@spfn/auth 0.3.0-beta.22 → 0.3.0-beta.24

package/dist/{machine-principals-B7N8gux0.d.ts → machine-principals-ZJd9anVT.d.ts}

@@ -1,7 +1,7 @@
 import * as _simplewebauthn_server from '@simplewebauthn/server';
-import { RegistrationResponseJSON, AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
+import { AuthenticationResponseJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server';
+import { S as SessionBindingType, K as KeyAlgorithmType, h as KeyPlatformType, l as SocialProvider } from './types-CTdoTOxM.js';
 import * as _spfn_core_route from '@spfn/core/route';
-import { K as KeyAlgorithmType, h as KeyPlatformType, j as SocialProvider } from './types-DYyhze28.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
@@ -91,548 +91,29 @@ interface UserProfile {
 }
 
 /**
- * @spfn/auth - Auth Service
- *
- * Core authentication logic: registration, login, logout, password management
- */
-
-interface RegisterParams {
-    email?: string;
-    phone?: string;
-    verificationToken: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    metadata?: Record<string, unknown>;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-interface RegisterResult {
-    userId: string;
-    publicId: string;
-    email?: string;
-    phone?: string;
-}
-interface LoginParams {
-    email?: string;
-    phone?: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    oldKeyId?: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-interface LoginResult {
-    userId: string;
-    publicId: string;
-    email?: string;
-    phone?: string;
-    passwordChangeRequired: boolean;
-}
-interface LogoutParams {
-    userId: number;
-    keyId: string;
-}
-interface ChangePasswordParams {
-    userId: number;
-    currentPassword?: string;
-    newPassword: string;
-    passwordHash?: string;
-}
-/**
- * Register a new user account
- */
-declare function registerService(params: RegisterParams): Promise<RegisterResult>;
-/**
- * Authenticate user and create session
- */
-declare function loginService(params: LoginParams): Promise<LoginResult>;
-/**
- * Logout user (revoke current key)
- */
-declare function logoutService(params: LogoutParams): Promise<void>;
-/**
- * Change user password
- */
-declare function changePasswordService(params: ChangePasswordParams): Promise<void>;
-
-declare const EmailSchema: _sinclair_typebox.TString;
-declare const PhoneSchema: _sinclair_typebox.TString;
-/**
- * Optional device labels a client may send when registering a key.
- *
- * Display only: the key list uses them to tell one device from another, and
- * nothing is authorized or refused by either value, so a client that lies about
- * them gains nothing. Both are omitted by every key registered before they
- * existed, hence optional rather than defaulted.
- */
-declare const DeviceNameSchema: _sinclair_typebox.TString;
-declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
-/**
- * Key material as a device sends it, bounded.
- *
- * The bounds exist for the one route that takes this material from a caller who
- * has not authenticated and cannot: `POST /_auth/device/start` persists what it
- * is given, and a correctly fingerprinted megabyte of base64 would sit in
- * `device_authorizations` until something swept it — and nothing sweeps it.
- *
- * The numbers are what real key material measures, with room to spare. The
- * package's own generators produce SPKI DER in base64: 124 characters for
- * ES256 (P-256), 392 for RS256 (RSA-2048). An RSA-4096 key would be 736, an
- * RSA-8192 key about 1400, and the same 4096-bit key PEM-armoured about 800 —
- * so 2048 admits every shape of key anyone could reasonably present, while a
- * megabyte is refused three orders of magnitude before it reaches a row.
- *
- * `keyId` is a UUID (36) everywhere this package generates one; 64 leaves room
- * for a client that prefixes or namespaces its own. `fingerprint` is SHA-256
- * hex, exactly 64, and nothing else can ever verify against the public key —
- * 128 is the length a longer digest would need, and no more.
- */
-declare const PublicKeySchema: _sinclair_typebox.TString;
-declare const KeyIdSchema: _sinclair_typebox.TString;
-declare const FingerprintSchema: _sinclair_typebox.TString;
-/**
- * The code a person reads off the waiting device and types on their own.
- *
- * Loose on purpose: 8 characters plus an optional dash is what is shown, but the
- * server folds whitespace, dashes and lower case away before looking anything up,
- * so refusing those spellings here would refuse a code that is on screen. The
- * bounds exist to stop an unbounded string reaching the database, not to spell
- * out the format — `USER_CODE_ALPHABET` is the only thing that can match a row.
- */
-declare const UserCodeSchema: _sinclair_typebox.TString;
-/**
- * What `POST /_auth/device/poll` answers with.
- *
- * A union, because the two answers are different kinds of thing rather than one
- * shape with optional fields: pending says "ask again in this long", approved is
- * a completed login carrying exactly what `/_auth/login` returns. `status` is the
- * discriminant, so a generated client narrows on it instead of testing which
- * fields happen to be present.
- *
- * The mobile contract has no union type, so it exports this as one object with
- * `status` required and every branch field optional — see
- * `deviceAuthorization.pollStatusRule` in the bundle. `intervalMillis` is an
- * integer for the same reason: that grammar carries no floating-point scalar,
- * and a count of milliseconds never needed one.
- *
- * That integer is a promise two things keep, because nothing validates a response
- * against this schema on the way out. `configureDeviceAuth` refuses an interval
- * that is not a whole number of milliseconds, so the only value this branch can
- * carry is one; and `contract-export.test.ts` reads this schema to check the
- * exported declaration, so writing `Type.Number` here fails the suite instead of
- * publishing an integer the server does not send.
- */
-declare const DeviceAuthPollResponseSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TObject<{
-    status: _sinclair_typebox.TLiteral<"pending">;
-    intervalMillis: _sinclair_typebox.TInteger;
-}>, _sinclair_typebox.TObject<{
-    status: _sinclair_typebox.TLiteral<"approved">;
-    userId: _sinclair_typebox.TString;
-    publicId: _sinclair_typebox.TString;
-    email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-    phone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-    passwordChangeRequired: _sinclair_typebox.TBoolean;
-}>]>;
-declare const PasswordSchema: _sinclair_typebox.TString;
-declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
-type VerificationTargetType = Static<typeof TargetTypeSchema>;
-declare const VERIFICATION_TARGET_TYPES: readonly ["email", "phone"];
-declare const VerificationPurposeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">, _sinclair_typebox.TLiteral<"account_deletion">]>;
-type VerificationPurpose = Static<typeof VerificationPurposeSchema>;
-declare const VERIFICATION_PURPOSES: readonly ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"];
-
-/**
- * @spfn/auth - Verification Service
- *
- * Handles OTP code generation, validation, and delivery
- */
-
-interface SendVerificationCodeParams {
-    target: string;
-    targetType: VerificationTargetType;
-    purpose: VerificationPurpose;
-}
-interface SendVerificationCodeResult {
-    success: boolean;
-    expiresAt: string;
-}
-interface VerifyCodeParams {
-    target: string;
-    targetType: VerificationTargetType;
-    code: string;
-    purpose: VerificationPurpose;
-}
-interface VerifyCodeResult {
-    valid: boolean;
-    verificationToken: string;
-}
-/**
- * Send verification code via email or SMS
- */
-declare function sendVerificationCodeService(params: SendVerificationCodeParams): Promise<SendVerificationCodeResult>;
-/**
- * Verify OTP code and return verification token
- */
-declare function verifyCodeService(params: VerifyCodeParams): Promise<{
-    valid: boolean;
-    verificationToken: string;
-}>;
-
-/**
- * @spfn/auth - Verified-Email Signup Service
- *
- * A signup where the address is proven before a password exists:
+ * @spfn/auth - Passkeys Entity
  *
- *   request  -> a one-time link is emailed
- *   confirm  -> the link is exchanged for a short-lived password-setup session
- *   password -> the account is created, the device registered, the user signed in
+ * A WebAuthn credential the account owner enrolled on one of their devices.
+ * It is a *credential*, not a session: an assertion proves who is asking, and
+ * the ordinary device key in `user_public_keys` is what the request afterwards
+ * is signed with. The two tables therefore never stand in for each other.
  *
- * The link token and the setup secret are bearer credentials, so neither is ever
- * stored. Only their SHA-256 hashes are, and lookup is by hash. A database dump
- * therefore yields nothing that can be presented to either step.
+ * Nothing here is a bearer value, so nothing is hashed. `publicKey` is public by
+ * construction and `credentialId` is a handle the authenticator hands to any
+ * origin that asks — storing either in the clear costs nothing, and the lookup
+ * on `credentialId` has to be a plain equality match on an indexed column.
  *
- * The six-digit-code registration path is untouched and remains the default; this
- * is a second entry point to the same account creation, not a replacement.
+ * Revocation is soft, and `credentialId` stays unique across live and revoked
+ * rows alike: a credential someone cut off must never become enrollable again,
+ * on this account or on another one.
  */
-
-interface RequestSignupLinkParams {
-    email: string;
-    returnPath?: string;
-}
-interface RequestSignupLinkResult {
-    success: boolean;
-    expiresAt: string;
-}
 /**
- * Step 1 — issue a confirmation link for an address.
- *
- * Answers identically whether or not the address already has an account. When it
- * does, the owner gets a notice instead of a usable link, through the same
- * dedupe window the six-digit-code path uses.
- *
- * Requesting again is how a resend works: every live link for the address is
- * superseded first, so the newest link is the only one that opens, and any setup
- * session already opened from an older link dies with it.
+ * Whether the credential can leave the authenticator that minted it.
  *
- * Neither branch sends mail: both hand it to `auth.link-mail`, so the answer
- * costs the same database work whichever one ran. With no pg-boss initialised
- * the mail still goes out on this request — see `lib/link-mail-delivery.ts`.
- */
-declare function requestSignupLinkService(params: RequestSignupLinkParams): Promise<RequestSignupLinkResult>;
-interface ConfirmSignupLinkParams {
-    token: string;
-}
-interface ConfirmSignupLinkResult {
-    email: string;
-    returnPath: string | null;
-    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
-    setupSecret: string;
-    setupExpiresAt: string;
-}
-/**
- * Step 2 — exchange a link for a password-setup session.
- *
- * Nothing binds the row to a device or a browser, which is what lets someone
- * request the link on a laptop and open it on a phone.
- */
-declare function confirmSignupLinkService(params: ConfirmSignupLinkParams): Promise<ConfirmSignupLinkResult>;
-interface CompleteSignupParams {
-    setupSecret?: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    metadata?: Record<string, unknown>;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-/**
- * Step 3 — set the password, which is what creates the account.
- *
- * Run under `Transactional()`: the user row, the device key and the completion
- * mark commit together. A device-key failure must not leave an account nobody
- * can sign into, and a completion mark must not survive a rolled-back account.
- *
- * A refusal that is the user's to fix — a weak password, an app policy that
- * rejects the registration — leaves the setup session usable, so the fix is
- * retyping the password rather than requesting a fresh email.
- */
-declare function completeSignupService(params: CompleteSignupParams): Promise<RegisterResult>;
-
-/**
- * @spfn/auth - Password Reset Service
- *
- * Getting back into an account whose password is gone, using the address the
- * account already proved:
- *
- *   request  -> a one-time link is emailed
- *   confirm  -> the link is exchanged for a short-lived password-setup session
- *   complete -> the new password is written, everything else is signed out,
- *               and the browser that reset is signed in on a fresh device key
- *
- * Mirrors the verified-email signup slice deliberately — same credentials, same
- * hashing, same supersede-on-resend, same interceptor moves — with two
- * differences that matter.
- *
- * First, the request answers identically for *every* input and sends mail only
- * to an account that can be reset. Signup can afford to tell an existing owner
- * "you already have an account"; a reset cannot send anything to a stranger's
- * mailbox, because the mail itself would be the answer to "does this address
- * have an account here".
- *
- * Second, completing it is a credential change on a live account, so it carries
- * the same blast radius as `changePasswordService`: pending device
- * authorizations are denied and every active key is revoked. Whoever was signed
- * in on the old password is signed out, including the attacker the reset was
- * needed for.
- */
-
-interface RequestPasswordResetParams {
-    email: string;
-    returnPath?: string;
-}
-interface RequestPasswordResetResult {
-    success: boolean;
-    expiresAt: string;
-}
-/**
- * Step 1 — issue a reset link for an address.
- *
- * Answers identically for every input: the same status, the same two fields, and
- * an `expiresAt` computed the same way whether or not a row was written. An
- * address with no account, an account that cannot be reset, and an account that
- * can are indistinguishable to the caller — only the first of the three gets
- * mail, and it goes to the owner.
- *
- * Requesting again is how a resend works: every live link for the account is
- * superseded first, so the newest link is the only one that opens, and any setup
- * session already opened from an older link dies with it.
- *
- * The eligible branch does not send the mail either — it hands it to
- * `auth.link-mail` — so the two branches differ by a few database writes and not
- * by a mail provider's round trip. With no pg-boss initialised the mail still
- * goes out on this request; see `lib/link-mail-delivery.ts`.
- */
-declare function requestPasswordResetService(params: RequestPasswordResetParams): Promise<RequestPasswordResetResult>;
-interface ConfirmPasswordResetParams {
-    token: string;
-}
-interface ConfirmPasswordResetResult {
-    email: string;
-    returnPath: string | null;
-    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
-    setupSecret: string;
-    setupExpiresAt: string;
-}
-/**
- * Step 2 — exchange a link for a password-setup session.
- *
- * Nothing binds the row to a device or a browser, which is what lets someone ask
- * for the link on a laptop and open it on a phone.
- */
-declare function confirmPasswordResetService(params: ConfirmPasswordResetParams): Promise<ConfirmPasswordResetResult>;
-interface CompletePasswordResetParams {
-    setupSecret?: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-/**
- * Step 3 — set the new password, which is what completes the reset.
- *
- * Run under `Transactional()`: the password, the revocations, the new device key
- * and the completion mark commit together. A key registration that failed after
- * the revoke-all would otherwise leave an account with a new password and
- * nothing signed in.
- *
- * A refusal that is the user's to fix — a password the policy rejects, a body
- * with no device key — leaves the setup session usable, so the fix is retyping
- * the password rather than asking for a fresh email.
- */
-declare function completePasswordResetService(params: CompletePasswordResetParams): Promise<RegisterResult>;
-
-/**
- * @spfn/auth - Device Auth Service
- *
- * Device-code login: a device with no key on file yet shows a short code, the
- * account owner types that code on a device that is already signed in, and the
- * waiting device's key is registered on approval.
- *
- * There is no token to hand over. Every request in this system is signed by the
- * calling device's own key, so "logging a device in" means one thing — getting
- * its public key into `user_public_keys` under the right account. That is what
- * the poll does, and it is why the poll returns exactly what `loginService`
- * returns: from the client's side the two ways in are indistinguishable.
- *
- * | state ↓ op → | info | approve | deny | poll |
- * | --- | --- | --- | --- | --- |
- * | pending | device details | → approved | → denied | pending |
- * | approved | AlreadyHandled | AlreadyHandled | AlreadyHandled | key registered, → consumed |
- * | denied | AlreadyHandled | AlreadyHandled | AlreadyHandled | Denied |
- * | consumed | NotFound | NotFound | NotFound | NotFound |
- * | expired | Expired | Expired | Expired | Expired |
- * | unknown | NotFound | NotFound | NotFound | NotFound |
- *
- * A global revocation — revoke-all, a password change, a deletion request —
- * refuses the account's live records too, as `denied`, so they land in that row
- * of the table. See `denyAllActiveByUserId`; the three callers are the three
- * places that revoke every key at once.
- */
-
-interface StartDeviceAuthParams {
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    /** Device label shown to the approver. Display only — nothing is authorized by it. */
-    deviceName?: string;
-    platform?: KeyPlatformType;
-}
-interface StartDeviceAuthResult {
-    /** Returned once. The waiting device polls with it; the server stores only its hash. */
-    deviceCode: string;
-    /** `XXXX-XXXX`, for the waiting device's screen and nowhere else. */
-    userCode: string;
-    expiresAtMillis: number;
-    /** Milliseconds the waiting device should wait between polls. */
-    intervalMillis: number;
-}
-interface DeviceAuthInfoParams {
-    userCode: string;
-}
-/** What the approver is shown about the device asking to be let in. */
-interface DeviceAuthInfoResult {
-    deviceName?: string;
-    /** One of `KEY_PLATFORM`, which is what the route accepts and the column stores. */
-    platform?: KeyPlatformType;
-    /** First bytes of the pending key's fingerprint, as the device list truncates it. */
-    fingerprintPrefix: string;
-    requestedAtMillis: number;
-    expiresAtMillis: number;
-}
-interface ApproveDeviceAuthParams {
-    userCode: string;
-    /** The approver, read from their session. Never from a request body. */
-    userId: number;
-}
-interface DenyDeviceAuthParams {
-    userCode: string;
-}
-interface PollDeviceAuthParams {
-    deviceCode: string;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-/** Nobody has answered yet. Not an error — the waiting device waits. */
-interface DeviceAuthPendingResult {
-    status: 'pending';
-    intervalMillis: number;
-}
-/** Approved and spent: the key is registered and this is the login it produced. */
-type DeviceAuthApprovedResult = {
-    status: 'approved';
-} & LoginResult;
-type PollDeviceAuthResult = DeviceAuthPendingResult | DeviceAuthApprovedResult;
-/**
- * Park a new device's key and hand back the codes it needs.
- *
- * The caller is unauthenticated by definition — this is what a device does before
- * it has any way to prove anything — so nothing here is attributed to an account.
- * The record gains an owner only when someone approves it.
- */
-declare function startDeviceAuthService(params: StartDeviceAuthParams): Promise<StartDeviceAuthResult>;
-/**
- * What the approver sees before deciding.
- *
- * This is the whole defence against being talked into approving someone else's
- * device: the answer names the device that is waiting, so the person holding the
- * phone can see that it is not theirs. An approval screen that showed only the
- * code would be asking them to confirm a number they were just told.
- */
-declare function getDeviceAuthInfoService(params: DeviceAuthInfoParams): Promise<DeviceAuthInfoResult>;
-/**
- * Bind the record to the approving account.
- *
- * The key is not registered here. The waiting device may never come back, and a
- * key registered for a device that stopped listening is a signing credential
- * nobody asked for — so approval records the decision and the poll acts on it.
- *
- * Answers with the same device description `info` returns, so a client that let
- * a user approve without looking first can still show them what they just let
- * in — which is the moment someone talked into approving an attacker's device
- * has to notice and revoke it.
- */
-declare function approveDeviceAuthService(params: ApproveDeviceAuthParams): Promise<DeviceAuthInfoResult>;
-/**
- * Refuse the record, so the waiting device is told no instead of timing out.
- *
- * Denying binds no user: the point of refusing is that the account owner wants
- * nothing to do with the request.
- */
-declare function denyDeviceAuthService(params: DenyDeviceAuthParams): Promise<void>;
-/**
- * The waiting device asking whether anyone has answered.
- *
- * Approved is the one branch with a side effect, and it is a one-shot: the record
- * is spent by a conditional update that names `approved`, so of two polls that
- * arrive together exactly one registers the key. The loser matches nothing and is
- * answered as if the code were unknown — which by then it is.
- */
-declare function pollDeviceAuthService(params: PollDeviceAuthParams): Promise<PollDeviceAuthResult>;
-
-/**
- * @spfn/auth - Passkeys Entity
- *
- * A WebAuthn credential the account owner enrolled on one of their devices.
- * It is a *credential*, not a session: an assertion proves who is asking, and
- * the ordinary device key in `user_public_keys` is what the request afterwards
- * is signed with. The two tables therefore never stand in for each other.
- *
- * Nothing here is a bearer value, so nothing is hashed. `publicKey` is public by
- * construction and `credentialId` is a handle the authenticator hands to any
- * origin that asks — storing either in the clear costs nothing, and the lookup
- * on `credentialId` has to be a plain equality match on an indexed column.
- *
- * Revocation is soft, and `credentialId` stays unique across live and revoked
- * rows alike: a credential someone cut off must never become enrollable again,
- * on this account or on another one.
- */
-/**
- * Whether the credential can leave the authenticator that minted it.
- *
- * `multiDevice` is a synced passkey (iCloud Keychain, Google Password Manager);
- * `singleDevice` is bound to one authenticator. Reported by the authenticator at
- * enrollment and shown in the management list, because "this one is only on that
- * phone" is what the owner needs to know before revoking the other entry.
+ * `multiDevice` is a synced passkey (iCloud Keychain, Google Password Manager);
+ * `singleDevice` is bound to one authenticator. Reported by the authenticator at
+ * enrollment and shown in the management list, because "this one is only on that
+ * phone" is what the owner needs to know before revoking the other entry.
  */
 declare const PASSKEY_DEVICE_TYPES: readonly ["singleDevice", "multiDevice"];
 type PasskeyDeviceType = typeof PASSKEY_DEVICE_TYPES[number];
@@ -822,6 +303,21 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        secondFactor: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "passkeys";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"passkeys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
             tableName: "passkeys";
@@ -873,6 +369,675 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
 type Passkey = typeof passkeys.$inferSelect;
 type NewPasskey = typeof passkeys.$inferInsert;
 
+/**
+ * @spfn/auth - Auth Service
+ *
+ * Core authentication logic: registration, login, logout, password management
+ */
+
+interface RegisterParams {
+    email?: string;
+    phone?: string;
+    verificationToken: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    metadata?: Record<string, unknown>;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. Carried for shape rather than effect: a brand-new account is on the
+     * default `session_binding: 'none'`, so its first key is never bound.
+     */
+    webProxy?: boolean;
+}
+interface RegisterResult {
+    userId: string;
+    publicId: string;
+    email?: string;
+    phone?: string;
+}
+interface LoginParams {
+    email?: string;
+    phone?: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    oldKeyId?: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
+}
+/**
+ * What a sign-in answers with, on every path that starts a session.
+ *
+ * The last two fields are the carrier #97 needed. The Next.js proxy generated
+ * the device key and sealed the cookie, but only the backend knows whether the
+ * account asked for a bound session and when the key it just registered runs
+ * out — so the sign-in says it here and the interceptor copies both into
+ * `SessionData`. A response without them seals an unbound session, which is what
+ * every account that did not opt in gets and what every path predating this
+ * change keeps getting.
+ */
+interface LoginResult {
+    userId: string;
+    publicId: string;
+    email?: string;
+    phone?: string;
+    passwordChangeRequired: boolean;
+    /** `'passkey'` when the key registered by this sign-in is bound. Absent otherwise. */
+    sessionBinding?: SessionBindingType;
+    /** Epoch milliseconds that key expires at. Only sent alongside `sessionBinding`. */
+    keyExpiresAtMillis?: number;
+}
+/**
+ * The binding half of a sign-in answer, as a type.
+ *
+ * Named because more than one result carries it: a password reset registers a
+ * device key exactly as a sign-in does, so its answer has to say so too or the
+ * proxy seals a cookie that does not know the key it holds is short-lived.
+ */
+type LoginBindingFields = Pick<LoginResult, 'sessionBinding' | 'keyExpiresAtMillis'>;
+interface LogoutParams {
+    userId: number;
+    keyId: string;
+}
+interface ChangePasswordParams {
+    userId: number;
+    /**
+     * The device key this request is signed with.
+     *
+     * Only read to measure the second-factor window of an enrolled account —
+     * an account with nothing enrolled is answered exactly as before, so this
+     * adds no refusal for anybody who has not opted in.
+     */
+    keyId: string;
+    currentPassword?: string;
+    newPassword: string;
+    passwordHash?: string;
+}
+/**
+ * Register a new user account
+ */
+declare function registerService(params: RegisterParams): Promise<RegisterResult>;
+/**
+ * Authenticate user and create session
+ */
+declare function loginService(params: LoginParams): Promise<LoginResult>;
+/**
+ * Logout user (revoke current key)
+ */
+declare function logoutService(params: LogoutParams): Promise<void>;
+/**
+ * Change user password
+ *
+ * An enrolled account steps up first (#95): a stolen session must not be able
+ * to take the account over by setting a new password. An unenrolled account is
+ * unaffected — including the OAuth-only account with no password and a key
+ * older than ten minutes, which still sets a first password and gets a 200.
+ */
+declare function changePasswordService(params: ChangePasswordParams): Promise<void>;
+
+/**
+ * @spfn/auth - Session Renewal Service
+ *
+ * What a bound session does when its key runs out: prove, with a fresh WebAuthn
+ * assertion, that the person who enrolled the passkey is still at the machine,
+ * and get a new short-lived key sealed into the cookie.
+ *
+ * Neither step is public. The expiring key is named by `expiredKeyId`, and that
+ * value reaches the service from `authenticateForRenewal` — the `keyId` of a
+ * bearer JWT this very key signed — rather than from the request body, so a
+ * caller who does not hold the private half cannot name a key at all. The
+ * assertion still has to be signed by a passkey that key's owner enrolled: the
+ * signature proves the cookie, and the cookie is the thing that may have been
+ * copied.
+ *
+ * The admission below is run again here all the same. The middleware and the
+ * service ask the same four questions of the row, and a service that trusted its
+ * caller to have asked them would be one refactor away from not being asked at
+ * all.
+ *
+ * Every refusal is the same refusal. A key that never existed, a stranger's key,
+ * an unbound key, a revoked one, one past its grace, an inactive account, a spent
+ * challenge, an assertion that did not verify — all `SessionRenewalRefusedError`,
+ * with the same body, because anything finer would answer "is this key id live"
+ * to whoever asked.
+ *
+ * Renewal announces nothing. No `auth.login`, no `auth.device.registered`, and
+ * `lastLoginAt` does not move: this is the same person on the same device
+ * continuing the session they already had, and a subscriber mailing "new sign-in"
+ * once a day per device would train its reader to ignore the notice that matters.
+ * A `lastLoginAt` that moved every day would make dormant-account detection
+ * meaningless for exactly the accounts that turned this protection on.
+ */
+
+interface StartSessionRenewParams {
+    /** The key that ran out, read off the JWT the request was signed with. */
+    expiredKeyId: string;
+}
+interface FinishSessionRenewParams extends StartSessionRenewParams {
+    /** The assertion, from `navigator.credentials.get()`. */
+    response: AuthenticationResponseJSON;
+    /**
+     * The new key pair, in the vocabulary the Next.js login interceptor already
+     * writes: `renew/verify` is on that interceptor's path list, so these arrive
+     * exactly as they do on a login.
+     */
+    keyId: string;
+    publicKey: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+}
+/**
+ * What a completed renewal answers: a sign-in result, plus the new key's id.
+ *
+ * The id is the one thing a renewal has that a sign-in does not need to say —
+ * `renewSession()` promises it to the app, which has no other way to learn it
+ * (the key pair is minted in the proxy and the private half never leaves the
+ * cookie). It is not a contract operation, so nothing generated reads it.
+ */
+interface SessionRenewResult extends LoginResult {
+    /** The key this renewal registered, the one the session now signs with. */
+    keyId: string;
+}
+/**
+ * Step 1 — the challenge the authenticator signs.
+ *
+ * `allowCredentials` is empty and the account lives only on the challenge row.
+ * See `startRenewalCeremonyService`.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없는 키·계정일 때 (모든 사유 동일)
+ */
+declare function startSessionRenewService(params: StartSessionRenewParams): Promise<PublicKeyCredentialRequestOptionsJSON>;
+/**
+ * Step 2 — verify the assertion, put a new bound key in place of the old one.
+ *
+ * The revocation runs first and its answer is the race winner: two verifies that
+ * both got past their own challenges meet at the same conditional UPDATE, and
+ * only the one that actually revoked the key goes on to register a replacement.
+ *
+ * The new key inherits the old row's provenance, so the device list keeps saying
+ * where this device first appeared rather than re-stamping itself every day. Its
+ * expiry is a fresh window from now — renewal is a renewal, not an extension of
+ * what the old key had.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없을 때 (증명 실패 포함, 모든 사유 동일)
+ */
+declare function finishSessionRenewService(params: FinishSessionRenewParams): Promise<SessionRenewResult>;
+
+declare const EmailSchema: _sinclair_typebox.TString;
+declare const PhoneSchema: _sinclair_typebox.TString;
+/**
+ * Optional device labels a client may send when registering a key.
+ *
+ * Display only: the key list uses them to tell one device from another, and
+ * nothing is authorized or refused by either value, so a client that lies about
+ * them gains nothing. Both are omitted by every key registered before they
+ * existed, hence optional rather than defaulted.
+ */
+declare const DeviceNameSchema: _sinclair_typebox.TString;
+declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
+/**
+ * Key material as a device sends it, bounded.
+ *
+ * The bounds exist for the one route that takes this material from a caller who
+ * has not authenticated and cannot: `POST /_auth/device/start` persists what it
+ * is given, and a correctly fingerprinted megabyte of base64 would sit in
+ * `device_authorizations` until something swept it — and nothing sweeps it.
+ *
+ * The numbers are what real key material measures, with room to spare. The
+ * package's own generators produce SPKI DER in base64: 124 characters for
+ * ES256 (P-256), 392 for RS256 (RSA-2048). An RSA-4096 key would be 736, an
+ * RSA-8192 key about 1400, and the same 4096-bit key PEM-armoured about 800 —
+ * so 2048 admits every shape of key anyone could reasonably present, while a
+ * megabyte is refused three orders of magnitude before it reaches a row.
+ *
+ * `keyId` is a UUID (36) everywhere this package generates one; 64 leaves room
+ * for a client that prefixes or namespaces its own. `fingerprint` is SHA-256
+ * hex, exactly 64, and nothing else can ever verify against the public key —
+ * 128 is the length a longer digest would need, and no more.
+ */
+declare const PublicKeySchema: _sinclair_typebox.TString;
+declare const KeyIdSchema: _sinclair_typebox.TString;
+declare const FingerprintSchema: _sinclair_typebox.TString;
+/**
+ * The code a person reads off the waiting device and types on their own.
+ *
+ * Loose on purpose: 8 characters plus an optional dash is what is shown, but the
+ * server folds whitespace, dashes and lower case away before looking anything up,
+ * so refusing those spellings here would refuse a code that is on screen. The
+ * bounds exist to stop an unbounded string reaching the database, not to spell
+ * out the format — `USER_CODE_ALPHABET` is the only thing that can match a row.
+ */
+declare const UserCodeSchema: _sinclair_typebox.TString;
+/**
+ * What `POST /_auth/device/poll` answers with.
+ *
+ * A union, because the two answers are different kinds of thing rather than one
+ * shape with optional fields: pending says "ask again in this long", approved is
+ * a completed login carrying exactly what `/_auth/login` returns. `status` is the
+ * discriminant, so a generated client narrows on it instead of testing which
+ * fields happen to be present.
+ *
+ * The mobile contract has no union type, so it exports this as one object with
+ * `status` required and every branch field optional — see
+ * `deviceAuthorization.pollStatusRule` in the bundle. `intervalMillis` is an
+ * integer for the same reason: that grammar carries no floating-point scalar,
+ * and a count of milliseconds never needed one.
+ *
+ * That integer is a promise two things keep, because nothing validates a response
+ * against this schema on the way out. `configureDeviceAuth` refuses an interval
+ * that is not a whole number of milliseconds, so the only value this branch can
+ * carry is one; and `contract-export.test.ts` reads this schema to check the
+ * exported declaration, so writing `Type.Number` here fails the suite instead of
+ * publishing an integer the server does not send.
+ */
+declare const DeviceAuthPollResponseSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TObject<{
+    status: _sinclair_typebox.TLiteral<"pending">;
+    intervalMillis: _sinclair_typebox.TInteger;
+}>, _sinclair_typebox.TObject<{
+    status: _sinclair_typebox.TLiteral<"approved">;
+    userId: _sinclair_typebox.TString;
+    publicId: _sinclair_typebox.TString;
+    email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+    phone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+    passwordChangeRequired: _sinclair_typebox.TBoolean;
+    sessionBinding: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"none" | "passkey">[]>>;
+    keyExpiresAtMillis: _sinclair_typebox.TOptional<_sinclair_typebox.TInteger>;
+}>]>;
+declare const PasswordSchema: _sinclair_typebox.TString;
+declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
+type VerificationTargetType = Static<typeof TargetTypeSchema>;
+declare const VERIFICATION_TARGET_TYPES: readonly ["email", "phone"];
+declare const VerificationPurposeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">, _sinclair_typebox.TLiteral<"account_deletion">]>;
+type VerificationPurpose = Static<typeof VerificationPurposeSchema>;
+declare const VERIFICATION_PURPOSES: readonly ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"];
+
+/**
+ * @spfn/auth - Verification Service
+ *
+ * Handles OTP code generation, validation, and delivery
+ */
+
+interface SendVerificationCodeParams {
+    target: string;
+    targetType: VerificationTargetType;
+    purpose: VerificationPurpose;
+}
+interface SendVerificationCodeResult {
+    success: boolean;
+    expiresAt: string;
+}
+interface VerifyCodeParams {
+    target: string;
+    targetType: VerificationTargetType;
+    code: string;
+    purpose: VerificationPurpose;
+}
+interface VerifyCodeResult {
+    valid: boolean;
+    verificationToken: string;
+}
+/**
+ * Send verification code via email or SMS
+ */
+declare function sendVerificationCodeService(params: SendVerificationCodeParams): Promise<SendVerificationCodeResult>;
+/**
+ * Verify OTP code and return verification token
+ */
+declare function verifyCodeService(params: VerifyCodeParams): Promise<{
+    valid: boolean;
+    verificationToken: string;
+}>;
+
+/**
+ * @spfn/auth - Verified-Email Signup Service
+ *
+ * A signup where the address is proven before a password exists:
+ *
+ *   request  -> a one-time link is emailed
+ *   confirm  -> the link is exchanged for a short-lived password-setup session
+ *   password -> the account is created, the device registered, the user signed in
+ *
+ * The link token and the setup secret are bearer credentials, so neither is ever
+ * stored. Only their SHA-256 hashes are, and lookup is by hash. A database dump
+ * therefore yields nothing that can be presented to either step.
+ *
+ * The six-digit-code registration path is untouched and remains the default; this
+ * is a second entry point to the same account creation, not a replacement.
+ */
+
+interface RequestSignupLinkParams {
+    email: string;
+    returnPath?: string;
+}
+interface RequestSignupLinkResult {
+    success: boolean;
+    expiresAt: string;
+}
+/**
+ * Step 1 — issue a confirmation link for an address.
+ *
+ * Answers identically whether or not the address already has an account. When it
+ * does, the owner gets a notice instead of a usable link, through the same
+ * dedupe window the six-digit-code path uses.
+ *
+ * Requesting again is how a resend works: every live link for the address is
+ * superseded first, so the newest link is the only one that opens, and any setup
+ * session already opened from an older link dies with it.
+ *
+ * Neither branch sends mail: both hand it to `auth.link-mail`, so the answer
+ * costs the same database work whichever one ran. With no pg-boss initialised
+ * the mail still goes out on this request — see `lib/link-mail-delivery.ts`.
+ */
+declare function requestSignupLinkService(params: RequestSignupLinkParams): Promise<RequestSignupLinkResult>;
+interface ConfirmSignupLinkParams {
+    token: string;
+}
+interface ConfirmSignupLinkResult {
+    email: string;
+    returnPath: string | null;
+    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
+    setupSecret: string;
+    setupExpiresAt: string;
+}
+/**
+ * Step 2 — exchange a link for a password-setup session.
+ *
+ * Nothing binds the row to a device or a browser, which is what lets someone
+ * request the link on a laptop and open it on a phone.
+ */
+declare function confirmSignupLinkService(params: ConfirmSignupLinkParams): Promise<ConfirmSignupLinkResult>;
+interface CompleteSignupParams {
+    setupSecret?: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    metadata?: Record<string, unknown>;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+}
+/**
+ * Step 3 — set the password, which is what creates the account.
+ *
+ * Run under `Transactional()`: the user row, the device key and the completion
+ * mark commit together. A device-key failure must not leave an account nobody
+ * can sign into, and a completion mark must not survive a rolled-back account.
+ *
+ * A refusal that is the user's to fix — a weak password, an app policy that
+ * rejects the registration — leaves the setup session usable, so the fix is
+ * retyping the password rather than requesting a fresh email.
+ */
+declare function completeSignupService(params: CompleteSignupParams): Promise<RegisterResult>;
+
+/**
+ * @spfn/auth - Password Reset Service
+ *
+ * Getting back into an account whose password is gone, using the address the
+ * account already proved:
+ *
+ *   request  -> a one-time link is emailed
+ *   confirm  -> the link is exchanged for a short-lived password-setup session
+ *   complete -> the new password is written, everything else is signed out,
+ *               and the browser that reset is signed in on a fresh device key
+ *
+ * Mirrors the verified-email signup slice deliberately — same credentials, same
+ * hashing, same supersede-on-resend, same interceptor moves — with two
+ * differences that matter.
+ *
+ * First, the request answers identically for *every* input and sends mail only
+ * to an account that can be reset. Signup can afford to tell an existing owner
+ * "you already have an account"; a reset cannot send anything to a stranger's
+ * mailbox, because the mail itself would be the answer to "does this address
+ * have an account here".
+ *
+ * Second, completing it is a credential change on a live account, so it carries
+ * the same blast radius as `changePasswordService`: pending device
+ * authorizations are denied and every active key is revoked. Whoever was signed
+ * in on the old password is signed out, including the attacker the reset was
+ * needed for.
+ */
+
+interface RequestPasswordResetParams {
+    email: string;
+    returnPath?: string;
+}
+interface RequestPasswordResetResult {
+    success: boolean;
+    expiresAt: string;
+}
+/**
+ * Step 1 — issue a reset link for an address.
+ *
+ * Answers identically for every input: the same status, the same two fields, and
+ * an `expiresAt` computed the same way whether or not a row was written. An
+ * address with no account, an account that cannot be reset, and an account that
+ * can are indistinguishable to the caller — only the first of the three gets
+ * mail, and it goes to the owner.
+ *
+ * Requesting again is how a resend works: every live link for the account is
+ * superseded first, so the newest link is the only one that opens, and any setup
+ * session already opened from an older link dies with it.
+ *
+ * The eligible branch does not send the mail either — it hands it to
+ * `auth.link-mail` — so the two branches differ by a few database writes and not
+ * by a mail provider's round trip. With no pg-boss initialised the mail still
+ * goes out on this request; see `lib/link-mail-delivery.ts`.
+ */
+declare function requestPasswordResetService(params: RequestPasswordResetParams): Promise<RequestPasswordResetResult>;
+interface ConfirmPasswordResetParams {
+    token: string;
+}
+interface ConfirmPasswordResetResult {
+    email: string;
+    returnPath: string | null;
+    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
+    setupSecret: string;
+    setupExpiresAt: string;
+}
+/**
+ * Step 2 — exchange a link for a password-setup session.
+ *
+ * Nothing binds the row to a device or a browser, which is what lets someone ask
+ * for the link on a laptop and open it on a phone.
+ */
+declare function confirmPasswordResetService(params: ConfirmPasswordResetParams): Promise<ConfirmPasswordResetResult>;
+interface CompletePasswordResetParams {
+    setupSecret?: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
+}
+/**
+ * Step 3 — set the new password, which is what completes the reset.
+ *
+ * Run under `Transactional()`: the password, the revocations, the new device key
+ * and the completion mark commit together. A key registration that failed after
+ * the revoke-all would otherwise leave an account with a new password and
+ * nothing signed in.
+ *
+ * A refusal that is the user's to fix — a password the policy rejects, a body
+ * with no device key — leaves the setup session usable, so the fix is retyping
+ * the password rather than asking for a fresh email.
+ *
+ * The answer carries the binding fields, like every other path that starts a
+ * session. A reset on an account that opted in registers a bound key — 24 hours,
+ * renewable only by a passkey — and this route is on the sealing interceptor's
+ * list, so a body that did not say so would have the proxy seal a cookie
+ * believing the session unbound: no user-agent check for the life of that key,
+ * and a sign-out a day later instead of the renewal prompt.
+ */
+declare function completePasswordResetService(params: CompletePasswordResetParams): Promise<RegisterResult & LoginBindingFields>;
+
+/**
+ * @spfn/auth - Device Auth Service
+ *
+ * Device-code login: a device with no key on file yet shows a short code, the
+ * account owner types that code on a device that is already signed in, and the
+ * waiting device's key is registered on approval.
+ *
+ * There is no token to hand over. Every request in this system is signed by the
+ * calling device's own key, so "logging a device in" means one thing — getting
+ * its public key into `user_public_keys` under the right account. That is what
+ * the poll does, and it is why the poll returns exactly what `loginService`
+ * returns: from the client's side the two ways in are indistinguishable.
+ *
+ * | state ↓ op → | info | approve | deny | poll |
+ * | --- | --- | --- | --- | --- |
+ * | pending | device details | → approved | → denied | pending |
+ * | approved | AlreadyHandled | AlreadyHandled | AlreadyHandled | key registered, → consumed |
+ * | denied | AlreadyHandled | AlreadyHandled | AlreadyHandled | Denied |
+ * | consumed | NotFound | NotFound | NotFound | NotFound |
+ * | expired | Expired | Expired | Expired | Expired |
+ * | unknown | NotFound | NotFound | NotFound | NotFound |
+ *
+ * A global revocation — revoke-all, a password change, a deletion request —
+ * refuses the account's live records too, as `denied`, so they land in that row
+ * of the table. See `denyAllActiveByUserId`; the three callers are the three
+ * places that revoke every key at once.
+ */
+
+interface StartDeviceAuthParams {
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    /** Device label shown to the approver. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+}
+interface StartDeviceAuthResult {
+    /** Returned once. The waiting device polls with it; the server stores only its hash. */
+    deviceCode: string;
+    /** `XXXX-XXXX`, for the waiting device's screen and nowhere else. */
+    userCode: string;
+    expiresAtMillis: number;
+    /** Milliseconds the waiting device should wait between polls. */
+    intervalMillis: number;
+}
+interface DeviceAuthInfoParams {
+    userCode: string;
+}
+/** What the approver is shown about the device asking to be let in. */
+interface DeviceAuthInfoResult {
+    deviceName?: string;
+    /** One of `KEY_PLATFORM`, which is what the route accepts and the column stores. */
+    platform?: KeyPlatformType;
+    /** First bytes of the pending key's fingerprint, as the device list truncates it. */
+    fingerprintPrefix: string;
+    requestedAtMillis: number;
+    expiresAtMillis: number;
+}
+interface ApproveDeviceAuthParams {
+    userCode: string;
+    /** The approver, read from their session. Never from a request body. */
+    userId: number;
+}
+interface DenyDeviceAuthParams {
+    userCode: string;
+}
+interface PollDeviceAuthParams {
+    deviceCode: string;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. A waiting device polls the backend itself, so this is false there
+     * and the key it collects is unbound — which is what a device with no browser
+     * to run a WebAuthn ceremony in needs.
+     */
+    webProxy?: boolean;
+}
+/** Nobody has answered yet. Not an error — the waiting device waits. */
+interface DeviceAuthPendingResult {
+    status: 'pending';
+    intervalMillis: number;
+}
+/** Approved and spent: the key is registered and this is the login it produced. */
+type DeviceAuthApprovedResult = {
+    status: 'approved';
+} & LoginResult;
+type PollDeviceAuthResult = DeviceAuthPendingResult | DeviceAuthApprovedResult;
+/**
+ * Park a new device's key and hand back the codes it needs.
+ *
+ * The caller is unauthenticated by definition — this is what a device does before
+ * it has any way to prove anything — so nothing here is attributed to an account.
+ * The record gains an owner only when someone approves it.
+ */
+declare function startDeviceAuthService(params: StartDeviceAuthParams): Promise<StartDeviceAuthResult>;
+/**
+ * What the approver sees before deciding.
+ *
+ * This is the whole defence against being talked into approving someone else's
+ * device: the answer names the device that is waiting, so the person holding the
+ * phone can see that it is not theirs. An approval screen that showed only the
+ * code would be asking them to confirm a number they were just told.
+ */
+declare function getDeviceAuthInfoService(params: DeviceAuthInfoParams): Promise<DeviceAuthInfoResult>;
+/**
+ * Bind the record to the approving account.
+ *
+ * The key is not registered here. The waiting device may never come back, and a
+ * key registered for a device that stopped listening is a signing credential
+ * nobody asked for — so approval records the decision and the poll acts on it.
+ *
+ * Answers with the same device description `info` returns, so a client that let
+ * a user approve without looking first can still show them what they just let
+ * in — which is the moment someone talked into approving an attacker's device
+ * has to notice and revoke it.
+ */
+declare function approveDeviceAuthService(params: ApproveDeviceAuthParams): Promise<DeviceAuthInfoResult>;
+/**
+ * Refuse the record, so the waiting device is told no instead of timing out.
+ *
+ * Denying binds no user: the point of refusing is that the account owner wants
+ * nothing to do with the request.
+ */
+declare function denyDeviceAuthService(params: DenyDeviceAuthParams): Promise<void>;
+/**
+ * The waiting device asking whether anyone has answered.
+ *
+ * Approved is the one branch with a side effect, and it is a one-shot: the record
+ * is spent by a conditional update that names `approved`, so of two polls that
+ * arrive together exactly one registers the key. The loser matches nothing and is
+ * answered as if the code were unknown — which by then it is.
+ */
+declare function pollDeviceAuthService(params: PollDeviceAuthParams): Promise<PollDeviceAuthResult>;
+
 /**
  * @spfn/auth - Passkey Service
  *
@@ -953,6 +1118,11 @@ interface StartPasskeyEnrollmentParams {
 /**
  * Step 1 of enrollment — options for `navigator.credentials.create()`.
  *
+ * An enrolled account steps up first, and every account then meets the
+ * recent-authentication rule this route has always had (#95). The order is what
+ * makes the two independent: `assertStepUp` is a no-op for an unenrolled
+ * account, so the answer such a caller gets is byte-for-byte today's.
+ *
  * `excludeCredentials` lists the caller's **live** passkeys only, so the
  * authenticator quietly refuses one already enrolled here. Revoked ones are left
  * out on purpose: they must not be re-enrolled either, and the check that
@@ -1000,6 +1170,8 @@ interface FinishPasskeyLoginParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
 /**
  * Step 2 of sign-in — verify the assertion, then sign in exactly as a password
@@ -1040,8 +1212,10 @@ interface RevokePasskeyParams {
 /**
  * Retire a passkey.
  *
- * Gated on recent authentication, because someone who walked up to an unlocked
- * laptop should not be able to strip the account's credentials; and on the
+ * Gated on the second factor for an enrolled account, and then — for every
+ * account, enrolled or not — on recent authentication, because someone who
+ * walked up to an unlocked laptop should not be able to strip the account's
+ * credentials; and on the
  * last-recovery-credential guard, because there is no undo for the state that
  * would leave.
  *
@@ -1056,6 +1230,318 @@ declare function revokePasskeyService(params: RevokePasskeyParams): Promise<{
     passkeyId: string;
 }>;
 
+/**
+ * @spfn/auth - Second-Factor Verification Entity
+ *
+ * When each device last proved the account's second factor. One row per device
+ * key, which is what makes the step-up window mean "this device, recently"
+ * rather than "somebody, somewhere, recently".
+ *
+ * `key_id` is the primary key and a foreign key onto `user_public_keys.key_id`,
+ * so the row dies with the device it belongs to — a revoked key cannot leave a
+ * verification behind for the next key that reuses its id, and deleting an
+ * account takes these with it. A rotation is the one moment the row moves
+ * rather than dying: rotating is already proof of the same device, so
+ * `rotateKeyService` and the login rotation carry the verification across, or
+ * the window would silently expire every time the proxy rotated a key.
+ */
+/**
+ * Which credential satisfied the step-up.
+ *
+ * Recorded for the owner-facing audit an app may build on it, and for support:
+ * "recovery" is the one that should be rare, and an account stepping up with
+ * recovery codes repeatedly has lost its authenticator.
+ */
+declare const MFA_VERIFICATION_METHODS: readonly ["totp", "recovery", "passkey"];
+type MfaVerificationMethod = typeof MFA_VERIFICATION_METHODS[number];
+declare const mfaVerifications: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_verifications";
+    schema: string;
+    columns: {
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        method: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["totp", "recovery", "passkey"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "string enum";
+            data: "passkey" | "totp" | "recovery";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["totp", "recovery", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        verifiedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type MfaVerification = typeof mfaVerifications.$inferSelect;
+type NewMfaVerification = typeof mfaVerifications.$inferInsert;
+
+/**
+ * @spfn/auth - Second Factor Service
+ *
+ * An optional second step the owner enrols, that the package then asks for at
+ * the moments a stolen first credential would be used. Two forms: a TOTP
+ * authenticator app, or a passkey the owner already enrolled and has marked as
+ * satisfying a step-up. Ten single-use recovery codes come with either.
+ *
+ * The rule the whole feature hangs on is the one in `assertStepUp`: an account
+ * that never enrolled is answered exactly as it is today, on every route. That
+ * is why the enrolment check comes first and returns, before any passkey
+ * configuration is read and before any second query is made — an app with no
+ * passkeys configured must still be able to change a password.
+ *
+ * The step-up window is per **device key**, not per account: "this device
+ * proved the second factor recently" is the claim a sensitive change needs, and
+ * a verification made on a phone must not authorize a change from a laptop. A
+ * key rotation carries the row across, because rotating is already proof of the
+ * same device.
+ *
+ * A secret and a recovery code appear in exactly three response bodies —
+ * `totp/enroll`, `totp/confirm` and `recovery/regenerate` — and nowhere else:
+ * not in `status`, not in an event, and not in a log line.
+ */
+
+/**
+ * Does this account have a second factor at all?
+ *
+ * One statement (`repositories/mfa-enrolment.repository.ts`), because every
+ * sensitive route and every device registration asks it, including the
+ * overwhelming majority that will answer false.
+ */
+declare function mfaEnrolledForUser(userId: number): Promise<boolean>;
+interface AssertStepUpParams {
+    userId: number;
+    /** The device key this request is signed with — the window is its window. */
+    keyId: string;
+    /** Override the configured window. Callers needing a tighter one pass it. */
+    maxAgeMs?: number;
+}
+/**
+ * Refuse a sensitive change unless this device proved the second factor recently.
+ *
+ * **No-op for an account with no second factor.** That is the contract of the
+ * whole feature: `changePassword` and `revokeAllKeys` have no recency gate
+ * today, and adding one for people who never opted in would be a new refusal on
+ * routes that never had one. Two of the callers do have a gate of their own —
+ * the passkey routes' `assertRecentAuthentication` — and they still run it
+ * afterwards; this adds a rule for enrolled accounts rather than replacing one.
+ *
+ * The unenrolled path therefore costs one indexed lookup and touches no passkey
+ * configuration, which is what lets an app with no passkeys at all call it.
+ *
+ * @throws StepUpRequiredError when the account is enrolled and the window has passed
+ */
+declare function assertStepUp(params: AssertStepUpParams): Promise<void>;
+/**
+ * Carry a device's verification onto the key that replaces it.
+ *
+ * Called from the two rotation seams — `rotateKeyService`, and the `oldKeyId`
+ * rotation every login path runs through `registerPublicKeyService`. Without
+ * it the window would expire silently on every rotation, which the web proxy
+ * does at each login: a user who stepped up a minute ago would be asked again
+ * with nothing to connect it to.
+ */
+declare function carryStepUpVerification(userId: number, fromKeyId: string, toKeyId: string): Promise<void>;
+interface TotpEnrolmentResult {
+    /** The base32 secret, shown once. Never logged, never returned again. */
+    secret: string;
+    /** The same secret as the URI an authenticator app scans. */
+    otpauthUri: string;
+}
+/**
+ * Mint a secret and park it unconfirmed.
+ *
+ * Calling this twice replaces the unconfirmed row and its failure counter — a
+ * user who closed the app before scanning starts over, which is also the
+ * documented remedy for a row that spent its five confirm attempts. A
+ * **confirmed** enrolment is refused instead: replacing a working second factor
+ * is `disable` followed by a fresh enrolment, both step-up gated, so nobody
+ * holding only a stolen session can swap an authenticator for their own.
+ *
+ * @throws MfaAlreadyEnrolledError when a confirmed enrolment already exists
+ */
+declare function startTotpEnrolmentService(userId: number): Promise<TotpEnrolmentResult>;
+interface ConfirmTotpParams {
+    userId: number;
+    /** The device this enrolment is being confirmed from — it gets the first verification. */
+    keyId: string;
+    code: string;
+}
+interface ConfirmTotpResult {
+    /** The ten plaintext codes, shown once. */
+    recoveryCodes: string[];
+}
+/**
+ * Spend the first code, which is what turns an enrolment into a second factor.
+ *
+ * Five wrong codes delete the unconfirmed row: at that point the person is
+ * reading the wrong entry in their app, and a fresh `enroll` is both the remedy
+ * and what resets the counter. A confirmed row is never deleted this way.
+ *
+ * The route deliberately runs this outside a transaction, so the counter
+ * survives the refusal that raised it; the success path opens its own, because
+ * the confirmation, the first verification and the recovery codes have to
+ * commit together or not at all.
+ *
+ * @throws MfaNotEnrolledError | MfaVerificationFailedError
+ */
+declare function confirmTotpEnrolmentService(params: ConfirmTotpParams): Promise<ConfirmTotpResult>;
+/**
+ * Replace the account's recovery codes, retiring every earlier one.
+ *
+ * The old generation's rows stay, unspent and unreachable: a code written down
+ * last year is refused with the same body as one that never existed, and the
+ * record of which generation a spent code came from survives.
+ *
+ * @throws MfaNotEnrolledError on an account with no second factor
+ */
+declare function regenerateRecoveryCodesService(userId: number): Promise<{
+    recoveryCodes: string[];
+}>;
+/**
+ * Take the second factor off the account entirely.
+ *
+ * Idempotent: an account with nothing enrolled is a success, because "make sure
+ * MFA is off" has already happened. The passkeys themselves are untouched —
+ * only their second-factor marks go, since a credential that signs the owner in
+ * is not something this route may remove.
+ */
+declare function disableMfaService(userId: number): Promise<void>;
+interface MarkPasskeyParams {
+    userId: number;
+    passkeyId: string;
+    secondFactor: boolean;
+}
+/**
+ * Mark or unmark one of the caller's passkeys as their second factor.
+ *
+ * Unmarking the last one is allowed, and leaves the account unenrolled. It is
+ * deliberately independent of `assertNotLastRecoveryCredential`, which guards
+ * `passkeys/revoke`: that rule protects a way *into* the account, and a
+ * second-factor mark is not one — the credential still signs the owner in
+ * afterwards, unchanged.
+ *
+ * @throws PasskeyNotFoundError for a credential that is not theirs, or revoked
+ */
+declare function markPasskeySecondFactorService(params: MarkPasskeyParams): Promise<MfaStatus>;
+/** What the account surface shows about the second factor. No secret is in it. */
+interface MfaStatus {
+    enrolled: boolean;
+    /** Which second factors are live: `'totp'`, `'passkey'`, or both. */
+    methods: ('totp' | 'passkey')[];
+    /** Unspent codes of the current generation, for the "2 left" warning. */
+    recoveryCodesRemaining: number;
+}
+/**
+ * The account's second-factor state.
+ *
+ * Carries no secret, no otpauth URI and no recovery code — only the counts and
+ * names an account screen needs. An unconfirmed enrolment is not a method: it
+ * gates nothing, so reporting it would tell the owner they are protected when
+ * they are not.
+ */
+declare function mfaStatusService(userId: number): Promise<MfaStatus>;
+/**
+ * Options for a step-up by passkey assertion.
+ *
+ * `allowCredentials` is empty, as it is for a sign-in and for the same reason
+ * (D3): the discoverable credential on the device names itself, and the owner
+ * and the second-factor mark are checked when the assertion comes back. The
+ * challenge is minted with kind `'mfa'` and this account's id, so it cannot be
+ * presented to `passkeys/login/verify` and a sign-in challenge cannot be
+ * presented here.
+ */
+declare function startStepUpService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
+interface StepUpParams {
+    userId: number;
+    /** The device the verification is recorded against. */
+    keyId: string;
+    code?: string;
+    recoveryCode?: string;
+    response?: AuthenticationResponseJSON;
+}
+/**
+ * Re-prove the second factor on this device, refreshing its window.
+ *
+ * The escape hatch the exempt registration channels need: a device-code
+ * approval and a passkey sign-in register a key with no verification against
+ * it, by design, so the session they create would otherwise fail every
+ * sensitive change with no way forward.
+ *
+ * @throws ValidationError when the body names none or more than one input
+ * @throws MfaNotEnrolledError | MfaVerificationFailedError
+ */
+declare function stepUpService(params: StepUpParams): Promise<void>;
+/**
+ * Check exactly one of the three proofs, and say which one it was.
+ *
+ * Exactly one: two inputs in a body is a caller trying combinations, and none
+ * is a malformed request. Neither is a failed verification, so both are a 400
+ * rather than the uniform 401 a wrong proof gets.
+ *
+ * @throws ValidationError | MfaVerificationFailedError
+ */
+declare function verifySecondFactor(params: StepUpParams): Promise<MfaVerificationMethod>;
+/**
+ * Drop enrolments nobody ever confirmed.
+ *
+ * A secret handed out and abandoned is a credential sitting in a table doing
+ * nothing; a day is long enough for anyone who meant to finish.
+ *
+ * @returns number of rows deleted
+ */
+declare function sweepUnconfirmedMfaService(): Promise<{
+    deleted: number;
+}>;
+
 /**
  * Auth provider type
  *
@@ -1070,10 +1556,16 @@ declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TL
  * - OAuth 기존 사용자 로그인 시
  * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
  *
+ * `mfaEnrolled` is computed as the event is emitted (#95) and is the whole of
+ * the package's opinion about the second factor: it never blocks an account
+ * that has none, and this is the hook an app uses to offer enrolment at a first
+ * login. It says nothing about *which* factor and carries no secret.
+ *
  * @example
  * ```typescript
  * authLoginEvent.subscribe(async (payload) => {
  *     await analytics.trackLogin(payload.userId, payload.provider);
+ *     if (!payload.mfaEnrolled) await suggestSecondFactor(payload.userId);
  * });
  * ```
  */
@@ -1081,7 +1573,8 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device" | "passkey";
+    provider: "email" | "phone" | "passkey" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device";
+    mfaEnrolled: boolean;
 }>;
 /**
  * Where a device key was registered — the door the new device came through.
@@ -1092,15 +1585,15 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
  * both arrive at `createVerifiedAccount`, so the two name themselves there;
  * `'invitation'` is the one path that stores a key without the key service.
  */
-declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">]>;
-/** The nine doors a device key is registered through. */
+declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"renewal">]>;
+/** The ten doors a device key is registered through. */
 type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
 /**
  * auth.device.registered — a new device key was added to an account
  *
  * 발행 시점:
  * - a key row was created for an account and the transaction that created it
- *   committed, on every one of the nine channels above
+ *   committed, on every one of the ten channels above
  *
  * This is the notice an account owner needs and could not get before: a stolen
  * password used to sign in on a new device was silent, because a login event
@@ -1116,6 +1609,10 @@ type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
  * Neither the full fingerprint nor the public key is carried. The prefix is
  * enough to point at one entry of `listKeys`, which is what a notice needs.
  *
+ * `mfaEnrolled` is computed as the event is emitted (#95), so a notice about a
+ * new device can also be the moment an app offers a second factor to the
+ * accounts that have none.
+ *
  * @example
  * ```typescript
  * authDeviceRegisteredEvent.subscribe(async ({ userId, deviceName, ip, channel }) => {
@@ -1133,7 +1630,8 @@ declare const authDeviceRegisteredEvent: _spfn_core_event.EventDef<{
     userId: string;
     fingerprintPrefix: string;
     createdAtMillis: number;
-    channel: "password" | "register" | "oauth-native" | "oauth" | "invitation" | "signup-link" | "password-reset" | "passkey" | "device-code";
+    mfaEnrolled: boolean;
+    channel: "password" | "register" | "passkey" | "oauth-native" | "renewal" | "oauth" | "invitation" | "signup-link" | "password-reset" | "device-code";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -1338,6 +1836,18 @@ interface RegisterPublicKeyParams {
     ip?: string;
     /** `user-agent` of the registering request, already truncated. */
     userAgent?: string;
+    /**
+     * Whether this key is bound to a passkey, as the registering path decided.
+     *
+     * Decided by the caller from two facts it is the only one holding: the
+     * owner's `session_binding` setting, and whether `proxy-guard` recognised the
+     * request as coming through the trusted Next.js proxy (`decideKeyBinding`).
+     * Never read off a request body, and `platform` is not consulted — that field
+     * is display-only, usually absent on a proxy-made key, and a native client
+     * may declare `'web'` freely. Omitted means `'none'`, which is what every
+     * path that has no opinion gets.
+     */
+    binding?: SessionBindingType;
     /**
      * The key this one replaces on the same device, when a revocation actually
      * happened. Its presence is what makes this a rotation rather than a new
@@ -1426,6 +1936,28 @@ interface KeySummary {
     registeredIp?: string;
     /** `user-agent` of the registering request, on the same terms as above. */
     registeredUserAgent?: string;
+    /**
+     * `'passkey'` when this key is bound to one, absent when it is not.
+     *
+     * Absent rather than `'none'`, so a deployment where nobody opted in answers
+     * exactly the list it always did, and so every consumer reads "unbound" the
+     * same way it reads it off a sign-in response.
+     */
+    binding?: SessionBindingType;
+    /**
+     * When this key was last seen from two client addresses inside the
+     * concurrent-use window, absent when that has never been observed.
+     *
+     * A signal for the owner, not a refusal: addresses change legitimately, so
+     * nothing is blocked by it and a device list that shows it is telling someone
+     * to look rather than telling them something happened. The addresses
+     * themselves are never returned.
+     *
+     * Only meaningful where proxy-guard is configured. Without it every web
+     * request carries the Next.js server's own address, so two browsers on two
+     * continents share one and this never fires.
+     */
+    concurrentUseAtMillis?: number;
 }
 interface ListKeysParams {
     userId: number;
@@ -1434,6 +1966,20 @@ interface ListKeysParams {
 }
 /** How much of the fingerprint the list returns. */
 declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
+/**
+ * What a registration settled on, for the caller that has to tell the browser.
+ *
+ * The sign-in paths put these two into their `LoginResult`, the Next.js proxy
+ * copies them into the sealed cookie, and that is the whole carrier by which the
+ * proxy learns a session is bound and when its key runs out. Returned rather than
+ * looked up again: the row was just written (or just read), so a second query
+ * would be a second answer to a question already settled.
+ */
+interface RegisteredKeyBinding {
+    binding: SessionBindingType;
+    /** null only for a key registered before expiry was stamped at all. */
+    expiresAt: Date | null;
+}
 /**
  * Register a new public key for a user
  *
@@ -1446,7 +1992,7 @@ declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
  * @throws InvalidKeyFingerprintError fingerprint가 publicKey와 맞지 않을 때
  * @throws KeyAlgorithmMismatchError 키의 SPKI 타입이 선언된 algorithm과 다를 때
  */
-declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<void>;
+declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<RegisteredKeyBinding>;
 /**
  * Rotate user's public key (revoke old, register new)
  *
@@ -1804,6 +2350,8 @@ interface OAuthCallbackParams {
     ip?: string;
     /** `user-agent` of the callback request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
 interface OAuthCallbackResult {
     redirectUrl: string;
@@ -1905,6 +2453,13 @@ interface OAuthNativeParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. Accepted because every registering route spreads the whole
+     * provenance, and read by nothing: a native sign-in never produces a bound
+     * key — see the note at the registration below.
+     */
+    webProxy?: boolean;
     /** Apple은 첫 로그인에만 이름을 별도로 주므로 클라이언트가 전달할 수 있다. */
     profile?: {
         name?: string;
@@ -2056,6 +2611,110 @@ declare function revokeOAuth2GrantService(id: number, userId: number): Promise<v
  */
 declare function revokeAllOAuth2GrantsForUser(userId: number): Promise<void>;
 
+/**
+ * @spfn/auth - Session Binding Service
+ *
+ * The opt-in from #97: an account says its web sessions should run on a key that
+ * expires in hours and can only be renewed by a fresh WebAuthn assertion. A
+ * session cookie copied off that machine — out of a browser profile, out of
+ * DevTools, by malware — still signs like the original until that key runs out,
+ * and then stops, because the copy cannot produce the assertion.
+ *
+ * Three rules shape this file.
+ *
+ * It can only be turned on where the backend can recognise the trusted Next.js
+ * proxy. `clientType` is that recognition and `proxy-guard` is what sets it;
+ * without it every key would be registered unbound and the setting would be a
+ * switch that reports success and protects nothing, so the request is refused as
+ * the configuration error it is.
+ *
+ * Turning it *off* is the privileged direction, which is the reverse of the
+ * usual posture. `assertRecentAuthentication` is satisfied by the age of the
+ * device key this request is signed with — and a cookie copied in the ten
+ * minutes after a sign-in carries exactly that. So leaving `'passkey'` asks for
+ * a credential the copy does not hold: a renewal-grade assertion, or the account
+ * password.
+ *
+ * Enabling twice is idempotent. Recomputing the expiry on a repeat call would
+ * make this route a way to extend a bound key without presenting anything, which
+ * is the thing the short life exists to prevent.
+ */
+
+/** What every one of the three reads and writes here answers with. */
+interface SessionBindingResult {
+    mode: SessionBindingType;
+    /**
+     * When the key this request is signed with expires, for a bound session.
+     *
+     * Absent when the account is unbound, and absent for a bound account asking
+     * from a key that is not itself bound — a native client, say, whose key was
+     * registered on a channel the proxy never touched. The response is the input
+     * the Next.js interceptor re-seals the cookie from, so it describes this
+     * session rather than the account.
+     */
+    keyExpiresAtMillis?: number;
+}
+interface SessionBindingParams {
+    userId: number;
+    /** The device key this request is signed with — the one binding is applied to. */
+    keyId: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy. */
+    webProxy?: boolean;
+}
+interface DisableSessionBindingParams extends SessionBindingParams {
+    /** A renewal-grade assertion, from `binding/disable/options`. */
+    response?: AuthenticationResponseJSON;
+    /** The account password, for a browser with no passkey to hand. */
+    currentPassword?: string;
+}
+/** What binding is on this account, and when this session's key runs out. */
+declare function getSessionBindingService(params: SessionBindingParams): Promise<SessionBindingResult>;
+/**
+ * The binding facts of one key, by key id alone.
+ *
+ * For `/_auth/oauth/finalize`, which is the one sealing path with no session and
+ * no `LoginResult` to read them off: the browser arrives at the callback page
+ * holding a key id the OAuth state minted, and the interceptor seals a session
+ * from the answer. Reflecting the caller's own claim about binding would let a
+ * caller ask for an unbound cookie over a bound key, so the row is read instead.
+ *
+ * Scoped by key id and nothing else. The id is a server-minted UUID that only
+ * ever travelled inside the sealed state, so a caller who holds one holds it
+ * because the flow gave it to them; adding the caller's own `userId` to the
+ * lookup would make the answer vary by a second guessable value without
+ * withholding anything from someone who already has the first.
+ */
+declare function keySessionBindingService(keyId: string): Promise<{
+    sessionBinding?: SessionBindingType;
+    keyExpiresAtMillis?: number;
+}>;
+/**
+ * Turn session binding on, and bind the key this request is signed with.
+ *
+ * The current key is bound here rather than only at the next sign-in, because
+ * otherwise the setting would not apply to the session that asked for it until
+ * the person signed in again — and the response is what tells the Next.js proxy
+ * to re-seal the cookie with the new expiry, so the browser and the key row
+ * agree from this moment on.
+ *
+ * @throws SessionBindingUnavailableError proxy-guard가 설정되지 않은 배포일 때
+ * @throws ValidationError 살아 있는 패스키가 하나도 없을 때
+ * @throws RecentAuthenticationRequiredError 최근 인증이 없을 때
+ */
+declare function enableSessionBindingService(params: SessionBindingParams): Promise<SessionBindingResult>;
+/**
+ * Turn session binding off, once the caller has proved they are still the owner.
+ *
+ * Every bound key returns to an ordinary ninety-day life in the same call. A row
+ * left marked `'passkey'` would keep expiring in hours with nothing left to
+ * renew it, which is the state the person just asked not to be in.
+ *
+ * @throws RecentAuthenticationRequiredError 새 자격증명 없이 껐을 때
+ */
+declare function disableSessionBindingService(params: DisableSessionBindingParams): Promise<SessionBindingResult>;
+/** The challenge the disabling ceremony signs. Same ceremony renewal uses. */
+declare function startSessionBindingDisableService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
+
 /**
  * @spfn/auth - Main Router
  *
@@ -2163,7 +2822,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
-    }, RegisterResult>;
+    }, RegisterResult & LoginBindingFields>;
     login: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -2201,6 +2860,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     } | {
         email?: string | undefined;
         phone?: string | undefined;
+        sessionBinding?: "none" | "passkey" | undefined;
+        keyExpiresAtMillis?: number | undefined;
         status: "approved";
         userId: string;
         publicId: string;
@@ -2272,6 +2933,39 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         passkeyId: string;
     }>;
+    mfaTotpEnroll: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, TotpEnrolmentResult>;
+    mfaTotpConfirm: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TString;
+        }>;
+    }, {}, ConfirmTotpResult>;
+    mfaDisable: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, void>;
+    mfaMarkPasskey: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            passkeyId: _sinclair_typebox.TString;
+            secondFactor: _sinclair_typebox.TBoolean;
+        }>;
+    }, {}, MfaStatus>;
+    mfaRegenerateRecoveryCodes: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, {
+        recoveryCodes: string[];
+    }>;
+    mfaStatus: _spfn_core_route.RouteDef<{}, {}, MfaStatus>;
+    mfaStepUp: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            recoveryCode: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            response: _sinclair_typebox.TOptional<_sinclair_typebox.TUnknown>;
+        }>;
+    }, {}, void>;
+    mfaStepUpOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
     rotateKey: _spfn_core_route.RouteDef<{}, {
         body: _sinclair_typebox.TObject<{
@@ -2344,6 +3038,32 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         phoneVerified: boolean;
         hasPassword: boolean;
     }>;
+    setSessionBinding: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            mode: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"none">]>;
+            response: _sinclair_typebox.TOptional<_sinclair_typebox.TUnknown>;
+            currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, SessionBindingResult>;
+    getSessionBinding: _spfn_core_route.RouteDef<{}, {}, SessionBindingResult>;
+    sessionBindingDisableOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewVerify: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            response: _sinclair_typebox.TUnknown;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>>;
+        }>;
+    }, SessionRenewResult>;
     issueOneTimeToken: _spfn_core_route.RouteDef<{}, {}, IssueOneTimeTokenResult>;
     requestAccountDeletion: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
@@ -2399,398 +3119,797 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         authUrl: string;
     }>;
-    oauthFinalize: _spfn_core_route.RouteDef<{
+    oauthFinalize: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userId: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        sessionBinding?: SessionBindingType;
+        keyExpiresAtMillis?: number;
+        success: boolean;
+        userId: string;
+        keyId: string;
+        returnUrl: string;
+    }>;
+    oauthProviderStart: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            state: _sinclair_typebox.TString;
+        }>;
+    }, {}, Response>;
+    oauthProviderCallback: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, Response>;
+    getProviderOAuthUrl: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        authUrl: string;
+    }>;
+    oauthNative: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
+            idToken: _sinclair_typebox.TString;
+            nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+            profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
+                name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            }>>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+        }>;
+    }, {}, OAuthNativeResult>;
+    oauthUnlinkNotify: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
+    oauthUnlinkNotifyGet: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
+    getInvitation: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        email: string;
+        role: string;
+        roleDisplayName: string;
+        invitedBy: string;
+        expiresAt: string;
+        metadata: Record<string, any> | undefined;
+    }>;
+    acceptInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+            password: _sinclair_typebox.TString;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+        }>;
+    }, {
+        userId: number;
+        email: string;
+        role: string;
+    }>;
+    createInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            email: _sinclair_typebox.TString;
+            roleId: _sinclair_typebox.TNumber;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            expiresAt: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TAny>;
+        }>;
+    }, {}, {
+        id: number;
+        email: string;
+        token: string;
+        roleId: number;
+        expiresAt: string;
+        invitationUrl: string;
+    }>;
+    listInvitations: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            status: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"pending" | "accepted" | "expired" | "cancelled">[]>>;
+            page: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            limit: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        }>;
+    }, {}, {
+        invitations: {
+            id: number;
+            email: string;
+            token: string;
+            roleId: number;
+            invitedBy: number;
+            status: "pending" | "accepted" | "expired" | "cancelled";
+            expiresAt: Date;
+            acceptedAt: Date | null;
+            cancelledAt: Date | null;
+            metadata: Record<string, any> | null;
+            createdAt: Date;
+            updatedAt: Date;
+            role: {
+                id: number;
+                name: string;
+                displayName: string;
+            };
+            inviter: {
+                id: number;
+                email: string | null;
+            };
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+        totalPages: number;
+    }>;
+    cancelInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+            reason: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        cancelledAt: string;
+    }>;
+    resendInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        }>;
+    }, {}, {
+        expiresAt: string;
+    }>;
+    deleteInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+        }>;
+    }, {}, void>;
+    getUserProfile: _spfn_core_route.RouteDef<{}, {}, UserProfile>;
+    updateUserProfile: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            firstName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            lastName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            avatarUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            bio: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            locale: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            timezone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            dateOfBirth: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            gender: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            website: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            location: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            company: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            jobTitle: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TAny>>;
+        }>;
+    }, {}, ProfileInfo>;
+    checkUsername: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            username: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        available: boolean;
+    }>;
+    updateUsername: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            username: _sinclair_typebox.TUnion<[_sinclair_typebox.TString, _sinclair_typebox.TNull]>;
+        }>;
+    }, {}, {
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    updateLocale: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            locale: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        locale: string;
+    }>;
+    listRoles: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            includeInactive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        roles: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        }[];
+    }>;
+    createAdminRole: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            userId: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            name: _sinclair_typebox.TString;
+            displayName: _sinclair_typebox.TString;
+            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            permissionIds: _sinclair_typebox.TOptional<_sinclair_typebox.TArray<_sinclair_typebox.TNumber>>;
         }>;
     }, {}, {
-        success: boolean;
-        userId: string;
-        keyId: string;
-        returnUrl: string;
+        role: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        };
     }>;
-    oauthProviderStart: _spfn_core_route.RouteDef<{
+    updateAdminRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            id: _sinclair_typebox.TNumber;
         }>;
-        query: _sinclair_typebox.TObject<{
-            state: _sinclair_typebox.TString;
+        body: _sinclair_typebox.TObject<{
+            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            isActive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
         }>;
-    }, {}, Response>;
-    oauthProviderCallback: _spfn_core_route.RouteDef<{
+    }, {}, {
+        role: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        };
+    }>;
+    deleteAdminRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
-        }>;
-        query: _sinclair_typebox.TObject<{
-            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            id: _sinclair_typebox.TNumber;
         }>;
-    }, {}, Response>;
-    getProviderOAuthUrl: _spfn_core_route.RouteDef<{
+    }, {}, void>;
+    updateUserRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            userId: _sinclair_typebox.TNumber;
         }>;
         body: _sinclair_typebox.TObject<{
-            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            roleId: _sinclair_typebox.TNumber;
         }>;
     }, {}, {
-        authUrl: string;
+        userId: number;
+        roleId: number;
     }>;
-    oauthNative: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
-        }>;
+    issueOpsToken: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            idToken: _sinclair_typebox.TString;
-            nonce: _sinclair_typebox.TString;
-            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            publicKey: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            fingerprint: _sinclair_typebox.TString;
-            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
-            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
-            profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
-                name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            }>>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+            name: _sinclair_typebox.TString;
+            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
         }>;
-    }, {}, OAuthNativeResult>;
-    oauthUnlinkNotify: _spfn_core_route.RouteDef<{
+    }, {}, {
+        token: string;
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
+    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
+        opsTokens: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        }[];
+    }>;
+    revokeOpsToken: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            id: _sinclair_typebox.TNumber;
         }>;
-    }, {}, void | Response>;
-    oauthUnlinkNotifyGet: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+    }, {}, {
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
+    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
+    getOAuth2Authorize: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
-    }, {}, void | Response>;
-    getInvitation: _spfn_core_route.RouteDef<{
+    }, {}, OAuth2ConsentView>;
+    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            approve: _sinclair_typebox.TBoolean;
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, OAuth2AuthorizationCodeIssued>;
+    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
+    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
+    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
+        grants: OAuth2GrantSummary[];
+    }>;
+    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            token: _sinclair_typebox.TString;
+            id: _sinclair_typebox.TNumber;
         }>;
     }, {}, {
-        email: string;
-        role: string;
-        roleDisplayName: string;
-        invitedBy: string;
-        expiresAt: string;
-        metadata: Record<string, any> | undefined;
+        revoked: boolean;
     }>;
-    acceptInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            token: _sinclair_typebox.TString;
-            password: _sinclair_typebox.TString;
+    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
+}>;
+
+/**
+ * @spfn/auth - User Public Keys Entity
+ *
+ * Stores client-generated public keys for JWT verification
+ * Supports key rotation and multi-key management per user
+ */
+/**
+ * User Public Keys Table
+ * Each user can have multiple public keys (for rotation)
+ */
+declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_public_keys";
+    schema: string;
+    columns: {
+        id: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {
-        body: _sinclair_typebox.TObject<{
-            publicKey: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            fingerprint: _sinclair_typebox.TString;
-            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {
-        userId: number;
-        email: string;
-        role: string;
-    }>;
-    createInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            email: _sinclair_typebox.TString;
-            roleId: _sinclair_typebox.TNumber;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            expiresAt: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TAny>;
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        publicKey: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        id: number;
-        email: string;
-        token: string;
-        roleId: number;
-        expiresAt: string;
-        invitationUrl: string;
-    }>;
-    listInvitations: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            status: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"pending" | "accepted" | "expired" | "cancelled">[]>>;
-            page: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            limit: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        algorithm: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ES256" | "RS256";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ES256", "RS256"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        invitations: {
-            id: number;
-            email: string;
-            token: string;
-            roleId: number;
-            invitedBy: number;
-            status: "pending" | "accepted" | "expired" | "cancelled";
-            expiresAt: Date;
-            acceptedAt: Date | null;
-            cancelledAt: Date | null;
-            metadata: Record<string, any> | null;
-            createdAt: Date;
-            updatedAt: Date;
-            role: {
-                id: number;
-                name: string;
-                displayName: string;
-            };
-            inviter: {
-                id: number;
-                email: string | null;
-            };
-        }[];
-        total: number;
-        page: number;
-        limit: number;
-        totalPages: number;
-    }>;
-    cancelInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
-            reason: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        cancelledAt: string;
-    }>;
-    resendInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        deviceName: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        expiresAt: string;
-    }>;
-    deleteInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+        platform: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ios" | "android" | "web" | "desktop";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, void>;
-    getUserProfile: _spfn_core_route.RouteDef<{}, {}, UserProfile>;
-    updateUserProfile: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            firstName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            lastName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            avatarUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            bio: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            locale: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            timezone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            dateOfBirth: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            gender: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            website: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            location: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            company: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            jobTitle: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TAny>>;
+        registeredIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, ProfileInfo>;
-    checkUsername: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            username: _sinclair_typebox.TString;
+        registeredUserAgent: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        available: boolean;
-    }>;
-    updateUsername: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            username: _sinclair_typebox.TUnion<[_sinclair_typebox.TString, _sinclair_typebox.TNull]>;
+        registeredUaFamily: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        deletedAt: Date | null;
-        deletedBy: string | null;
-        createdAt: Date;
-        updatedAt: Date;
-        id: number;
-        publicId: string;
-        email: string | null;
-        phone: string | null;
-        username: string | null;
-        passwordHash: string | null;
-        passwordChangeRequired: boolean;
-        roleId: number;
-        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
-        emailVerifiedAt: Date | null;
-        phoneVerifiedAt: Date | null;
-        keyEpoch: number;
-        lastLoginAt: Date | null;
-    }>;
-    updateLocale: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            locale: _sinclair_typebox.TString;
+        lastSeenIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        locale: string;
-    }>;
-    listRoles: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            includeInactive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        lastSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        roles: {
-            description: string | null;
+        concurrentUseAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        }[];
-    }>;
-    createAdminRole: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            name: _sinclair_typebox.TString;
-            displayName: _sinclair_typebox.TString;
-            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            permissionIds: _sinclair_typebox.TOptional<_sinclair_typebox.TArray<_sinclair_typebox.TNumber>>;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        role: {
-            description: string | null;
+        binding: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["none", "passkey"] & [string, ...string[]]>>>, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        };
-    }>;
-    updateAdminRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "none" | "passkey";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-        body: _sinclair_typebox.TObject<{
-            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            isActive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        clientKind: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["web", "ios", "android"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ios" | "android" | "web";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["web", "ios", "android"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        role: {
-            description: string | null;
+        clientVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        };
-    }>;
-    deleteAdminRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, void>;
-    updateUserRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            userId: _sinclair_typebox.TNumber;
+        clientContractVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-        body: _sinclair_typebox.TObject<{
-            roleId: _sinclair_typebox.TNumber;
+        clientSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        userId: number;
-        roleId: number;
-    }>;
-    issueOpsToken: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            name: _sinclair_typebox.TString;
-            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
+        isActive: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        token: string;
-        opsToken: {
-            id: number;
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        };
-    }>;
-    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
-        opsTokens: {
-            id: number;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        }[];
-    }>;
-    revokeOpsToken: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        opsToken: {
-            id: number;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        };
-    }>;
-    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
-    getOAuth2Authorize: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            client_id: _sinclair_typebox.TString;
-            redirect_uri: _sinclair_typebox.TString;
-            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, OAuth2ConsentView>;
-    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            approve: _sinclair_typebox.TBoolean;
-            client_id: _sinclair_typebox.TString;
-            redirect_uri: _sinclair_typebox.TString;
-            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, OAuth2AuthorizationCodeIssued>;
-    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
-    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
-    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
-        grants: OAuth2GrantSummary[];
-    }>;
-    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        revoked: boolean;
-    }>;
-    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
+    };
+    dialect: "pg";
 }>;
+type UserPublicKey = typeof userPublicKeys.$inferSelect;
+type NewUserPublicKey = typeof userPublicKeys.$inferInsert;
 
 /**
  * The auth-profile registry the authenticate middleware dispatches on.
@@ -2931,6 +4050,46 @@ declare module 'hono' {
         auth: AuthContext;
     }
 }
+/** Why a Bearer credential was not admitted, in the order the steps run. */
+type BearerRefusal = 'absent' | 'machine' | 'undecodable' | 'unknown' | 'expired' | 'token-expired' | 'bad-signature' | 'unverifiable';
+/** What a Bearer credential resolved to: the key row it named, or why not. */
+type BearerOutcome = {
+    key: UserPublicKey;
+} | {
+    refused: BearerRefusal;
+};
+/**
+ * Admit the Bearer credential on this request, or say what stopped it.
+ *
+ * The one lookup-and-verify path every Bearer middleware takes — header, machine
+ * discriminator, decode, key row, expiry, signature — kept in one place because
+ * the order is itself a rule: a machine credential never reaches a decode, and a
+ * key row is found before its signature is checked so that an unknown key and a
+ * forged one cost the same work.
+ *
+ * It answers rather than throws, which is what lets two middlewares share it.
+ * `authenticate` turns each refusal into the error that step has always
+ * answered with; `authenticateForRenewal` turns every one of them into a single
+ * refusal, so a caller holding no private key cannot tell a live key id from a
+ * dead one. A shared step that threw would have to be unwound to get there.
+ *
+ * @param c - the Hono context of the request being authenticated
+ * @param admitsExpired - whether a key past its `expiresAt` may still be
+ *   admitted. Renewal is the only caller that says yes, and only for a bound key
+ *   inside its grace.
+ */
+declare function admitBearerKey(c: Context, admitsExpired: (key: UserPublicKey) => boolean): Promise<BearerOutcome>;
+/**
+ * The principal a verified Bearer key resolves to.
+ *
+ * The one place the Bearer path builds an `AuthContext`, so that a middleware
+ * added beside `authenticate` cannot invent a second shape of it.
+ */
+declare function bearerAuthContext(keyId: string, resolved: {
+    user: User;
+    role: string | null;
+    locale: string;
+}): AuthContext;
 /**
  * Authentication middleware
  *
@@ -3084,4 +4243,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { type DenyDeviceAuthParams as $, type AuthInitOptions as A, type AuthDeletionRequestedPayload as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type AuthDeviceRegisteredPayload as E, type FinishPasskeyEnrollmentResult as F, type AuthLoginPayload as G, type AuthPasswordResetPayload as H, type IssueOneTimeTokenResult as I, type AuthProfileOutcome as J, type KeySummary as K, type LoginResult as L, type AuthProfileVerifier as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, AuthProviderSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type AuthRegisterPayload as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type ChangePasswordParams as W, type CompletePasswordResetParams as X, type CompleteSignupParams as Y, type ConfirmPasswordResetParams as Z, type ConfirmSignupLinkParams as _, type RegisterResult as a, assertRecentAuthentication as a$, type DeviceAuthApprovedResult as a0, type DeviceAuthInfoParams as a1, type DeviceAuthPendingResult as a2, DeviceAuthPollResponseSchema as a3, DeviceNameSchema as a4, type DeviceRegistrationChannel as a5, EmailSchema as a6, FingerprintSchema as a7, type FinishPasskeyEnrollmentParams as a8, type FinishPasskeyLoginParams as a9, type PollDeviceAuthResult as aA, PublicKeySchema as aB, type RecentAuthenticationParams as aC, type RegisterParams as aD, type RegisterPublicKeyParams as aE, type RenamePasskeyParams as aF, type RequestPasswordResetParams as aG, type RequestSignupLinkParams as aH, type RevokeAllKeysParams as aI, type RevokeKeyParams as aJ, type RevokePasskeyParams as aK, type RotateKeyParams as aL, type SendVerificationCodeParams as aM, type StartDeviceAuthParams as aN, type StartPasskeyEnrollmentParams as aO, TargetTypeSchema as aP, type UnlinkNotification as aQ, UnlinkNotifyRejection as aR, type UnlinkNotifyRequest as aS, type UnlinkNotifyResult as aT, UserCodeSchema as aU, VerificationPurposeSchema as aV, type VerifyCodeParams as aW, type VerifyCodeResult as aX, approveDeviceAuthService as aY, approveOAuth2AuthorizeService as aZ, assertNotLastRecoveryCredential as a_, type InvitationAcceptedPayload as aa, type InvitationCreatedPayload as ab, KEY_FINGERPRINT_PREFIX_LENGTH as ac, KeyIdSchema as ad, type LoginParams as ae, type LogoutParams as af, type MachinePrincipal as ag, type MachineVerifierRegistration as ah, type NativeVerifyOptions as ai, type NormalizedIdentity as aj, type OAuth2AuthorizeParams as ak, type OAuth2ScopeDescription as al, type OAuthCallbackParams as am, type OAuthCallbackResult as an, type OAuthCodeExchangeOptions as ao, type OAuthNativeParams as ap, type OAuthStartParams as aq, type OAuthTokens as ar, type OAuthUnlinkedPayload as as, PASSKEY_DEVICE_TYPES as at, PASSKEY_LABEL_MAX_LENGTH as au, type PasskeyDeviceType as av, PasswordSchema as aw, PhoneSchema as ax, PlatformSchema as ay, type PollDeviceAuthParams as az, type RequestSignupLinkResult as b, startDeviceAuthService as b$, authDeletionCancelledEvent as b0, authDeletionCompletedEvent as b1, authDeletionRequestedEvent as b2, authDeviceRegisteredEvent as b3, authLoginEvent as b4, authPasswordResetEvent as b5, authRegisterEvent as b6, authenticate as b7, buildOAuthErrorUrl as b8, changePasswordService as b9, oauthNativeService as bA, oauthStartService as bB, oauthUnlinkNotifyService as bC, oauthUnlinkedEvent as bD, optionalAuth as bE, passkeys as bF, pollDeviceAuthService as bG, registerAuthProfile as bH, registerMachineVerifier as bI, registerOAuthProvider as bJ, registerPublicKeyService as bK, registerService as bL, renamePasskeyService as bM, requestPasswordResetService as bN, requestSignupLinkService as bO, requireEnabledProvider as bP, requireMachineScope as bQ, resolveAuthenticatedUser as bR, revokeAllKeysService as bS, revokeAllOAuth2GrantsForUser as bT, revokeKeyService as bU, revokeOAuth2GrantService as bV, revokePasskeyService as bW, rotateKeyService as bX, runAuthProfile as bY, selectAuthProfile as bZ, sendVerificationCodeService as b_, completePasswordResetService as ba, completeSignupService as bb, confirmPasswordResetService as bc, confirmSignupLinkService as bd, denyDeviceAuthService as be, denyOAuth2AuthorizeService as bf, describeOAuth2AuthorizeRequestService as bg, finishPasskeyEnrollmentService as bh, finishPasskeyLoginService as bi, getDeviceAuthInfoService as bj, getEnabledOAuthProviders as bk, getGoogleAccessToken as bl, getMachinePrincipal as bm, getOAuthProvider as bn, getRegisteredProviders as bo, invitationAcceptedEvent as bp, invitationCreatedEvent as bq, isOAuthProviderEnabled as br, issueOneTimeTokenService as bs, listKeysService as bt, listOAuth2GrantsService as bu, listPasskeysService as bv, loginService as bw, logoutService as bx, machineAuth as by, oauthCallbackService as bz, type RequestPasswordResetResult as c, startPasskeyEnrollmentService as c0, startPasskeyLoginService as c1, verifyCodeService as c2, verifyOneTimeTokenService as c3, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type RotateKeyResult as g, type RevokeAllKeysResult as h, type OAuthNativeResult as i, type ProfileInfo as j, type OAuth2ConsentView as k, type OAuth2AuthorizationCodeIssued as l, mainAuthRouter as m, type OAuth2GrantSummary as n, type AuthSession as o, PERMISSION_CATEGORIES as p, type PermissionCategory as q, VERIFICATION_TARGET_TYPES as r, type VerificationPurpose as s, type VerificationTargetType as t, type OAuthProvider as u, type Passkey as v, type AuthContext as w, type ApproveDeviceAuthParams as x, type AuthDeletionCancelledPayload as y, type AuthDeletionCompletedPayload as z };
+export { type AuthLoginPayload as $, type AuthInitOptions as A, type Passkey as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type MfaVerification as E, type FinishPasskeyEnrollmentResult as F, type MfaVerificationMethod as G, type UserPublicKey as H, type IssueOneTimeTokenResult as I, type AuthContext as J, type KeySummary as K, type LoginBindingFields as L, type MfaStatus as M, type NewUserPublicKey as N, type OAuthStartResult as O, type PermissionConfig as P, type ApproveDeviceAuthParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type AssertStepUpParams as W, type AuthDeletionCancelledPayload as X, type AuthDeletionCompletedPayload as Y, type AuthDeletionRequestedPayload as Z, type AuthDeviceRegisteredPayload as _, type RegisterResult as a, type RevokeAllKeysParams as a$, type AuthPasswordResetPayload as a0, type AuthProfileOutcome as a1, type AuthProfileVerifier as a2, AuthProviderSchema as a3, type AuthRegisterPayload as a4, type BearerOutcome as a5, type BearerRefusal as a6, type ChangePasswordParams as a7, type CompletePasswordResetParams as a8, type CompleteSignupParams as a9, type NativeVerifyOptions as aA, type NewMfaVerification as aB, type NormalizedIdentity as aC, type OAuth2AuthorizeParams as aD, type OAuth2ScopeDescription as aE, type OAuthCallbackParams as aF, type OAuthCallbackResult as aG, type OAuthCodeExchangeOptions as aH, type OAuthNativeParams as aI, type OAuthStartParams as aJ, type OAuthTokens as aK, type OAuthUnlinkedPayload as aL, PASSKEY_DEVICE_TYPES as aM, PASSKEY_LABEL_MAX_LENGTH as aN, type PasskeyDeviceType as aO, PasswordSchema as aP, PhoneSchema as aQ, PlatformSchema as aR, type PollDeviceAuthParams as aS, type PollDeviceAuthResult as aT, PublicKeySchema as aU, type RecentAuthenticationParams as aV, type RegisterParams as aW, type RegisterPublicKeyParams as aX, type RenamePasskeyParams as aY, type RequestPasswordResetParams as aZ, type RequestSignupLinkParams as a_, type ConfirmPasswordResetParams as aa, type ConfirmSignupLinkParams as ab, type ConfirmTotpParams as ac, type DenyDeviceAuthParams as ad, type DeviceAuthApprovedResult as ae, type DeviceAuthInfoParams as af, type DeviceAuthPendingResult as ag, DeviceAuthPollResponseSchema as ah, DeviceNameSchema as ai, type DeviceRegistrationChannel as aj, type DisableSessionBindingParams as ak, EmailSchema as al, FingerprintSchema as am, type FinishPasskeyEnrollmentParams as an, type FinishPasskeyLoginParams as ao, type FinishSessionRenewParams as ap, type InvitationAcceptedPayload as aq, type InvitationCreatedPayload as ar, KEY_FINGERPRINT_PREFIX_LENGTH as as, KeyIdSchema as at, type LoginParams as au, type LogoutParams as av, MFA_VERIFICATION_METHODS as aw, type MachinePrincipal as ax, type MachineVerifierRegistration as ay, type MarkPasskeyParams as az, type RequestSignupLinkResult as b, listOAuth2GrantsService as b$, type RevokeKeyParams as b0, type RevokePasskeyParams as b1, type RotateKeyParams as b2, type SendVerificationCodeParams as b3, type SessionBindingParams as b4, type StartDeviceAuthParams as b5, type StartPasskeyEnrollmentParams as b6, type StartSessionRenewParams as b7, type StepUpParams as b8, TargetTypeSchema as b9, completePasswordResetService as bA, completeSignupService as bB, confirmPasswordResetService as bC, confirmSignupLinkService as bD, confirmTotpEnrolmentService as bE, denyDeviceAuthService as bF, denyOAuth2AuthorizeService as bG, describeOAuth2AuthorizeRequestService as bH, disableMfaService as bI, disableSessionBindingService as bJ, enableSessionBindingService as bK, finishPasskeyEnrollmentService as bL, finishPasskeyLoginService as bM, finishSessionRenewService as bN, getDeviceAuthInfoService as bO, getEnabledOAuthProviders as bP, getGoogleAccessToken as bQ, getMachinePrincipal as bR, getOAuthProvider as bS, getRegisteredProviders as bT, getSessionBindingService as bU, invitationAcceptedEvent as bV, invitationCreatedEvent as bW, isOAuthProviderEnabled as bX, issueOneTimeTokenService as bY, keySessionBindingService as bZ, listKeysService as b_, type UnlinkNotification as ba, UnlinkNotifyRejection as bb, type UnlinkNotifyRequest as bc, type UnlinkNotifyResult as bd, UserCodeSchema as be, VerificationPurposeSchema as bf, type VerifyCodeParams as bg, type VerifyCodeResult as bh, admitBearerKey as bi, approveDeviceAuthService as bj, approveOAuth2AuthorizeService as bk, assertNotLastRecoveryCredential as bl, assertRecentAuthentication as bm, assertStepUp as bn, authDeletionCancelledEvent as bo, authDeletionCompletedEvent as bp, authDeletionRequestedEvent as bq, authDeviceRegisteredEvent as br, authLoginEvent as bs, authPasswordResetEvent as bt, authRegisterEvent as bu, authenticate as bv, bearerAuthContext as bw, buildOAuthErrorUrl as bx, carryStepUpVerification as by, changePasswordService as bz, type RequestPasswordResetResult as c, listPasskeysService as c0, loginService as c1, logoutService as c2, machineAuth as c3, markPasskeySecondFactorService as c4, mfaEnrolledForUser as c5, mfaStatusService as c6, mfaVerifications as c7, oauthCallbackService as c8, oauthNativeService as c9, sendVerificationCodeService as cA, startDeviceAuthService as cB, startPasskeyEnrollmentService as cC, startPasskeyLoginService as cD, startSessionBindingDisableService as cE, startSessionRenewService as cF, startStepUpService as cG, startTotpEnrolmentService as cH, stepUpService as cI, sweepUnconfirmedMfaService as cJ, userPublicKeys as cK, verifyCodeService as cL, verifyOneTimeTokenService as cM, verifySecondFactor as cN, oauthStartService as ca, oauthUnlinkNotifyService as cb, oauthUnlinkedEvent as cc, optionalAuth as cd, passkeys as ce, pollDeviceAuthService as cf, regenerateRecoveryCodesService as cg, registerAuthProfile as ch, registerMachineVerifier as ci, registerOAuthProvider as cj, registerPublicKeyService as ck, registerService as cl, renamePasskeyService as cm, requestPasswordResetService as cn, requestSignupLinkService as co, requireEnabledProvider as cp, requireMachineScope as cq, resolveAuthenticatedUser as cr, revokeAllKeysService as cs, revokeAllOAuth2GrantsForUser as ct, revokeKeyService as cu, revokeOAuth2GrantService as cv, revokePasskeyService as cw, rotateKeyService as cx, runAuthProfile as cy, selectAuthProfile as cz, type ConfirmPasswordResetResult as d, type LoginResult as e, type StartDeviceAuthResult as f, type PasskeySummary as g, type ConfirmTotpResult as h, type RotateKeyResult as i, type RevokeAllKeysResult as j, type SessionBindingResult as k, type SessionRenewResult as l, mainAuthRouter as m, type OAuthNativeResult as n, type ProfileInfo as o, type OAuth2ConsentView as p, type OAuth2AuthorizationCodeIssued as q, type OAuth2GrantSummary as r, type AuthSession as s, PERMISSION_CATEGORIES as t, type PermissionCategory as u, VERIFICATION_TARGET_TYPES as v, type VerificationPurpose as w, type VerificationTargetType as x, type OAuthProvider as y, type NewPasskey as z };