@spfn/auth 0.3.0-beta.22 → 0.3.0-beta.24

package/dist/server.d.ts

@@ -1,8 +1,8 @@
-import { A as AuthInitOptions, u as OAuthProvider, s as VerificationPurpose, N as NewPasskey, v as Passkey, q as PermissionCategory, w as AuthContext } from './machine-principals-B7N8gux0.js';
-export { x as ApproveDeviceAuthParams, y as AuthDeletionCancelledPayload, z as AuthDeletionCompletedPayload, B as AuthDeletionRequestedPayload, E as AuthDeviceRegisteredPayload, G as AuthLoginPayload, H as AuthPasswordResetPayload, J as AuthProfileOutcome, M as AuthProfileVerifier, Q as AuthProviderSchema, T as AuthRegisterPayload, W as ChangePasswordParams, X as CompletePasswordResetParams, Y as CompleteSignupParams, Z as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, _ as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, $ as DenyDeviceAuthParams, a0 as DeviceAuthApprovedResult, a1 as DeviceAuthInfoParams, D as DeviceAuthInfoResult, a2 as DeviceAuthPendingResult, a3 as DeviceAuthPollResponseSchema, a4 as DeviceNameSchema, a5 as DeviceRegistrationChannel, a6 as EmailSchema, a7 as FingerprintSchema, a8 as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, a9 as FinishPasskeyLoginParams, aa as InvitationAcceptedPayload, ab as InvitationCreatedPayload, I as IssueOneTimeTokenResult, ac as KEY_FINGERPRINT_PREFIX_LENGTH, ad as KeyIdSchema, K as KeySummary, ae as LoginParams, L as LoginResult, af as LogoutParams, ag as MachinePrincipal, ah as MachineVerifierRegistration, ai as NativeVerifyOptions, aj as NormalizedIdentity, l as OAuth2AuthorizationCodeIssued, ak as OAuth2AuthorizeParams, k as OAuth2ConsentView, n as OAuth2GrantSummary, al as OAuth2ScopeDescription, am as OAuthCallbackParams, an as OAuthCallbackResult, ao as OAuthCodeExchangeOptions, ap as OAuthNativeParams, i as OAuthNativeResult, aq as OAuthStartParams, O as OAuthStartResult, ar as OAuthTokens, as as OAuthUnlinkedPayload, at as PASSKEY_DEVICE_TYPES, au as PASSKEY_LABEL_MAX_LENGTH, av as PasskeyDeviceType, f as PasskeySummary, aw as PasswordSchema, ax as PhoneSchema, ay as PlatformSchema, az as PollDeviceAuthParams, aA as PollDeviceAuthResult, aB as PublicKeySchema, aC as RecentAuthenticationParams, aD as RegisterParams, aE as RegisterPublicKeyParams, a as RegisterResult, aF as RenamePasskeyParams, aG as RequestPasswordResetParams, c as RequestPasswordResetResult, aH as RequestSignupLinkParams, b as RequestSignupLinkResult, aI as RevokeAllKeysParams, h as RevokeAllKeysResult, aJ as RevokeKeyParams, aK as RevokePasskeyParams, aL as RotateKeyParams, g as RotateKeyResult, aM as SendVerificationCodeParams, S as SendVerificationCodeResult, aN as StartDeviceAuthParams, e as StartDeviceAuthResult, aO as StartPasskeyEnrollmentParams, aP as TargetTypeSchema, aQ as UnlinkNotification, aR as UnlinkNotifyRejection, aS as UnlinkNotifyRequest, aT as UnlinkNotifyResult, aU as UserCodeSchema, V as VERIFICATION_PURPOSES, r as VERIFICATION_TARGET_TYPES, aV as VerificationPurposeSchema, t as VerificationTargetType, aW as VerifyCodeParams, aX as VerifyCodeResult, aY as approveDeviceAuthService, aZ as approveOAuth2AuthorizeService, a_ as assertNotLastRecoveryCredential, a$ as assertRecentAuthentication, b0 as authDeletionCancelledEvent, b1 as authDeletionCompletedEvent, b2 as authDeletionRequestedEvent, b3 as authDeviceRegisteredEvent, b4 as authLoginEvent, b5 as authPasswordResetEvent, b6 as authRegisterEvent, m as authRouter, b7 as authenticate, b8 as buildOAuthErrorUrl, b9 as changePasswordService, ba as completePasswordResetService, bb as completeSignupService, bc as confirmPasswordResetService, bd as confirmSignupLinkService, be as denyDeviceAuthService, bf as denyOAuth2AuthorizeService, bg as describeOAuth2AuthorizeRequestService, bh as finishPasskeyEnrollmentService, bi as finishPasskeyLoginService, bj as getDeviceAuthInfoService, bk as getEnabledOAuthProviders, bl as getGoogleAccessToken, bm as getMachinePrincipal, bn as getOAuthProvider, bo as getRegisteredProviders, bp as invitationAcceptedEvent, bq as invitationCreatedEvent, br as isOAuthProviderEnabled, bs as issueOneTimeTokenService, bt as listKeysService, bu as listOAuth2GrantsService, bv as listPasskeysService, bw as loginService, bx as logoutService, by as machineAuth, bz as oauthCallbackService, bA as oauthNativeService, bB as oauthStartService, bC as oauthUnlinkNotifyService, bD as oauthUnlinkedEvent, bE as optionalAuth, bF as passkeys, bG as pollDeviceAuthService, bH as registerAuthProfile, bI as registerMachineVerifier, bJ as registerOAuthProvider, bK as registerPublicKeyService, bL as registerService, bM as renamePasskeyService, bN as requestPasswordResetService, bO as requestSignupLinkService, bP as requireEnabledProvider, bQ as requireMachineScope, bR as resolveAuthenticatedUser, bS as revokeAllKeysService, bT as revokeAllOAuth2GrantsForUser, bU as revokeKeyService, bV as revokeOAuth2GrantService, bW as revokePasskeyService, bX as rotateKeyService, bY as runAuthProfile, bZ as selectAuthProfile, b_ as sendVerificationCodeService, b$ as startDeviceAuthService, c0 as startPasskeyEnrollmentService, c1 as startPasskeyLoginService, c2 as verifyCodeService, c3 as verifyOneTimeTokenService } from './machine-principals-B7N8gux0.js';
+import { A as AuthInitOptions, y as OAuthProvider, N as NewUserPublicKey, w as VerificationPurpose, z as NewPasskey, B as Passkey, E as MfaVerification, G as MfaVerificationMethod, u as PermissionCategory, H as UserPublicKey, J as AuthContext } from './machine-principals-ZJd9anVT.js';
+export { Q as ApproveDeviceAuthParams, W as AssertStepUpParams, X as AuthDeletionCancelledPayload, Y as AuthDeletionCompletedPayload, Z as AuthDeletionRequestedPayload, _ as AuthDeviceRegisteredPayload, $ as AuthLoginPayload, a0 as AuthPasswordResetPayload, a1 as AuthProfileOutcome, a2 as AuthProfileVerifier, a3 as AuthProviderSchema, a4 as AuthRegisterPayload, a5 as BearerOutcome, a6 as BearerRefusal, a7 as ChangePasswordParams, a8 as CompletePasswordResetParams, a9 as CompleteSignupParams, aa as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ab as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, ac as ConfirmTotpParams, h as ConfirmTotpResult, ad as DenyDeviceAuthParams, ae as DeviceAuthApprovedResult, af as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ag as DeviceAuthPendingResult, ah as DeviceAuthPollResponseSchema, ai as DeviceNameSchema, aj as DeviceRegistrationChannel, ak as DisableSessionBindingParams, al as EmailSchema, am as FingerprintSchema, an as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, ao as FinishPasskeyLoginParams, ap as FinishSessionRenewParams, aq as InvitationAcceptedPayload, ar as InvitationCreatedPayload, I as IssueOneTimeTokenResult, as as KEY_FINGERPRINT_PREFIX_LENGTH, at as KeyIdSchema, K as KeySummary, au as LoginParams, e as LoginResult, av as LogoutParams, aw as MFA_VERIFICATION_METHODS, ax as MachinePrincipal, ay as MachineVerifierRegistration, az as MarkPasskeyParams, M as MfaStatus, aA as NativeVerifyOptions, aB as NewMfaVerification, aC as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aD as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aE as OAuth2ScopeDescription, aF as OAuthCallbackParams, aG as OAuthCallbackResult, aH as OAuthCodeExchangeOptions, aI as OAuthNativeParams, n as OAuthNativeResult, aJ as OAuthStartParams, O as OAuthStartResult, aK as OAuthTokens, aL as OAuthUnlinkedPayload, aM as PASSKEY_DEVICE_TYPES, aN as PASSKEY_LABEL_MAX_LENGTH, aO as PasskeyDeviceType, g as PasskeySummary, aP as PasswordSchema, aQ as PhoneSchema, aR as PlatformSchema, aS as PollDeviceAuthParams, aT as PollDeviceAuthResult, aU as PublicKeySchema, aV as RecentAuthenticationParams, aW as RegisterParams, aX as RegisterPublicKeyParams, a as RegisterResult, aY as RenamePasskeyParams, aZ as RequestPasswordResetParams, c as RequestPasswordResetResult, a_ as RequestSignupLinkParams, b as RequestSignupLinkResult, a$ as RevokeAllKeysParams, j as RevokeAllKeysResult, b0 as RevokeKeyParams, b1 as RevokePasskeyParams, b2 as RotateKeyParams, i as RotateKeyResult, b3 as SendVerificationCodeParams, S as SendVerificationCodeResult, b4 as SessionBindingParams, k as SessionBindingResult, b5 as StartDeviceAuthParams, f as StartDeviceAuthResult, b6 as StartPasskeyEnrollmentParams, b7 as StartSessionRenewParams, b8 as StepUpParams, b9 as TargetTypeSchema, T as TotpEnrolmentResult, ba as UnlinkNotification, bb as UnlinkNotifyRejection, bc as UnlinkNotifyRequest, bd as UnlinkNotifyResult, be as UserCodeSchema, V as VERIFICATION_PURPOSES, v as VERIFICATION_TARGET_TYPES, bf as VerificationPurposeSchema, x as VerificationTargetType, bg as VerifyCodeParams, bh as VerifyCodeResult, bi as admitBearerKey, bj as approveDeviceAuthService, bk as approveOAuth2AuthorizeService, bl as assertNotLastRecoveryCredential, bm as assertRecentAuthentication, bn as assertStepUp, bo as authDeletionCancelledEvent, bp as authDeletionCompletedEvent, bq as authDeletionRequestedEvent, br as authDeviceRegisteredEvent, bs as authLoginEvent, bt as authPasswordResetEvent, bu as authRegisterEvent, m as authRouter, bv as authenticate, bw as bearerAuthContext, bx as buildOAuthErrorUrl, by as carryStepUpVerification, bz as changePasswordService, bA as completePasswordResetService, bB as completeSignupService, bC as confirmPasswordResetService, bD as confirmSignupLinkService, bE as confirmTotpEnrolmentService, bF as denyDeviceAuthService, bG as denyOAuth2AuthorizeService, bH as describeOAuth2AuthorizeRequestService, bI as disableMfaService, bJ as disableSessionBindingService, bK as enableSessionBindingService, bL as finishPasskeyEnrollmentService, bM as finishPasskeyLoginService, bN as finishSessionRenewService, bO as getDeviceAuthInfoService, bP as getEnabledOAuthProviders, bQ as getGoogleAccessToken, bR as getMachinePrincipal, bS as getOAuthProvider, bT as getRegisteredProviders, bU as getSessionBindingService, bV as invitationAcceptedEvent, bW as invitationCreatedEvent, bX as isOAuthProviderEnabled, bY as issueOneTimeTokenService, bZ as keySessionBindingService, b_ as listKeysService, b$ as listOAuth2GrantsService, c0 as listPasskeysService, c1 as loginService, c2 as logoutService, c3 as machineAuth, c4 as markPasskeySecondFactorService, c5 as mfaEnrolledForUser, c6 as mfaStatusService, c7 as mfaVerifications, c8 as oauthCallbackService, c9 as oauthNativeService, ca as oauthStartService, cb as oauthUnlinkNotifyService, cc as oauthUnlinkedEvent, cd as optionalAuth, ce as passkeys, cf as pollDeviceAuthService, cg as regenerateRecoveryCodesService, ch as registerAuthProfile, ci as registerMachineVerifier, cj as registerOAuthProvider, ck as registerPublicKeyService, cl as registerService, cm as renamePasskeyService, cn as requestPasswordResetService, co as requestSignupLinkService, cp as requireEnabledProvider, cq as requireMachineScope, cr as resolveAuthenticatedUser, cs as revokeAllKeysService, ct as revokeAllOAuth2GrantsForUser, cu as revokeKeyService, cv as revokeOAuth2GrantService, cw as revokePasskeyService, cx as rotateKeyService, cy as runAuthProfile, cz as selectAuthProfile, cA as sendVerificationCodeService, cB as startDeviceAuthService, cC as startPasskeyEnrollmentService, cD as startPasskeyLoginService, cE as startSessionBindingDisableService, cF as startSessionRenewService, cG as startStepUpService, cH as startTotpEnrolmentService, cI as stepUpService, cJ as sweepUnconfirmedMfaService, cK as userPublicKeys, cL as verifyCodeService, cM as verifyOneTimeTokenService, cN as verifySecondFactor } from './machine-principals-ZJd9anVT.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
-import { j as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
-export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
+import { l as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-CTdoTOxM.js';
+export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, j as SESSION_BINDINGS, k as SOCIAL_PROVIDERS, S as SessionBindingType, U as USER_STATUSES, m as UserStatus } from './types-CTdoTOxM.js';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';
 import { c as ClientIdentity } from './wire-version-CtzMKvBB.js';
@@ -10,7 +10,7 @@ import { Context } from 'hono';
 import * as _spfn_core_route from '@spfn/core/route';
 import { NamedMiddleware } from '@spfn/core/route';
 export { KeyPair, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, getKeySize, shouldRotateKey } from './crypto.js';
-export { S as SessionData, g as getSessionInfo, i as isSafeReturnPath, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-Dfwu5g2W.js';
+export { S as SessionData, g as getSessionInfo, i as isSafeReturnPath, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-BbhAGZtA.js';
 import { JWTPayload } from 'jose';
 import { SSETokenManager, SSETokenStore } from '@spfn/core/event/sse';
 import * as _spfn_core_logger from '@spfn/core/logger';
@@ -21,95 +21,6 @@ import '@spfn/core/event';
 import '@spfn/auth/server';
 import 'jsonwebtoken';
 
-/**
- * @spfn/auth - Signed Sign-Out-Everywhere Link
- *
- * A link an app mails to an account's proven address, which signs every device
- * of that account out without a session. It exists for the case the rest of the
- * key surface cannot serve: the owner suspects a device they do not recognise,
- * and the device they would have to sign in on to do something about it is the
- * one they no longer trust.
- *
- * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
- * mints the capability and hands the app a URL. `describeRevokeAllLink` says
- * whether that URL still works and changes nothing, so a mail scanner opening
- * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
- * and it takes the owner pressing the button.
- *
- * The caller's obligation, which this package cannot enforce: the URL
- * `createRevokeAllLink` returns carries the plaintext token, because the package
- * sends no mail here. Do not log it, do not persist it, do not put it in a job
- * payload — hand it to the mail template and let it go. Every other link in this
- * package is minted inside the worker that sends it precisely so that no caller
- * ever holds one; this one cannot be, and the obligation moves to the app.
- */
-interface CreateRevokeAllLinkOptions {
-    /**
-     * Minutes the link stays valid. Defaults to
-     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
-     */
-    ttlMinutes?: number;
-}
-interface RevokeAllLink {
-    /** Absolute URL of the app page, token in its query string. Never log it. */
-    url: string;
-    expiresAt: Date;
-}
-/** What the describe call tells the page, so it can say what pressing the button does. */
-interface RevokeAllLinkDescription {
-    expiresAt: Date;
-    activeKeyCount: number;
-}
-/**
- * Mint a sign-out-everywhere link for an account.
- *
- * Issuing supersedes every live link the account already has, the rule the
- * password-reset flow follows: an owner who asks twice must not leave the first
- * capability working in their mailbox after using the second.
- *
- * The row records the account's key generation, so the link dies the moment any
- * other path signs every device out — a password reset, a password change, a
- * deletion request, or the ordinary revoke-all route.
- *
- * Send it beside a password reset link. It ends the sessions; it does not change
- * the password that let them start.
- *
- * @param userId - The account to issue for
- * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
- * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
- */
-declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
-/**
- * Say whether a presented link still works, and what pressing the button would
- * do. Changes nothing — a mail scanner that opens the page has done nothing.
- *
- * @throws RevokeAllLinkError every refusal, in one shape
- */
-declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
-/**
- * Spend a link and sign every device of the account out.
- *
- * The claim is one statement, so of two requests carrying the same token exactly
- * one revokes and the other is refused as if the token were unknown — which by
- * then it is. `includeCurrent` is true because there is no current device here:
- * the caller holds a mailbox, not a session, and sparing something would mean
- * sparing whatever the owner is trying to cut off.
- *
- * @returns how many device keys were revoked; zero is a success, not a refusal
- * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
- */
-declare function consumeRevokeAllLink(token: string): Promise<{
-    revokedCount: number;
-}>;
-/**
- * Delete link rows that can no longer answer anything.
- *
- * @returns number of rows deleted
- */
-declare function purgeRevokeAllTokensService(): Promise<{
-    deleted: number;
-}>;
-
 /**
  * @spfn/auth - Global Configuration
  *
@@ -341,6 +252,27 @@ declare function getCsrfMode(): CsrfMode;
  * Get the paths exempted from the CSRF check (exact match, backend route paths)
  */
 declare function getCsrfExemptPaths(): string[];
+/**
+ * How long a key bound to a passkey lives, in milliseconds.
+ *
+ * A positive override is honoured; anything else falls back to the policy
+ * constant. Nothing refuses boot over it — unlike the passkey relying party, a
+ * nonsensical value here does not make every ceremony fail, it just means the
+ * default applies.
+ */
+declare function getBoundKeyTtlMs(): number;
+/** How long past expiry a bound key may still be renewed, in milliseconds. */
+declare function getBoundKeyRenewGraceMs(): number;
+/** How close two sightings from two addresses must be to count as concurrent. */
+declare function getConcurrentUseWindowMs(): number;
+/**
+ * The page a bound session whose key expired is sent to.
+ *
+ * `RequireAuth` redirects here instead of to the sign-in page; the app renders a
+ * client component there that calls `renewSession(api)` and returns the person to
+ * where they were.
+ */
+declare function getSessionRenewPath(): string;
 /**
  * The relying party this deployment presents to authenticators, resolved.
  *
@@ -399,6 +331,116 @@ declare function getPasskeyConfig(env?: PasskeyEnvSource): PasskeyConfig;
  * @throws PasskeyConfigError when a passkey variable is set and cannot be honoured
  */
 declare function assertPasskeyConfig(env?: PasskeyEnvSource): void;
+/** What the second-factor routes read out of the environment. */
+interface MfaConfig {
+    /** Name the authenticator app files the account under. */
+    issuer: string;
+    /** How long a device's step-up stays good for a sensitive change. */
+    stepUpWindowMs: number;
+}
+/**
+ * Resolve the second-factor configuration.
+ *
+ * Deliberately reads no passkey setting beyond `SPFN_AUTH_PASSKEY_RP_NAME`,
+ * and reads that as a plain string rather than through `getPasskeyConfig()`:
+ * an app with no passkeys configured at all must be able to enrol a TOTP and
+ * to step up, and `getPasskeyConfig()` refuses to resolve for such an app.
+ *
+ * Nothing here can fail the way the passkey config can, so there is no boot
+ * check to match: a bad step-up window falls back to the default rather than
+ * refusing to start, because the value it would refuse over is a number of
+ * minutes and the default is the safe one.
+ */
+declare function getMfaConfig(): MfaConfig;
+
+/**
+ * @spfn/auth - Signed Sign-Out-Everywhere Link
+ *
+ * A link an app mails to an account's proven address, which signs every device
+ * of that account out without a session. It exists for the case the rest of the
+ * key surface cannot serve: the owner suspects a device they do not recognise,
+ * and the device they would have to sign in on to do something about it is the
+ * one they no longer trust.
+ *
+ * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
+ * mints the capability and hands the app a URL. `describeRevokeAllLink` says
+ * whether that URL still works and changes nothing, so a mail scanner opening
+ * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
+ * and it takes the owner pressing the button.
+ *
+ * The caller's obligation, which this package cannot enforce: the URL
+ * `createRevokeAllLink` returns carries the plaintext token, because the package
+ * sends no mail here. Do not log it, do not persist it, do not put it in a job
+ * payload — hand it to the mail template and let it go. Every other link in this
+ * package is minted inside the worker that sends it precisely so that no caller
+ * ever holds one; this one cannot be, and the obligation moves to the app.
+ */
+interface CreateRevokeAllLinkOptions {
+    /**
+     * Minutes the link stays valid. Defaults to
+     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
+     */
+    ttlMinutes?: number;
+}
+interface RevokeAllLink {
+    /** Absolute URL of the app page, token in its query string. Never log it. */
+    url: string;
+    expiresAt: Date;
+}
+/** What the describe call tells the page, so it can say what pressing the button does. */
+interface RevokeAllLinkDescription {
+    expiresAt: Date;
+    activeKeyCount: number;
+}
+/**
+ * Mint a sign-out-everywhere link for an account.
+ *
+ * Issuing supersedes every live link the account already has, the rule the
+ * password-reset flow follows: an owner who asks twice must not leave the first
+ * capability working in their mailbox after using the second.
+ *
+ * The row records the account's key generation, so the link dies the moment any
+ * other path signs every device out — a password reset, a password change, a
+ * deletion request, or the ordinary revoke-all route.
+ *
+ * Send it beside a password reset link. It ends the sessions; it does not change
+ * the password that let them start.
+ *
+ * @param userId - The account to issue for
+ * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
+ * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
+ */
+declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
+/**
+ * Say whether a presented link still works, and what pressing the button would
+ * do. Changes nothing — a mail scanner that opens the page has done nothing.
+ *
+ * @throws RevokeAllLinkError every refusal, in one shape
+ */
+declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
+/**
+ * Spend a link and sign every device of the account out.
+ *
+ * The claim is one statement, so of two requests carrying the same token exactly
+ * one revokes and the other is refused as if the token were unknown — which by
+ * then it is. `includeCurrent` is true because there is no current device here:
+ * the caller holds a mailbox, not a session, and sparing something would mean
+ * sparing whatever the owner is trying to cut off.
+ *
+ * @returns how many device keys were revoked; zero is a success, not a refusal
+ * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
+ */
+declare function consumeRevokeAllLink(token: string): Promise<{
+    revokedCount: number;
+}>;
+/**
+ * Delete link rows that can no longer answer anything.
+ *
+ * @returns number of rows deleted
+ */
+declare function purgeRevokeAllTokensService(): Promise<{
+    deleted: number;
+}>;
 
 /**
  * @spfn/auth - Users Entity
@@ -657,6 +699,36 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        sessionBinding: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["none", "passkey"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "users";
+            dataType: "string enum";
+            data: "none" | "passkey";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sessionBindingChangedAt: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "users";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         lastLoginAt: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
             tableName: "users";
@@ -704,6 +776,8 @@ declare function getUserByIdService(userId: number): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -726,6 +800,8 @@ declare function getUserByEmailService(email: string): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -748,6 +824,8 @@ declare function getUserByPhoneService(phone: string): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -789,6 +867,8 @@ declare function updateUsernameService(userId: string | number | bigint, usernam
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 
@@ -2002,6 +2082,14 @@ declare function verifyIdToken(params: VerifyIdTokenParams): Promise<JWTPayload>
  * Never include token or key material in logs or error messages.
  */
 
+/**
+ * Framing prefix of the current at-rest format: `enc:v2:<keyId>:<payload>`.
+ *
+ * Exported because the MFA secret cipher writes the same frame over the same
+ * keyring (`lib/mfa-cipher.ts`) — one format for everything this package
+ * encrypts at rest, rather than a second one nobody would remember to rotate.
+ */
+declare const V2_PREFIX = "enc:v2:";
 type OAuthTokenType = 'access' | 'refresh';
 interface OAuthTokenContext {
     provider: SocialProvider;
@@ -2017,6 +2105,21 @@ interface OAuthTokenCipher {
     encrypt(value: string, context: OAuthTokenContext): Promise<string>;
     decrypt(value: string, context: OAuthTokenContext): Promise<DecryptedOAuthToken>;
 }
+interface TokenEncryptionKey {
+    keyId: string;
+    key: Buffer;
+}
+/**
+ * Parse `<keyId>:<base64-encoded 32-byte key>` entries. The first entry is active.
+ *
+ * Empty when the variable is unset — whether that is a configuration error is
+ * the caller's to decide, and the two callers answer it differently: an OAuth
+ * token refuses outright, while an MFA secret raises `MfaConfigError` so the
+ * refusal cannot be mistaken for a wrong code.
+ *
+ * @throws Error when an entry is present but malformed
+ */
+declare function getEncryptionKeyring(): TokenEncryptionKey[];
 declare class EnvironmentKeyringTokenCipher implements OAuthTokenCipher {
     encrypt(value: string, context: OAuthTokenContext): Promise<string>;
     decrypt(value: string, context: OAuthTokenContext): Promise<DecryptedOAuthToken>;
@@ -3115,25 +3218,20 @@ type UserProfile = typeof userProfiles.$inferSelect;
 type NewUserProfile = typeof userProfiles.$inferInsert;
 
 /**
- * @spfn/auth - User Public Keys Entity
+ * @spfn/auth - User Social Accounts Entity
  *
- * Stores client-generated public keys for JWT verification
- * Supports key rotation and multi-key management per user
- */
-/**
- * User Public Keys Table
- * Each user can have multiple public keys (for rotation)
+ * Stores OAuth connections for social login providers
  */
-declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_public_keys";
+declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_social_accounts";
     schema: string;
     columns: {
-        id: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "number int53";
-            data: number;
-            driverParam: number;
+            tableName: "user_social_accounts";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
@@ -3143,14 +3241,14 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
+            tableName: "user_social_accounts";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3158,27 +3256,27 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        keyId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
+            tableName: "user_social_accounts";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        publicKey: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        userId: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
+            tableName: "user_social_accounts";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -3188,24 +3286,24 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        algorithm: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
+        provider: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["google", "apple", "github", "kakao", "naver", "superself"] & [string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_social_accounts";
             dataType: "string enum";
-            data: "ES256" | "RS256";
+            data: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
             driverParam: string;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["ES256", "RS256"] & [string, ...string[]];
+            enumValues: ["google", "apple", "github", "kakao", "naver", "superself"] & [string, ...string[]];
             identity: undefined;
             generated: undefined;
         }>;
-        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        providerUserId: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_social_accounts";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3218,9 +3316,9 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        deviceName: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        providerEmail: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_social_accounts";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3233,24 +3331,24 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        platform: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
+        accessToken: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ios" | "android" | "web" | "desktop";
+            tableName: "user_social_accounts";
+            dataType: "string";
+            data: string;
             driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        registeredIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        refreshToken: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_social_accounts";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3263,11 +3361,11 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        registeredUserAgent: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        tokenExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
+            tableName: "user_social_accounts";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -3278,29 +3376,45 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        clientKind: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["web", "ios", "android"] & [string, ...string[]]>, {
+    };
+    dialect: "pg";
+}>;
+type UserSocialAccount = typeof userSocialAccounts.$inferSelect;
+type NewUserSocialAccount = typeof userSocialAccounts.$inferInsert;
+
+/**
+ * @spfn/auth - Verification Codes Entity
+ *
+ * Stores verification codes for email and phone verification
+ * Codes expire after a configurable time period
+ */
+declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "verification_codes";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ios" | "android" | "web";
+            tableName: "verification_codes";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["web", "ios", "android"] & [string, ...string[]];
+            enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        clientVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
+            tableName: "verification_codes";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3308,14 +3422,14 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        clientContractVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            tableName: "verification_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3323,13 +3437,13 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        clientSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        target: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
+            tableName: "verification_codes";
+            dataType: "string";
+            data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3338,29 +3452,29 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        isActive: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+        targetType: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["email", "phone"] & [string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
+            tableName: "verification_codes";
+            dataType: "string enum";
+            data: "email" | "phone";
+            driverParam: string;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: ["email", "phone"] & [string, ...string[]];
             identity: undefined;
             generated: undefined;
         }>;
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        code: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
+            tableName: "verification_codes";
+            dataType: "string";
+            data: string;
             driverParam: string;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3368,28 +3482,28 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        purpose: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"] & [string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
+            tableName: "verification_codes";
+            dataType: "string enum";
+            data: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"] & [string, ...string[]];
             identity: undefined;
             generated: undefined;
         }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "verification_codes";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3398,9 +3512,9 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        usedAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "verification_codes";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3413,14 +3527,14 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        attempts: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            tableName: "verification_codes";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3431,21 +3545,29 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type UserPublicKey = typeof userPublicKeys.$inferSelect;
-type NewUserPublicKey = typeof userPublicKeys.$inferInsert;
+type VerificationCode = typeof verificationCodes.$inferSelect;
+type NewVerificationCode = typeof verificationCodes.$inferInsert;
 
 /**
- * @spfn/auth - User Social Accounts Entity
+ * @spfn/auth - Signup Link Tokens Entity
  *
- * Stores OAuth connections for social login providers
+ * Backs the verified-email signup flow: a one-time confirmation link is emailed,
+ * opening it mints a short-lived setup session, and setting a password on that
+ * session creates the account.
+ *
+ * A separate table from `verification_codes` on purpose. That table stores its
+ * six-digit code in plaintext, which is acceptable for a short-lived numeric code
+ * bounded by an attempt counter, but a link token is a bearer credential sitting
+ * in someone's mailbox and must only ever be stored as a hash. Sharing one table
+ * would make "plaintext or hash" a per-row property that nothing enforces.
  */
-declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_social_accounts";
+declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "signup_link_tokens";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "user_social_accounts";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3458,9 +3580,9 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "user_social_accounts";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3473,9 +3595,9 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "user_social_accounts";
+            tableName: "signup_link_tokens";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -3488,39 +3610,9 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
-            name: string;
-            tableName: "user_social_accounts";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        provider: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["google", "apple", "github", "kakao", "naver", "superself"] & [string, ...string[]]>>, {
-            name: string;
-            tableName: "user_social_accounts";
-            dataType: "string enum";
-            data: "google" | "apple" | "github" | "kakao" | "naver" | "superself";
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["google", "apple", "github", "kakao", "naver", "superself"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        providerUserId: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        email: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "user_social_accounts";
+            tableName: "signup_link_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3533,24 +3625,9 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        providerEmail: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_social_accounts";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        accessToken: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_social_accounts";
+            tableName: "signup_link_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3563,9 +3640,9 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        refreshToken: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        returnPath: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_social_accounts";
+            tableName: "signup_link_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3578,13 +3655,13 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        tokenExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_social_accounts", drizzle_orm_pg_core.PgTimestampBuilder, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "user_social_accounts";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3593,30 +3670,14 @@ declare const userSocialAccounts: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-    };
-    dialect: "pg";
-}>;
-type UserSocialAccount = typeof userSocialAccounts.$inferSelect;
-type NewUserSocialAccount = typeof userSocialAccounts.$inferInsert;
-
-/**
- * @spfn/auth - Verification Codes Entity
- *
- * Stores verification codes for email and phone verification
- * Codes expire after a configurable time period
- */
-declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "verification_codes";
-    schema: string;
-    columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "verification_codes";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3624,43 +3685,13 @@ declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "verification_codes";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
-            name: string;
-            tableName: "verification_codes";
-            dataType: "number int53";
-            data: number;
-            driverParam: number;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        target: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "verification_codes";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3669,28 +3700,13 @@ declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        targetType: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["email", "phone"] & [string, ...string[]]>>, {
-            name: string;
-            tableName: "verification_codes";
-            dataType: "string enum";
-            data: "email" | "phone";
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["email", "phone"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        code: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        setupSecretHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "verification_codes";
+            tableName: "signup_link_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3699,28 +3715,13 @@ declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        purpose: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"] & [string, ...string[]]>>, {
-            name: string;
-            tableName: "verification_codes";
-            dataType: "string enum";
-            data: "registration" | "login" | "password_reset" | "email_change" | "phone_change" | "account_deletion";
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+        setupExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "verification_codes";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3729,9 +3730,9 @@ declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        usedAt: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.PgTimestampBuilder, {
+        completedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "verification_codes";
+            tableName: "signup_link_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3744,47 +3745,53 @@ declare const verificationCodes: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        attempts: drizzle_orm_pg_core.PgBuildColumn<"verification_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
-            name: string;
-            tableName: "verification_codes";
-            dataType: "number int32";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
     };
     dialect: "pg";
 }>;
-type VerificationCode = typeof verificationCodes.$inferSelect;
-type NewVerificationCode = typeof verificationCodes.$inferInsert;
+type SignupLinkToken = typeof signupLinkTokens.$inferSelect;
+type NewSignupLinkToken = typeof signupLinkTokens.$inferInsert;
 
 /**
- * @spfn/auth - Signup Link Tokens Entity
+ * @spfn/auth - Password Reset Tokens Entity
  *
- * Backs the verified-email signup flow: a one-time confirmation link is emailed,
- * opening it mints a short-lived setup session, and setting a password on that
- * session creates the account.
+ * Backs the password reset flow: a one-time link is emailed to an address the
+ * account has already proved, opening it mints a short-lived setup session, and
+ * setting a password on that session replaces the old one and signs the browser
+ * in.
  *
- * A separate table from `verification_codes` on purpose. That table stores its
- * six-digit code in plaintext, which is acceptable for a short-lived numeric code
- * bounded by an attempt counter, but a link token is a bearer credential sitting
- * in someone's mailbox and must only ever be stored as a hash. Sharing one table
- * would make "plaintext or hash" a per-row property that nothing enforces.
+ * A separate table from `signup_link_tokens` even though the two carry the same
+ * columns. They are the same shape, not the same thing: one names an address
+ * that has no account and the other names a user that does, and the setup
+ * secrets they mint must not be interchangeable. Sharing one table would make
+ * "which flow is this row" a per-row property that the lookup would have to
+ * remember to filter on — and a lookup that forgets would accept a signup secret
+ * as a reset secret.
+ *
+ * The link token and the setup secret are bearer credentials, so only their
+ * SHA-256 hashes are stored.
  */
-declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "signup_link_tokens";
+declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "password_reset_tokens";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "password_reset_tokens";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3797,12 +3804,12 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "signup_link_tokens";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
+            tableName: "password_reset_tokens";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
@@ -3812,14 +3819,14 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        userId: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "number int53";
             data: number;
-            driverParam: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3827,9 +3834,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        email: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        email: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3842,9 +3849,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3857,9 +3864,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        returnPath: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        returnPath: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3872,9 +3879,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3887,9 +3894,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3902,9 +3909,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3917,9 +3924,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        setupSecretHash: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        setupSecretHash: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3932,9 +3939,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        setupExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        setupExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3947,9 +3954,9 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        completedAt: drizzle_orm_pg_core.PgBuildColumn<"signup_link_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        completedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "signup_link_tokens";
+            tableName: "password_reset_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -3965,35 +3972,34 @@ declare const signupLinkTokens: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type SignupLinkToken = typeof signupLinkTokens.$inferSelect;
-type NewSignupLinkToken = typeof signupLinkTokens.$inferInsert;
+type PasswordResetToken = typeof passwordResetTokens.$inferSelect;
+type NewPasswordResetToken = typeof passwordResetTokens.$inferInsert;
 
 /**
- * @spfn/auth - Password Reset Tokens Entity
+ * @spfn/auth - Revoke-All Link Tokens Entity
  *
- * Backs the password reset flow: a one-time link is emailed to an address the
- * account has already proved, opening it mints a short-lived setup session, and
- * setting a password on that session replaces the old one and signs the browser
- * in.
+ * Backs the signed sign-out-everywhere link: a one-time token an app mails to
+ * an account's proven address, which revokes every device key of that account
+ * without a session. It is the action an owner can take from a mailbox when the
+ * device they would otherwise have to sign in on is the one they no longer
+ * trust.
  *
- * A separate table from `signup_link_tokens` even though the two carry the same
- * columns. They are the same shape, not the same thing: one names an address
- * that has no account and the other names a user that does, and the setup
- * secrets they mint must not be interchangeable. Sharing one table would make
- * "which flow is this row" a per-row property that the lookup would have to
- * remember to filter on — and a lookup that forgets would accept a signup secret
- * as a reset secret.
+ * `key_epoch` is what makes the link dead rather than merely spent. It records
+ * the account's key generation at issue time, and the consume statement joins it
+ * against `users.key_epoch` — so a password reset, a password change, a deletion
+ * request or an earlier revoke-all, every one of which moves the counter, leaves
+ * the outstanding link answering the same 404 an unknown token gets.
  *
- * The link token and the setup secret are bearer credentials, so only their
- * SHA-256 hashes are stored.
+ * The token is a bearer credential, so only its SHA-256 hash is stored, the same
+ * way the signup and reset links store theirs.
  */
-declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "password_reset_tokens";
+declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "key_revoke_all_tokens";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "key_revoke_all_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4006,9 +4012,9 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "key_revoke_all_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4021,9 +4027,9 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "key_revoke_all_tokens";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -4036,9 +4042,9 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        userId: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "key_revoke_all_tokens";
             dataType: "number int53";
             data: number;
             driverParam: string | number;
@@ -4051,9 +4057,9 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        email: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "key_revoke_all_tokens";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -4066,13 +4072,13 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        keyEpoch: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>, {
             name: string;
-            tableName: "password_reset_tokens";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
+            tableName: "key_revoke_all_tokens";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4081,13 +4087,13 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        returnPath: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "password_reset_tokens";
-            dataType: "string";
-            data: string;
+            tableName: "key_revoke_all_tokens";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4096,13 +4102,13 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "key_revoke_all_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4111,9 +4117,9 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "key_revoke_all_tokens";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4126,14 +4132,64 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+    };
+    dialect: "pg";
+}>;
+type KeyRevokeAllToken = typeof keyRevokeAllTokens.$inferSelect;
+type NewKeyRevokeAllToken = typeof keyRevokeAllTokens.$inferInsert;
+
+/**
+ * @spfn/auth - WebAuthn Challenges Entity
+ *
+ * The random value an authenticator signs, parked between the `options` call
+ * that minted it and the `verify` call that spends it.
+ *
+ * In the database rather than in a cookie or in memory, for two reasons: the
+ * check that makes a challenge one-time has to be a conditional UPDATE that two
+ * concurrent verifies cannot both win, and several API instances serve the same
+ * browser — an in-process map would let a replay land on the instance that never
+ * saw the first attempt.
+ *
+ * Only the SHA-256 of the challenge is stored, following the rule the package
+ * already applies to signup link tokens. A challenge is a nonce rather than a
+ * bearer credential, so this buys less than it does there; it costs nothing, and
+ * it keeps "plaintext or hash" from becoming a per-table judgement call.
+ */
+/**
+ * Which ceremony the challenge was minted for.
+ *
+ * Recorded and matched at consume time so a registration challenge cannot be
+ * presented to `login/verify` or the other way round — the two ceremonies
+ * authorize very different things, and only the kind tells them apart once the
+ * value itself is just 32 random bytes.
+ *
+ * `'mfa'` is the third: a step-up assertion, minted for an identified account
+ * and spent by `POST /_auth/mfa/step-up`. It buys the same separation in the
+ * direction that matters most — an assertion collected as a second factor is
+ * not a sign-in, and `passkeys/login/verify` refuses it for exactly the reason
+ * the column exists.
+ *
+ * `'renewal'` is the fourth: the assertion that renews a bound session key, and
+ * the one that lets an account leave `session_binding: 'passkey'`. It is its own
+ * kind rather than a reused `'authentication'` because that kind's challenge is
+ * minted for nobody in particular — a discoverable sign-in names no account —
+ * while a renewal challenge is bound to the account it was issued for, and
+ * spending one where the other was expected would cross those two rules.
+ */
+declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication", "mfa", "renewal"];
+type WebAuthnChallengeKind = typeof WEBAUTHN_CHALLENGE_KINDS[number];
+declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "webauthn_challenges";
+    schema: string;
+    columns: {
+        id: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "password_reset_tokens";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            tableName: "webauthn_challenges";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -4141,12 +4197,42 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        setupSecretHash: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        challengeHash: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "webauthn_challenges";
             dataType: "string";
             data: string;
             driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication", "mfa", "renewal"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "string enum";
+            data: "registration" | "authentication" | "mfa" | "renewal";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["registration", "authentication", "mfa", "renewal"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.PgBigInt53Builder, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
@@ -4156,13 +4242,13 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        setupExpiresAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "webauthn_challenges";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4171,9 +4257,9 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        completedAt: drizzle_orm_pg_core.PgBuildColumn<"password_reset_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "password_reset_tokens";
+            tableName: "webauthn_challenges";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4186,37 +4272,56 @@ declare const passwordResetTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "webauthn_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
     };
     dialect: "pg";
 }>;
-type PasswordResetToken = typeof passwordResetTokens.$inferSelect;
-type NewPasswordResetToken = typeof passwordResetTokens.$inferInsert;
+type WebAuthnChallenge = typeof webauthnChallenges.$inferSelect;
+type NewWebAuthnChallenge = typeof webauthnChallenges.$inferInsert;
 
 /**
- * @spfn/auth - Revoke-All Link Tokens Entity
+ * @spfn/auth - TOTP Enrolment Entity
  *
- * Backs the signed sign-out-everywhere link: a one-time token an app mails to
- * an account's proven address, which revokes every device key of that account
- * without a session. It is the action an owner can take from a mailbox when the
- * device they would otherwise have to sign in on is the one they no longer
- * trust.
+ * One row per account that has started enrolling an authenticator app. The row
+ * exists from the moment `totp/enroll` mints a secret; `confirmed_at` is what
+ * turns it into a second factor, so an abandoned enrolment never gates anything
+ * and is swept away a day later.
  *
- * `key_epoch` is what makes the link dead rather than merely spent. It records
- * the account's key generation at issue time, and the consume statement joins it
- * against `users.key_epoch` — so a password reset, a password change, a deletion
- * request or an earlier revoke-all, every one of which moves the counter, leaves
- * the outstanding link answering the same 404 an unknown token gets.
+ * `secret_enc` is the ciphertext `lib/mfa-cipher.ts` produces, bound to this
+ * `user_id` by the AEAD's additional data. A row copied to another account does
+ * not decrypt.
+ */
+/**
+ * How many wrong codes an unconfirmed enrolment survives.
  *
- * The token is a bearer credential, so only its SHA-256 hash is stored, the same
- * way the signup and reset links store theirs.
+ * Small, because the row is throwaway: five wrong codes means the person is
+ * reading the wrong entry in their app, and starting over with a fresh secret
+ * is both the remedy and the thing that resets the counter. A confirmed row is
+ * never deleted this way — that would be a remote way to strip someone's second
+ * factor.
  */
-declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "key_revoke_all_tokens";
+declare const MFA_CONFIRM_ATTEMPT_LIMIT = 5;
+declare const mfaTotp: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_totp";
     schema: string;
     columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "key_revoke_all_tokens";
+            tableName: "mfa_totp";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4229,9 +4334,9 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "key_revoke_all_tokens";
+            tableName: "mfa_totp";
             dataType: "object date";
             data: Date;
             driverParam: string;
@@ -4244,9 +4349,9 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "key_revoke_all_tokens";
+            tableName: "mfa_totp";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -4259,9 +4364,9 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
             name: string;
-            tableName: "key_revoke_all_tokens";
+            tableName: "mfa_totp";
             dataType: "number int53";
             data: number;
             driverParam: string | number;
@@ -4274,9 +4379,9 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        tokenHash: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        secretEnc: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "key_revoke_all_tokens";
+            tableName: "mfa_totp";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -4289,28 +4394,13 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        keyEpoch: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>, {
-            name: string;
-            tableName: "key_revoke_all_tokens";
-            dataType: "number int32";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+        confirmedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "key_revoke_all_tokens";
+            tableName: "mfa_totp";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4319,12 +4409,12 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        lastUsedStep: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.PgBigInt53Builder, {
             name: string;
-            tableName: "key_revoke_all_tokens";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
+            tableName: "mfa_totp";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
@@ -4334,14 +4424,14 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        supersededAt: drizzle_orm_pg_core.PgBuildColumn<"key_revoke_all_tokens", drizzle_orm_pg_core.PgTimestampBuilder, {
+        failedConfirmAttempts: drizzle_orm_pg_core.PgBuildColumn<"mfa_totp", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
             name: string;
-            tableName: "key_revoke_all_tokens";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            tableName: "mfa_totp";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -4352,46 +4442,33 @@ declare const keyRevokeAllTokens: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type KeyRevokeAllToken = typeof keyRevokeAllTokens.$inferSelect;
-type NewKeyRevokeAllToken = typeof keyRevokeAllTokens.$inferInsert;
+type MfaTotp = typeof mfaTotp.$inferSelect;
+type NewMfaTotp = typeof mfaTotp.$inferInsert;
 
 /**
- * @spfn/auth - WebAuthn Challenges Entity
- *
- * The random value an authenticator signs, parked between the `options` call
- * that minted it and the `verify` call that spends it.
- *
- * In the database rather than in a cookie or in memory, for two reasons: the
- * check that makes a challenge one-time has to be a conditional UPDATE that two
- * concurrent verifies cannot both win, and several API instances serve the same
- * browser — an in-process map would let a replay land on the instance that never
- * saw the first attempt.
+ * @spfn/auth - Recovery Codes Entity
  *
- * Only the SHA-256 of the challenge is stored, following the rule the package
- * already applies to signup link tokens. A challenge is a nonce rather than a
- * bearer credential, so this buys less than it does there; it costs nothing, and
- * it keeps "plaintext or hash" from becoming a per-table judgement call.
- */
-/**
- * Which ceremony the challenge was minted for.
+ * The ten single-use codes an enrolled account is shown once. Only the hash is
+ * stored, and it is a **password** hash rather than the unsalted SHA-256 the
+ * link flows use — a code a human transcribes is short enough that a leaked
+ * dump of unsalted hashes falls to an offline sweep. `lib/recovery-codes.ts`
+ * sets out the reasoning.
  *
- * Recorded and matched at consume time so a registration challenge cannot be
- * presented to `login/verify` or the other way round — the two ceremonies
- * authorize very different things, and only the kind tells them apart once the
- * value itself is just 32 random bytes.
+ * Codes come in generations. Regenerating raises the generation rather than
+ * deleting the old rows, so a code someone wrote down last year is refused with
+ * the same body as one that never existed, and the history of which generation
+ * a code was spent from survives.
  */
-declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication"];
-type WebAuthnChallengeKind = typeof WEBAUTHN_CHALLENGE_KINDS[number];
-declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "webauthn_challenges";
+declare const mfaRecoveryCodes: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_recovery_codes";
     schema: string;
     columns: {
-        id: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            tableName: "webauthn_challenges";
-            dataType: "number int53";
-            data: number;
-            driverParam: number;
+            tableName: "mfa_recovery_codes";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
@@ -4401,14 +4478,14 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        challengeHash: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
-            tableName: "webauthn_challenges";
-            dataType: "string";
-            data: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "object date";
+            data: Date;
             driverParam: string;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -4416,28 +4493,28 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication"] & [string, ...string[]]>>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
-            tableName: "webauthn_challenges";
-            dataType: "string enum";
-            data: "registration" | "authentication";
-            driverParam: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["registration", "authentication"] & [string, ...string[]];
+            enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.PgBigInt53Builder, {
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
             name: string;
-            tableName: "webauthn_challenges";
+            tableName: "mfa_recovery_codes";
             dataType: "number int53";
             data: number;
             driverParam: string | number;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4446,12 +4523,12 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+        generation: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>, {
             name: string;
-            tableName: "webauthn_challenges";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
+            tableName: "mfa_recovery_codes";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -4461,13 +4538,13 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        consumedAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.PgTimestampBuilder, {
+        codeHash: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "webauthn_challenges";
-            dataType: "object date";
-            data: Date;
+            tableName: "mfa_recovery_codes";
+            dataType: "string";
+            data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -4476,14 +4553,14 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+        usedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_recovery_codes", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            tableName: "webauthn_challenges";
+            tableName: "mfa_recovery_codes";
             dataType: "object date";
             data: Date;
             driverParam: string;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -4494,8 +4571,8 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type WebAuthnChallenge = typeof webauthnChallenges.$inferSelect;
-type NewWebAuthnChallenge = typeof webauthnChallenges.$inferInsert;
+type MfaRecoveryCode = typeof mfaRecoveryCodes.$inferSelect;
+type NewMfaRecoveryCode = typeof mfaRecoveryCodes.$inferInsert;
 
 /**
  * @spfn/auth - Device Authorizations Entity
@@ -5963,6 +6040,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -5989,6 +6068,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6026,6 +6107,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6059,6 +6142,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6082,6 +6167,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6105,6 +6192,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6128,6 +6217,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6151,6 +6242,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     } | null>;
     /**
@@ -6177,6 +6270,8 @@ declare class UsersRepository extends BaseRepository {
             emailVerifiedAt: Date | null;
             phoneVerifiedAt: Date | null;
             keyEpoch: number;
+            sessionBinding: "none" | "passkey";
+            sessionBindingChangedAt: Date | null;
             lastLoginAt: Date | null;
         };
         role: {
@@ -6192,6 +6287,7 @@ declare class UsersRepository extends BaseRepository {
     create(data: NewUser): Promise<{
         email: string | null;
         phone: string | null;
+        sessionBinding: "none" | "passkey";
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
@@ -6204,6 +6300,7 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -6274,6 +6371,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6302,6 +6401,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6325,6 +6426,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6348,6 +6451,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6357,6 +6462,7 @@ declare class UsersRepository extends BaseRepository {
     deleteById(id: number): Promise<{
         email: string | null;
         phone: string | null;
+        sessionBinding: "none" | "passkey";
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
@@ -6369,6 +6475,7 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -6472,6 +6579,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6498,6 +6610,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6524,6 +6641,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6543,6 +6665,10 @@ declare class KeysRepository extends BaseRepository {
      *
      * `includeRevoked`는 이미 끊은 기기까지 보여준다 — "내가 언제 무엇을 끊었나"를
      * 확인하는 용도라, 폐기 시각과 사유를 함께 고른다.
+     *
+     * `lastSeenIp` is not selected, deliberately. The concurrent-use moment is
+     * what the owner acts on; the trail of addresses behind it is stored PII the
+     * account surface has no use for.
      * Read replica 사용
      */
     listForUser(userId: number, includeRevoked?: boolean): Promise<{
@@ -6558,6 +6684,8 @@ declare class KeysRepository extends BaseRepository {
         revokedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        binding: "none" | "passkey";
+        concurrentUseAt: Date | null;
     }[]>;
     /**
      * 공개키 생성
@@ -6579,6 +6707,11 @@ declare class KeysRepository extends BaseRepository {
         lastUsedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6606,6 +6739,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6669,6 +6807,11 @@ declare class KeysRepository extends BaseRepository {
         lastUsedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6698,6 +6841,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6724,6 +6872,46 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
+        clientKind: "ios" | "android" | "web" | null;
+        clientVersion: string | null;
+        clientContractVersion: string | null;
+        clientSeenAt: Date | null;
+        isActive: boolean;
+        createdAt: Date;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        revokedReason: string | null;
+    }>;
+    /**
+     * Bind one live key to the account's passkey, and give it the short life
+     * that goes with it.
+     *
+     * Scoped by user and by `isActive`, like every other targeted update here, so
+     * the answer is "this call bound something" rather than "a row exists".
+     * Write primary 사용
+     */
+    bindByKeyIdAndUserId(keyId: string, userId: number, expiresAt: Date): Promise<{
+        id: number;
+        userId: number;
+        keyId: string;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6735,6 +6923,15 @@ declare class KeysRepository extends BaseRepository {
         revokedAt: Date | null;
         revokedReason: string | null;
     }>;
+    /**
+     * Return every one of a user's bound keys to an ordinary long-lived key.
+     *
+     * One statement, because turning the setting off has to leave no key behind:
+     * a row still marked `'passkey'` would keep expiring in hours with nothing
+     * left to renew it, and its owner has just said they do not want that.
+     * Write primary 사용
+     */
+    unbindActiveByUserId(userId: number, expiresAt: Date): Promise<number>;
     /**
      * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
      *
@@ -6753,6 +6950,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6779,6 +6981,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6809,8 +7016,28 @@ declare class KeysRepository extends BaseRepository {
      * `clientSeenAt` moves only when one of the three values differs from what is
      * stored, so it answers "since when has this device been on this release"
      * rather than "when was it last seen", which lastUsedAt already answers.
+     *
+     * `ip` is the client address this request resolved to, or null when none did.
+     * It joins this statement rather than getting one of its own: the rule the
+     * concurrent-use signal needs — write the address, and move
+     * `concurrentUseAt` when it differs from the stored one inside the window —
+     * is the rule already implemented here, and a second fire-and-forget write
+     * beside it would double the per-request write on the authenticated path. It
+     * is also why the comparison is a `CASE` over the stored value rather than a
+     * read followed by a write: the row comes off the read replica, and a
+     * replica-lagged address compared in application code both misses real
+     * switches and invents ones that did not happen.
+     */
+    updateLastUsedById(id: number, identity?: ClientIdentity | null, ip?: string | null): Promise<void>;
+    /**
+     * The boundary a previous sighting has to be newer than to count as concurrent.
+     *
+     * Computed here rather than written as `now() - interval` so that the moment
+     * the row is stamped with and the moment the window is measured from are the
+     * same one — a statement that used the database clock for the boundary and
+     * ours for the value would disagree with itself by the round trip.
      */
-    updateLastUsedById(id: number, identity?: ClientIdentity | null): Promise<void>;
+    private concurrentUseSince;
 }
 declare const keysRepository: KeysRepository;
 
@@ -7261,6 +7488,31 @@ declare class PasskeysRepository extends BaseRepository {
      * @returns the updated row, or null if it is not theirs or already revoked
      */
     revokeByIdAndUserId(id: number, userId: number, reason: string): Promise<Passkey | null>;
+    /**
+     * Mark or unmark a live credential as the owner's second factor.
+     *
+     * Owner-scoped and live-only, so somebody else's passkey and an already
+     * revoked one are both "no such row" — the same answer every other
+     * management statement here gives.
+     *
+     * @returns the updated row, or null if it is not theirs or already revoked
+     */
+    markSecondFactorByIdAndUserId(id: number, userId: number, secondFactor: boolean): Promise<Passkey | null>;
+    /**
+     * The account's live credentials that satisfy a step-up.
+     *
+     * Used to check an assertion against the marked ones only: a passkey that
+     * signs the owner in is not a second factor until they say it is.
+     */
+    listLiveSecondFactorByUserId(userId: number): Promise<Passkey[]>;
+    /**
+     * Take the second-factor mark off every one of an account's credentials.
+     *
+     * What `mfa/disable` does to the passkey half of an enrolment. The
+     * credentials themselves are untouched — they still sign the owner in.
+     * Write primary.
+     */
+    clearSecondFactorByUserId(userId: number): Promise<void>;
     /**
      * Delete every passkey of an account (account destruction).
      * Write primary.
@@ -7313,6 +7565,158 @@ declare class WebAuthnChallengesRepository extends BaseRepository {
 }
 declare const webauthnChallengesRepository: WebAuthnChallengesRepository;
 
+/**
+ * MFA TOTP Repository
+ *
+ * Data access for the one enrolment row an account may have. Extends
+ * BaseRepository for transaction-context detection and read/write splitting.
+ *
+ * `secret_enc` is a ciphertext and is only ever moved through this layer as an
+ * opaque string — nothing here decrypts, and nothing here logs a row.
+ */
+
+declare class MfaTotpRepository extends BaseRepository {
+    /** The account's enrolment row, confirmed or not. */
+    findByUserId(userId: number): Promise<MfaTotp | null>;
+    /**
+     * Start an enrolment, replacing an unconfirmed one.
+     *
+     * Upsert rather than insert: calling `enroll` twice is the ordinary case —
+     * a user closes the app before scanning — and the second call must hand out
+     * a fresh secret rather than a 409. The failed-attempt counter resets with
+     * it, which is what makes "start over" the documented remedy for a row that
+     * spent its five tries.
+     *
+     * A **confirmed** row is refused by the service before this is reached, so
+     * this can never overwrite a working second factor.
+     */
+    startEnrolment(userId: number, secretEnc: string): Promise<MfaTotp>;
+    /**
+     * Mark the enrolment confirmed and record the step its first code spent.
+     * Write primary.
+     */
+    confirm(userId: number, step: number): Promise<void>;
+    /** Record the newest step this account has spent, so it cannot be replayed. */
+    recordUsedStep(userId: number, step: number): Promise<void>;
+    /**
+     * Count one wrong code against an unconfirmed row.
+     *
+     * @returns the count after this attempt
+     */
+    countFailedConfirm(userId: number): Promise<number>;
+    /** Rewrite the ciphertext in place, after a read on a retired key. */
+    updateSecret(userId: number, secretEnc: string): Promise<void>;
+    /** Drop the account's enrolment. Write primary. */
+    deleteByUserId(userId: number): Promise<void>;
+    /**
+     * Drop enrolments nobody ever confirmed. The sweep job's statement.
+     *
+     * @returns number of rows deleted
+     */
+    deleteUnconfirmedBefore(cutoff: Date): Promise<number>;
+}
+declare const mfaTotpRepository: MfaTotpRepository;
+
+/**
+ * MFA Recovery Codes Repository
+ *
+ * Data access for the ten single-use codes of an account's current generation.
+ * Extends BaseRepository for transaction-context detection and read/write
+ * splitting.
+ *
+ * Every read is scoped by `(user_id, generation)`. A code from an older
+ * generation, or from another account, is not "not found" by accident — it is
+ * outside every query this class can make.
+ */
+
+declare class MfaRecoveryCodesRepository extends BaseRepository {
+    /**
+     * The account's newest generation, or 0 when it has never had codes.
+     *
+     * 0 rather than null so the caller's `+ 1` is the same expression on both
+     * paths: a first enrolment writes generation 1.
+     */
+    currentGeneration(userId: number): Promise<number>;
+    /** Write one generation of codes. Write primary. */
+    createGeneration(userId: number, generation: number, hashes: string[]): Promise<void>;
+    /** The account's unspent codes of one generation. */
+    listUnused(userId: number, generation: number): Promise<MfaRecoveryCode[]>;
+    /** How many of a generation are left, for `status` and the "2 remaining" warning. */
+    countUnused(userId: number, generation: number): Promise<number>;
+    /**
+     * Spend one code, if this call is the one that spends it.
+     *
+     * One conditional UPDATE, like the WebAuthn challenge consume and for the
+     * same reason: two requests arriving with the same code must produce one
+     * winner, not two, and a read-then-write would let both read it as unused.
+     *
+     * @returns true when this call spent the row
+     */
+    consume(id: number): Promise<boolean>;
+    /** Drop every generation the account has. Write primary. */
+    deleteByUserId(userId: number): Promise<void>;
+}
+declare const mfaRecoveryCodesRepository: MfaRecoveryCodesRepository;
+
+/**
+ * MFA Verifications Repository
+ *
+ * Data access for "when did this device last prove the second factor". Extends
+ * BaseRepository for transaction-context detection and read/write splitting.
+ *
+ * One row per device key, replaced rather than appended to: only the newest
+ * verification decides anything, and a history of them would be a table that
+ * grows with every step-up for no reader.
+ */
+
+declare class MfaVerificationsRepository extends BaseRepository {
+    /** When this device last stepped up, if it ever did. */
+    findByKeyId(keyId: string): Promise<MfaVerification | null>;
+    /** Record a fresh verification for this device, replacing any earlier one. */
+    record(keyId: string, userId: number, method: MfaVerificationMethod): Promise<void>;
+    /**
+     * Carry a verification across a key rotation.
+     *
+     * Scoped by owner, so a caller naming somebody else's key moves nothing.
+     * Nothing to move is not an error: a device that never stepped up rotates
+     * exactly as it does today.
+     */
+    moveToKeyId(userId: number, fromKeyId: string, toKeyId: string): Promise<void>;
+    /** Forget every device's verification — what disabling the second factor means. */
+    deleteByUserId(userId: number): Promise<void>;
+}
+declare const mfaVerificationsRepository: MfaVerificationsRepository;
+
+/**
+ * MFA Enrolment Repository
+ *
+ * One question, asked on every sensitive route and at every device
+ * registration: does this account have a second factor at all?
+ *
+ * It spans two tables — a confirmed `mfa_totp` row, or at least one live passkey
+ * the owner marked as a second factor — so it lives here rather than in either
+ * table's repository, and it is deliberately **one** statement. `assertStepUp`
+ * asks it first and returns immediately when the answer is no, so an account
+ * that never enrolled pays one round trip against two indexed lookups
+ * (`mfa_totp_user_id_idx`, unique, and `passkeys_user_id_idx`) and nothing else:
+ * no second query, and no passkey configuration read.
+ *
+ * `UNION ALL ... LIMIT 1` rather than two `EXISTS` counts, so Postgres stops at
+ * the first row either side produces. Both halves select `user_id` — a column
+ * rather than a literal, so the two sides agree on a shape without a raw-SQL
+ * alias, and the value is thrown away either way.
+ */
+
+declare class MfaEnrolmentRepository extends BaseRepository {
+    /** Whether the account has a confirmed TOTP or a live second-factor passkey. */
+    isEnrolled(userId: number): Promise<boolean>;
+    /** The other half of the union, as its own read for `status` to reuse. */
+    private liveSecondFactorPasskeys;
+    /** Whether at least one live passkey is marked as a second factor. */
+    hasSecondFactorPasskey(userId: number): Promise<boolean>;
+}
+declare const mfaEnrolmentRepository: MfaEnrolmentRepository;
+
 /**
  * Device Authorizations Repository
  *
@@ -9153,6 +9557,31 @@ declare function verifyKeyFingerprint(publicKeyB64: string, expectedFingerprint:
  */
 declare function assertKeyMatchesAlgorithm(publicKeyB64: string, algorithm: KeyAlgorithmType): void;
 
+/**
+ * Whether a key may sign a renewal — the one clause that differs from `authenticate`.
+ *
+ * Bound, and within its grace. Early renewal is allowed, because a browser that
+ * asks a minute before its key runs out should not have to wait for the failure
+ * first; late renewal is allowed for the grace window, so a laptop closed over a
+ * long weekend comes back to one prompt instead of a sign-in. Past it there is
+ * nothing to continue, and an unbound key was never in this ceremony at all.
+ */
+declare function admitsForRenewal(key: UserPublicKey): boolean;
+/**
+ * Renewal authentication middleware
+ *
+ * Auto-skips the global `auth` middleware, the way `optionalAuth` does: a route
+ * that carries this one must not also be asked for a live key.
+ *
+ * @example
+ * ```typescript
+ * export const sessionRenewOptions = route.post('/_auth/session/renew/options')
+ *   .use([authenticateForRenewal])
+ *   .handler(async (c) => startSessionRenewService({ expiredKeyId: getAuth(c).keyId }));
+ * ```
+ */
+declare const authenticateForRenewal: _spfn_core_route.NamedMiddleware<"authForRenewal">;
+
 /**
  * @spfn/auth - Permission Middleware
  *
@@ -9497,6 +9926,7 @@ declare function getUser(c: Context | {
 }): {
     email: string | null;
     phone: string | null;
+    sessionBinding: "none" | "passkey";
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     publicId: string;
     passwordChangeRequired: boolean;
@@ -9509,6 +9939,7 @@ declare function getUser(c: Context | {
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
     deletedAt: Date | null;
     deletedBy: string | null;
@@ -10439,8 +10870,8 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
 
 /**
  * Build the auth job router: the account-deletion purge sweep, the OAuth 2.1
- * stale-client sweep, the sign-out-everywhere link sweep, and the link-mail
- * sender.
+ * stale-client sweep, the sign-out-everywhere link sweep, the abandoned
+ * second-factor enrolment sweep, and the link-mail sender.
  *
  * The cron is a parameter because `job(...).cron(expression)` bakes the string in
  * at module-import time, which always happens before `createAuthLifecycle()` runs
@@ -10451,15 +10882,18 @@ declare const linkMailJob: _spfn_core_job.JobDef<{
  * @param options.purgeCron - Deletion purge schedule; defaults to daily at 04:00
  * @param options.oauth2ClientPurgeCron - Stale OAuth client sweep; defaults to daily at 05:00
  * @param options.revokeAllTokenPurgeCron - Sign-out-everywhere link sweep; defaults to daily at 06:00
+ * @param options.mfaSweepCron - Abandoned second-factor enrolment sweep; defaults to daily at 07:00
  */
 declare function createAuthJobRouter(options?: {
     purgeCron?: string;
     oauth2ClientPurgeCron?: string;
     revokeAllTokenPurgeCron?: string;
+    mfaSweepCron?: string;
 }): _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
     oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
     revokeAllTokenPurge: _spfn_core_job.JobDef<void, void>;
+    mfaSweep: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -10480,6 +10914,7 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
     deletionPurge: _spfn_core_job.JobDef<void, void>;
     oauth2ClientPurge: _spfn_core_job.JobDef<void, void>;
     revokeAllTokenPurge: _spfn_core_job.JobDef<void, void>;
+    mfaSweep: _spfn_core_job.JobDef<void, void>;
     linkMail: _spfn_core_job.JobDef<{
         kind: "signup-link";
         rowId: number;
@@ -10499,4 +10934,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };