkPasskeyParams, M as MfaStatus, ar as NativeVerifyOptions, as as NewMfaVerification, at as NormalizedIdentity, n as OAuth2AuthorizationCodeIssued, au as OAuth2AuthorizeParams, l as OAuth2ConsentView, o as OAuth2GrantSummary, av as OAuth2ScopeDescription, aw as OAuthCallbackParams, ax as OAuthCallbackResult, ay as OAuthCodeExchangeOptions, az as OAuthNativeParams, j as OAuthNativeResult, aA as OAuthStartParams, O as OAuthStartResult, aB as OAuthTokens, aC as OAuthUnlinkedPayload, aD as PASSKEY_DEVICE_TYPES, aE as PASSKEY_LABEL_MAX_LENGTH, aF as PasskeyDeviceType, f as PasskeySummary, aG as PasswordSchema, aH as PhoneSchema, aI as PlatformSchema, aJ as PollDeviceAuthParams, aK as PollDeviceAuthResult, aL as PublicKeySchema, aM as RecentAuthenticationParams, aN as RegisterParams, aO as RegisterPublicKeyParams, a as RegisterResult, aP as RenamePasskeyParams, aQ as RequestPasswordResetParams, c as RequestPasswordResetResult, aR as RequestSignupLinkParams, b as RequestSignupLinkResult, aS as RevokeAllKeysParams, i as RevokeAllKeysResult, aT as RevokeKeyParams, aU as RevokePasskeyParams, aV as RotateKeyParams, h as RotateKeyResult, aW as SendVerificationCodeParams, S as SendVerificationCodeResult, aX as StartDeviceAuthParams, e as StartDeviceAuthResult, aY as StartPasskeyEnrollmentParams, aZ as StepUpParams, a_ as TargetTypeSchema, T as TotpEnrolmentResult, a$ as UnlinkNotification, b0 as UnlinkNotifyRejection, b1 as UnlinkNotifyRequest, b2 as UnlinkNotifyResult, b3 as UserCodeSchema, V as VERIFICATION_PURPOSES, s as VERIFICATION_TARGET_TYPES, b4 as VerificationPurposeSchema, u as VerificationTargetType, b5 as VerifyCodeParams, b6 as VerifyCodeResult, b7 as approveDeviceAuthService, b8 as approveOAuth2AuthorizeService, b9 as assertNotLastRecoveryCredential, ba as assertRecentAuthentication, bb as assertStepUp, bc as authDeletionCancelledEvent, bd as authDeletionCompletedEvent, be as authDeletionRequestedEvent, bf as authDeviceRegisteredEvent, bg as authLoginEvent, bh as authPasswordResetEvent, bi as authRegisterEvent, m as authRouter, bj as authenticate, bk as buildOAuthErrorUrl, bl as carryStepUpVerification, bm as changePasswordService, bn as completePasswordResetService, bo as completeSignupService, bp as confirmPasswordResetService, bq as confirmSignupLinkService, br as confirmTotpEnrolmentService, bs as denyDeviceAuthService, bt as denyOAuth2AuthorizeService, bu as describeOAuth2AuthorizeRequestService, bv as disableMfaService, bw as finishPasskeyEnrollmentService, bx as finishPasskeyLoginService, by as getDeviceAuthInfoService, bz as getEnabledOAuthProviders, bA as getGoogleAccessToken, bB as getMachinePrincipal, bC as getOAuthProvider, bD as getRegisteredProviders, bE as invitationAcceptedEvent, bF as invitationCreatedEvent, bG as isOAuthProviderEnabled, bH as issueOneTimeTokenService, bI as listKeysService, bJ as listOAuth2GrantsService, bK as listPasskeysService, bL as loginService, bM as logoutService, bN as machineAuth, bO as markPasskeySecondFactorService, bP as mfaEnrolledForUser, bQ as mfaStatusService, bR as mfaVerifications, bS as oauthCallbackService, bT as oauthNativeService, bU as oauthStartService, bV as oauthUnlinkNotifyService, bW as oauthUnlinkedEvent, bX as optionalAuth, bY as passkeys, bZ as pollDeviceAuthService, b_ as regenerateRecoveryCodesService, b$ as registerAuthProfile, c0 as registerMachineVerifier, c1 as registerOAuthProvider, c2 as registerPublicKeyService, c3 as registerService, c4 as renamePasskeyService, c5 as requestPasswordResetService, c6 as requestSignupLinkService, c7 as requireEnabledProvider, c8 as requireMachineScope, c9 as resolveAuthenticatedUser, ca as revokeAllKeysService, cb as revokeAllOAuth2GrantsForUser, cc as revokeKeyService, cd as revokeOAuth2GrantService, ce as revokePasskeyService, cf as rotateKeyService, cg as runAuthProfile, ch as selectAuthProfile, ci as sendVerificationCodeService, cj as startDeviceAuthService, ck as startPasskeyEnrollmentService, cl as startPasskeyLoginService, cm as startStepUpService, cn as startTotpEnrolmentService, co as stepUpService, cp as sweepUnconfirmedMfaService, cq as verifyCodeService, cr as verifyOneTimeTokenService, cs as verifySecondFactor } from './machine-principals-CaEFq61K.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { j as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
@@ -399,6 +399,27 @@ declare function getPasskeyConfig(env?: PasskeyEnvSource): PasskeyConfig;
  * @throws PasskeyConfigError when a passkey variable is set and cannot be honoured
  */
 declare function assertPasskeyConfig(env?: PasskeyEnvSource): void;
+/** What the second-factor routes read out of the environment. */
+interface MfaConfig {
+    /** Name the authenticator app files the account under. */
+    issuer: string;
+    /** How long a device's step-up stays good for a sensitive change. */
+    stepUpWindowMs: number;
+}
+/**
+ * Resolve the second-factor configuration.
+ *
+ * Deliberately reads no passkey setting beyond `SPFN_AUTH_PASSKEY_RP_NAME`,
+ * and reads that as a plain string rather than through `getPasskeyConfig()`:
+ * an app with no passkeys configured at all must be able to enrol a TOTP and
+ * to step up, and `getPasskeyConfig()` refuses to resolve for such an app.
+ *
+ * Nothing here can fail the way the passkey config can, so there is no boot
+ * check to match: a bad step-up window falls back to the default rather than
+ * refusing to start, because the value it would refuse over is a number of
+ * minutes and the default is the safe one.
+ */
+declare function getMfaConfig(): MfaConfig;
 
 /**
  * @spfn/auth - Users Entity
@@ -2002,6 +2023,14 @@ declare function verifyIdToken(params: VerifyIdTokenParams): Promise<JWTPayload>
  * Never include token or key material in logs or error messages.
  */
 
+/**
+ * Framing prefix of the current at-rest format: `enc:v2:<keyId>:<payload>`.
+ *
+ * Exported because the MFA secret cipher writes the same frame over the same
+ * keyring (`lib/mfa-cipher.ts`) — one format for everything this package
+ * encrypts at rest, rather than a second one nobody would remember to rotate.
+ */
+declare const V2_PREFIX = "enc:v2:";
 type OAuthTokenType = 'access' | 'refresh';
 interface OAuthTokenContext {
     provider: SocialProvider;
@@ -2017,6 +2046,21 @@ interface OAuthTokenCipher {
     encrypt(value: string, context: OAuthTokenContext): Promise<string>;
     decrypt(value: string, context: OAuthTokenContext): Promise<DecryptedOAuthToken>;
 }
+interface TokenEncryptionKey {
+    keyId: string;
+    key: Buffer;
+}
+/**
+ * Parse `<keyId>:<base64-encoded 32-byte key>` entries. The first entry is active.
+ *
+ * Empty when the variable is unset — whether that is a configuration error is
+ * the caller's to decide, and the two callers answer it differently: an OAuth
+ * token refuses outright, while an MFA secret raises `MfaConfigError` so the
+ * refusal cannot be mistaken for a wrong code.
+ *
+ * @throws Error when an entry is present but malformed
+ */
+declare function getEncryptionKeyring(): TokenEncryptionKey[];
 declare class EnvironmentKeyringTokenCipher implements OAuthTokenCipher {
     encrypt(value: string, context: OAuthTokenContext): Promise<string>;
     decrypt(value: string, context: OAuthTokenContext): Promise<DecryptedOAuthToken>;
@@ -4379,8 +4423,14 @@ type NewKeyRevokeAllToken = typeof keyRevokeAllTokens.$inferInsert;
  * presented to `login/verify` or the other way round — the two ceremonies
  * authorize very different things, and only the kind tells them apart once the
  * value itself is just 32 random bytes.
+ *
+ * `'mfa'` is the third: a step-up assertion, minted for an identified account
+ * and spent by `POST /_auth/mfa/step-up`. It buys the same separation in the
+ * direction that matters most — an assertion collected as a second factor is
+ * not a sign-in, and `passkeys/login/verify` refuses it for exactly the reason
+ * the column exists.
  */
-declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication"];
+declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication", "mfa"];
 type WebAuthnChallengeKind = typeof WEBAUTHN_CHALLENGE_KINDS[number];
 declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "webauthn_challenges";
@@ -4416,18 +4466,18 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication"] & [string, ...string[]]>>, {
+        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication", "mfa"] & [string, ...string[]]>>, {
             name: string;
             tableName: "webauthn_challenges";
             dataType: "string enum";
-            data: "registration" | "authentication";
+            data: "registration" | "authentication" | "mfa";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["registration", "authentication"] & [string, ...string[]];
+            enumValues: ["registration", "authentication", "mfa"] & [string, ...string[]];
             identity: undefined;
             generated: undefined;
         }>;
@@ -4497,6 +4547,287 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
 type WebAuthnChallenge = typeof webauthnChallenges.$inferSelect;
 type NewWebAuthnChallenge = typeof webauthnChallenges.$inferInsert;
 
+/**
+ * @spfn/auth - TOTP Enrolment Entity
+ *
+ * One row per account that has started enrolling an authenticator app. The row
+ * exists from the moment `totp/enroll` mints a secret; `confirmed_at` is what
+ * turns it into a second factor, so an abandoned enrolment never gates anything
+ * and is swept away a day later.
+ *
+ * `secret_enc` is the ciphertext `lib/mfa-cipher.ts` produces, bound to this
+ * `user_id` by the AEAD's additional data. A row copied to another account does
+ * not decrypt.
+ */
+/**
+ * How many wrong codes an unconfirmed enrolment survives.
+ *
+ * Small, because the row is throwaway: five wrong codes means the person is
+ * reading the wrong entry in their app, and starting over with a fresh secret
+ * is both the remedy and the thing that resets the counter. A confirmed row is
+ * never deleted this way — that would be a remote way to strip someone's second
+ * factor.
+ */
+declare const MFA_CONFIRM_ATTEMPT_LIMIT = 5;
+declare const mfaTotp: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_totp";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        secretEnc: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        confirmedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedStep: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.PgBigInt53Builder, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        failedConfirmAttempts: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
+            name: string;
+            tableName: "mfa_totp";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type MfaTotp = typeof mfaTotp.$inferSelect;
+type NewMfaTotp = typeof mfaTotp.$inferInsert;
+
+/**
+ * @spfn/auth - Recovery Codes Entity
+ *
+ * The ten single-use codes an enrolled account is shown once. Only the hash is
+ * stored, and it is a **password** hash rather than the unsalted SHA-256 the
+ * link flows use — a code a human transcribes is short enough that a leaked
+ * dump of unsalted hashes falls to an offline sweep. `lib/recovery-codes.ts`
+ * sets out the reasoning.
+ *
+ * Codes come in generations. Regenerating raises the generation rather than
+ * deleting the old rows, so a code someone wrote down last year is refused with
+ * the same body as one that never existed, and the history of which generation
+ * a code was spent from survives.
+ */
+declare const mfaRecoveryCodes: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_recovery_codes";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        generation: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>, {
+            name: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        codeHash: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        usedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type MfaRecoveryCode = typeof mfaRecoveryCodes.$inferSelect;
+type NewMfaRecoveryCode = typeof mfaRecoveryCodes.$inferInsert;
+
 /**
  * @spfn/auth - Device Authorizations Entity
  *
@@ -7261,6 +7592,31 @@ declare class PasskeysRepository extends BaseRepository {
      * @returns the updated row, or null if it is not theirs or already revoked
      */
     revokeByIdAndUserId(id: number, userId: number, reason: string): Promise<Passkey | null>;
+    /**
+     * Mark or unmark a live credential as the owner's second factor.
+     *
+     * Owner-scoped and live-only, so somebody else's passkey and an already
+     * revoked one are both "no such row" — the same answer every other
+     * management statement here gives.
+     *
+     * @returns the updated row, or null if it is not theirs or already revoked
+     */
+    markSecondFactorByIdAndUserId(id: number, userId: number, secondFactor: boolean): Promise<Passkey | null>;
+    /**
+     * The account's live credentials that satisfy a step-up.
+     *
+     * Used to check an assertion against the marked ones only: a passkey that
+     * signs the owner in is not a second factor until they say it is.
+     */
+    listLiveSecondFactorByUserId(userId: number): Promise<Passkey[]>;
+    /**
+     * Take the second-factor mark off every one of an account's credentials.
+     *
+     * What `mfa/disable` does to the passkey half of an enrolment. The
+     * credentials themselves are untouched — they still sign the owner in.
+     * Write primary.
+     */
+    clearSecondFactorByUserId(userId: number): Promise<void>;
     /**
      * Delete every passkey of an account (account destruction).
      * Write primary.
@@ -7313,6 +7669,158 @@ declare class WebAuthnChallengesRepository extends BaseRepository {
 }
 declare const webauthnChallengesRepository: WebAuthnChallengesRepository;
 
+/**
+ * MFA TOTP Repository
+ *
+ * Data access for the one enrolment row an account may have. Extends
+ * BaseRepository for transaction-context detection and read/write splitting.
+ *
+ * `secret_enc` is a ciphertext and is only ever moved through this layer as an
+ * opaque string — nothing here decrypts, and nothing here logs a row.
+ */
+
+declare class MfaTotpRepository extends BaseRepository {
+    /** The account's enrolment row, confirmed or not. */
+    findByUserId(userId: number): Promise<MfaTotp | null>;
+    /**
+     * Start an enrolment, replacing an unconfirmed one.
+     *
+     * Upsert rather than insert: calling `enroll` twice is the ordinary case —
+     * a user closes the app before scanning — and the second call must hand out
+     * a fresh secret rather than a 409. The failed-attempt counter resets with
+     * it, which is what makes "start over" the documented remedy for a row that
+     * spent its five tries.
+     *
+     * A **confirmed** row is refused by the service before this is reached, so
+     * this can never overwrite a working second factor.
+     */
+    startEnrolment(userId: number, secretEnc: string): Promise<MfaTotp>;
+    /**
+     * Mark the enrolment confirmed and record the step its first code spent.
+     * Write primary.
+     */
+    confirm(userId: number, step: number): Promise<void>;
+    /** Record the newest step this account has spent, so it cannot be replayed. */
+    recordUsedStep(userId: number, step: number): Promise<void>;
+    /**
+     * Count one wrong code against an unconfirmed row.
+     *
+     * @returns the count after this attempt
+     */
+    countFailedConfirm(userId: number): Promise<number>;
+    /** Rewrite the ciphertext in place, after a read on a retired key. */
+    updateSecret(userId: number, secretEnc: string): Promise<void>;
+    /** Drop the account's enrolment. Write primary. */
+    deleteByUserId(userId: number): Promise<void>;
+    /**
+     * Drop enrolments nobody ever confirmed. The sweep job's statement.
+     *
+     * @returns number of rows deleted
+     */
+    deleteUnconfirmedBefore(cutoff: Date): Promise<number>;
+}
+declare const mfaTotpRepository: MfaTotpRepository;
+
+/**
+ * MFA Recovery Codes Repository
+ *
+ * Data access for the ten single-use codes of an account's current generation.
+ * Extends BaseRepository for transaction-context detection and read/write
+ * splitting.
+ *
+ * Every read is scoped by `(user_id, generation)`. A code from an older
+ * generation, or from another account, is not "not found" by accident — it is
+ * outside every query this class can make.
+ */
+
+declare class MfaRecoveryCodesRepository extends BaseRepository {
+    /**
+     * The account's newest generation, or 0 when it has never had codes.
+     *
+     * 0 rather than null so the caller's `+ 1` is the same expression on both
+     * paths: a first enrolment writes generation 1.
+     */
+    currentGeneration(userId: number): Promise<number>;
+    /** Write one generation of codes. Write primary. */
+    createGeneration(userId: number, generation: number, hashes: string[]): Promise<void>;
+    /** The account's unspent codes of one generation. */
+    listUnused(userId: number, generation: number): Promise<MfaRecoveryCode[]>;
+    /** How many of a generation are left, for `status` and the "2 remaining" warning. */
+    countUnused(userId: number, generation: number): Promise<number>;
+    /**
+     * Spend one code, if this call is the one that spends it.
+     *
+     * One conditional UPDATE, like the WebAuthn challenge consume and for the
+     * same reason: two requests arriving with the same code must produce one
+     * winner, not two, and a read-then-write would let both read it as unused.
+     *
+     * @returns true when this call spent the row
+     */
+    consume(id: number): Promise<boolean>;
+    /** Drop every generation the account has. Write primary. */
+    deleteByUserId(userId: number): Promise<void>;
+}
+declare const mfaRecoveryCodesRepository: MfaRecoveryCodesRepository;
+
+/**
+ * MFA Verifications Repository
+ *
+ * Data access for "when did this device last prove the second factor". Extends
+ * BaseRepository for transaction-context detection and read/write splitting.
+ *
+ * One row per device key, replaced rather than appended to: only the newest
+ * verification decides anything, and a history of them would be a table that
+ * grows with every step-up for no reader.
+ */
+
+declare class MfaVerificationsRepository extends BaseRepository {
+    /** When this device last stepped up, if it ever did. */
+    findByKeyId(keyId: string): Promise<MfaVerification | null>;
+    /** Record a fresh verification for this device, replacing any earlier one. */
+    record(keyId: string, userId: number, method: MfaVerificationMethod): Promise<void>;
+    /**
+     * Carry a verification across a key rotation.
+     *
+     * Scoped by owner, so a caller naming somebody else's key moves nothing.
+     * Nothing to move is not an error: a device that never stepped up rotates
+     * exactly as it does today.
+     */
+    moveToKeyId(userId: number, fromKeyId: string, toKeyId: string): Promise<void>;
+    /** Forget every device's verification — what disabling the second factor means. */
+    deleteByUserId(userId: number): Promise<void>;
+}
+declare const mfaVerificationsRepository: MfaVerificationsRepository;
+
+/**
+ * MFA Enrolment Repository
+ *
+ * One question, asked on every sensitive route and at every device
+ * registration: does this account have a second factor at all?
+ *
+ * It spans two tables — a confirmed `mfa_totp` row, or at least one live passkey
+ * the owner marked as a second factor — so it lives here rather than in either
+ * table's repository, and it is deliberately **one** statement. `assertStepUp`
+ * asks it first and returns immediately when the answer is no, so an account
+ * that never enrolled pays one round trip against two indexed lookups
+ * (`mfa_totp_user_id_idx`, unique, and `passkeys_user_id_idx`) and nothing else:
+ * no second query, and no passkey configuration read.
+ *
+ * `UNION ALL ... LIMIT 1` rather than two `EXISTS` counts, so Postgres stops at
+ * the first row either side produces. Both halves select `user_id` — a column
+ * rather than a literal, so the two sides agree on a shape without a raw-SQL
+ * alias, and the value is thrown away either way.
+ */
+
+declare class MfaEnrolmentRepository extends BaseRepository {
+    /** Whether the account has a confirmed TOTP or a live second-factor passkey. */
+    isEnrolled(userId: number): Promise<boolean>;
+    /** The other half of the union, as its own read for `status` to reuse. */
+    private liveSecondFactorPasskeys;
+    /** Whether at least one live passkey is marked as a second factor. */
+    hasSecondFactorPasskey(userId: number): Promise<boolean>;
+}
+declare const mfaEnrolmentRepository: MfaEnrolmentRepository;
+
 /**
  * Device Authorizations Repository
  *
@@ -10439,8 +10947,8 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
 
 /**
  * Build the auth job router: the account-deletion purge sweep, the OAuth 2.1
- * stale-client sweep, the sign-out-everywhere link sweep, and the link-mail
- * sender.
+ * stale-client sweep, the sign-out-everywhere link sweep, the abandoned
+ * second-factor enrolment sweep, and the link-mail sender.
  *
  * The cron is a parameter because `job(...).cron(expression)` bakes the string in
  * at module-import time, which always happens before `createAuthLifecycle()` runs
@@ -10451,15 +10959,18 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
  * @param options.purgeCron - Deletion purge schedule; defaults to daily at 04:00
  * @param options.oauth2ClientPurgeCron - Stale OAuth client sweep; defaults to daily at 05:00
  * @param options.revokeAllTokenPurgeCron - Sign-out-everywhere link sweep; defaults to daily at 06:00
+ * @param options.mfaSweepCron - Abandoned second-factor enrolment sweep; defaults to daily at 07:00
  */
 declare function createAuthJobRouter(options?: {
     purgeCron?: string;
     oauth2ClientPurgeCron?: string;
     revokeAllTokenPurgeCron?: string;
+    mfaSweepCron?: string;
 }): _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
     oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
     revokeAllTokenPurge: _spfn_core_job.JobDef<void, void>;
+    mfaSweep: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -10480,6 +10991,7 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
     oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
     revokeAllTokenPurge: _spfn_core_job.JobDef<void, void>;
+    mfaSweep: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -10499,4 +11011,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };