@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.24

package/dist/server.d.ts

@@ -1,8 +1,8 @@
-import { A as AuthInitOptions, v as OAuthProvider, t as VerificationPurpose, N as NewPasskey, w as Passkey, x as MfaVerification, y as MfaVerificationMethod, r as PermissionCategory, z as AuthContext } from './machine-principals-CaEFq61K.js';
-export { B as ApproveDeviceAuthParams, E as AssertStepUpParams, G as AuthDeletionCancelledPayload, H as AuthDeletionCompletedPayload, J as AuthDeletionRequestedPayload, Q as AuthDeviceRegisteredPayload, W as AuthLoginPayload, X as AuthPasswordResetPayload, Y as AuthProfileOutcome, Z as AuthProfileVerifier, _ as AuthProviderSchema, $ as AuthRegisterPayload, a0 as ChangePasswordParams, a1 as CompletePasswordResetParams, a2 as CompleteSignupParams, a3 as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, a4 as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, a5 as ConfirmTotpParams, g as ConfirmTotpResult, a6 as DenyDeviceAuthParams, a7 as DeviceAuthApprovedResult, a8 as DeviceAuthInfoParams, D as DeviceAuthInfoResult, a9 as DeviceAuthPendingResult, aa as DeviceAuthPollResponseSchema, ab as DeviceNameSchema, ac as DeviceRegistrationChannel, ad as EmailSchema, ae as FingerprintSchema, af as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, ag as FinishPasskeyLoginParams, ah as InvitationAcceptedPayload, ai as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aj as KEY_FINGERPRINT_PREFIX_LENGTH, ak as KeyIdSchema, K as KeySummary, al as LoginParams, L as LoginResult, am as LogoutParams, an as MFA_VERIFICATION_METHODS, ao as MachinePrincipal, ap as MachineVerifierRegistration, aq as MarkPasskeyParams, M as MfaStatus, ar as NativeVerifyOptions, as as NewMfaVerification, at as NormalizedIdentity, n as OAuth2AuthorizationCodeIssued, au as OAuth2AuthorizeParams, l as OAuth2ConsentView, o as OAuth2GrantSummary, av as OAuth2ScopeDescription, aw as OAuthCallbackParams, ax as OAuthCallbackResult, ay as OAuthCodeExchangeOptions, az as OAuthNativeParams, j as OAuthNativeResult, aA as OAuthStartParams, O as OAuthStartResult, aB as OAuthTokens, aC as OAuthUnlinkedPayload, aD as PASSKEY_DEVICE_TYPES, aE as PASSKEY_LABEL_MAX_LENGTH, aF as PasskeyDeviceType, f as PasskeySummary, aG as PasswordSchema, aH as PhoneSchema, aI as PlatformSchema, aJ as PollDeviceAuthParams, aK as PollDeviceAuthResult, aL as PublicKeySchema, aM as RecentAuthenticationParams, aN as RegisterParams, aO as RegisterPublicKeyParams, a as RegisterResult, aP as RenamePasskeyParams, aQ as RequestPasswordResetParams, c as RequestPasswordResetResult, aR as RequestSignupLinkParams, b as RequestSignupLinkResult, aS as RevokeAllKeysParams, i as RevokeAllKeysResult, aT as RevokeKeyParams, aU as RevokePasskeyParams, aV as RotateKeyParams, h as RotateKeyResult, aW as SendVerificationCodeParams, S as SendVerificationCodeResult, aX as StartDeviceAuthParams, e as StartDeviceAuthResult, aY as StartPasskeyEnrollmentParams, aZ as StepUpParams, a_ as TargetTypeSchema, T as TotpEnrolmentResult, a$ as UnlinkNotification, b0 as UnlinkNotifyRejection, b1 as UnlinkNotifyRequest, b2 as UnlinkNotifyResult, b3 as UserCodeSchema, V as VERIFICATION_PURPOSES, s as VERIFICATION_TARGET_TYPES, b4 as VerificationPurposeSchema, u as VerificationTargetType, b5 as VerifyCodeParams, b6 as VerifyCodeResult, b7 as approveDeviceAuthService, b8 as approveOAuth2AuthorizeService, b9 as assertNotLastRecoveryCredential, ba as assertRecentAuthentication, bb as assertStepUp, bc as authDeletionCancelledEvent, bd as authDeletionCompletedEvent, be as authDeletionRequestedEvent, bf as authDeviceRegisteredEvent, bg as authLoginEvent, bh as authPasswordResetEvent, bi as authRegisterEvent, m as authRouter, bj as authenticate, bk as buildOAuthErrorUrl, bl as carryStepUpVerification, bm as changePasswordService, bn as completePasswordResetService, bo as completeSignupService, bp as confirmPasswordResetService, bq as confirmSignupLinkService, br as confirmTotpEnrolmentService, bs as denyDeviceAuthService, bt as denyOAuth2AuthorizeService, bu as describeOAuth2AuthorizeRequestService, bv as disableMfaService, bw as finishPasskeyEnrollmentService, bx as finishPasskeyLoginService, by as getDeviceAuthInfoService, bz as getEnabledOAuthProviders, bA as getGoogleAccessToken, bB as getMachinePrincipal, bC as getOAuthProvider, bD as getRegisteredProviders, bE as invitationAcceptedEvent, bF as invitationCreatedEvent, bG as isOAuthProviderEnabled, bH as issueOneTimeTokenService, bI as listKeysService, bJ as listOAuth2GrantsService, bK as listPasskeysService, bL as loginService, bM as logoutService, bN as machineAuth, bO as markPasskeySecondFactorService, bP as mfaEnrolledForUser, bQ as mfaStatusService, bR as mfaVerifications, bS as oauthCallbackService, bT as oauthNativeService, bU as oauthStartService, bV as oauthUnlinkNotifyService, bW as oauthUnlinkedEvent, bX as optionalAuth, bY as passkeys, bZ as pollDeviceAuthService, b_ as regenerateRecoveryCodesService, b$ as registerAuthProfile, c0 as registerMachineVerifier, c1 as registerOAuthProvider, c2 as registerPublicKeyService, c3 as registerService, c4 as renamePasskeyService, c5 as requestPasswordResetService, c6 as requestSignupLinkService, c7 as requireEnabledProvider, c8 as requireMachineScope, c9 as resolveAuthenticatedUser, ca as revokeAllKeysService, cb as revokeAllOAuth2GrantsForUser, cc as revokeKeyService, cd as revokeOAuth2GrantService, ce as revokePasskeyService, cf as rotateKeyService, cg as runAuthProfile, ch as selectAuthProfile, ci as sendVerificationCodeService, cj as startDeviceAuthService, ck as startPasskeyEnrollmentService, cl as startPasskeyLoginService, cm as startStepUpService, cn as startTotpEnrolmentService, co as stepUpService, cp as sweepUnconfirmedMfaService, cq as verifyCodeService, cr as verifyOneTimeTokenService, cs as verifySecondFactor } from './machine-principals-CaEFq61K.js';
+import { A as AuthInitOptions, y as OAuthProvider, N as NewUserPublicKey, w as VerificationPurpose, z as NewPasskey, B as Passkey, E as MfaVerification, G as MfaVerificationMethod, u as PermissionCategory, H as UserPublicKey, J as AuthContext } from './machine-principals-ZJd9anVT.js';
+export { Q as ApproveDeviceAuthParams, W as AssertStepUpParams, X as AuthDeletionCancelledPayload, Y as AuthDeletionCompletedPayload, Z as AuthDeletionRequestedPayload, _ as AuthDeviceRegisteredPayload, $ as AuthLoginPayload, a0 as AuthPasswordResetPayload, a1 as AuthProfileOutcome, a2 as AuthProfileVerifier, a3 as AuthProviderSchema, a4 as AuthRegisterPayload, a5 as BearerOutcome, a6 as BearerRefusal, a7 as ChangePasswordParams, a8 as CompletePasswordResetParams, a9 as CompleteSignupParams, aa as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ab as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, ac as ConfirmTotpParams, h as ConfirmTotpResult, ad as DenyDeviceAuthParams, ae as DeviceAuthApprovedResult, af as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ag as DeviceAuthPendingResult, ah as DeviceAuthPollResponseSchema, ai as DeviceNameSchema, aj as DeviceRegistrationChannel, ak as DisableSessionBindingParams, al as EmailSchema, am as FingerprintSchema, an as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, ao as FinishPasskeyLoginParams, ap as FinishSessionRenewParams, aq as InvitationAcceptedPayload, ar as InvitationCreatedPayload, I as IssueOneTimeTokenResult, as as KEY_FINGERPRINT_PREFIX_LENGTH, at as KeyIdSchema, K as KeySummary, au as LoginParams, e as LoginResult, av as LogoutParams, aw as MFA_VERIFICATION_METHODS, ax as MachinePrincipal, ay as MachineVerifierRegistration, az as MarkPasskeyParams, M as MfaStatus, aA as NativeVerifyOptions, aB as NewMfaVerification, aC as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aD as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aE as OAuth2ScopeDescription, aF as OAuthCallbackParams, aG as OAuthCallbackResult, aH as OAuthCodeExchangeOptions, aI as OAuthNativeParams, n as OAuthNativeResult, aJ as OAuthStartParams, O as OAuthStartResult, aK as OAuthTokens, aL as OAuthUnlinkedPayload, aM as PASSKEY_DEVICE_TYPES, aN as PASSKEY_LABEL_MAX_LENGTH, aO as PasskeyDeviceType, g as PasskeySummary, aP as PasswordSchema, aQ as PhoneSchema, aR as PlatformSchema, aS as PollDeviceAuthParams, aT as PollDeviceAuthResult, aU as PublicKeySchema, aV as RecentAuthenticationParams, aW as RegisterParams, aX as RegisterPublicKeyParams, a as RegisterResult, aY as RenamePasskeyParams, aZ as RequestPasswordResetParams, c as RequestPasswordResetResult, a_ as RequestSignupLinkParams, b as RequestSignupLinkResult, a$ as RevokeAllKeysParams, j as RevokeAllKeysResult, b0 as RevokeKeyParams, b1 as RevokePasskeyParams, b2 as RotateKeyParams, i as RotateKeyResult, b3 as SendVerificationCodeParams, S as SendVerificationCodeResult, b4 as SessionBindingParams, k as SessionBindingResult, b5 as StartDeviceAuthParams, f as StartDeviceAuthResult, b6 as StartPasskeyEnrollmentParams, b7 as StartSessionRenewParams, b8 as StepUpParams, b9 as TargetTypeSchema, T as TotpEnrolmentResult, ba as UnlinkNotification, bb as UnlinkNotifyRejection, bc as UnlinkNotifyRequest, bd as UnlinkNotifyResult, be as UserCodeSchema, V as VERIFICATION_PURPOSES, v as VERIFICATION_TARGET_TYPES, bf as VerificationPurposeSchema, x as VerificationTargetType, bg as VerifyCodeParams, bh as VerifyCodeResult, bi as admitBearerKey, bj as approveDeviceAuthService, bk as approveOAuth2AuthorizeService, bl as assertNotLastRecoveryCredential, bm as assertRecentAuthentication, bn as assertStepUp, bo as authDeletionCancelledEvent, bp as authDeletionCompletedEvent, bq as authDeletionRequestedEvent, br as authDeviceRegisteredEvent, bs as authLoginEvent, bt as authPasswordResetEvent, bu as authRegisterEvent, m as authRouter, bv as authenticate, bw as bearerAuthContext, bx as buildOAuthErrorUrl, by as carryStepUpVerification, bz as changePasswordService, bA as completePasswordResetService, bB as completeSignupService, bC as confirmPasswordResetService, bD as confirmSignupLinkService, bE as confirmTotpEnrolmentService, bF as denyDeviceAuthService, bG as denyOAuth2AuthorizeService, bH as describeOAuth2AuthorizeRequestService, bI as disableMfaService, bJ as disableSessionBindingService, bK as enableSessionBindingService, bL as finishPasskeyEnrollmentService, bM as finishPasskeyLoginService, bN as finishSessionRenewService, bO as getDeviceAuthInfoService, bP as getEnabledOAuthProviders, bQ as getGoogleAccessToken, bR as getMachinePrincipal, bS as getOAuthProvider, bT as getRegisteredProviders, bU as getSessionBindingService, bV as invitationAcceptedEvent, bW as invitationCreatedEvent, bX as isOAuthProviderEnabled, bY as issueOneTimeTokenService, bZ as keySessionBindingService, b_ as listKeysService, b$ as listOAuth2GrantsService, c0 as listPasskeysService, c1 as loginService, c2 as logoutService, c3 as machineAuth, c4 as markPasskeySecondFactorService, c5 as mfaEnrolledForUser, c6 as mfaStatusService, c7 as mfaVerifications, c8 as oauthCallbackService, c9 as oauthNativeService, ca as oauthStartService, cb as oauthUnlinkNotifyService, cc as oauthUnlinkedEvent, cd as optionalAuth, ce as passkeys, cf as pollDeviceAuthService, cg as regenerateRecoveryCodesService, ch as registerAuthProfile, ci as registerMachineVerifier, cj as registerOAuthProvider, ck as registerPublicKeyService, cl as registerService, cm as renamePasskeyService, cn as requestPasswordResetService, co as requestSignupLinkService, cp as requireEnabledProvider, cq as requireMachineScope, cr as resolveAuthenticatedUser, cs as revokeAllKeysService, ct as revokeAllOAuth2GrantsForUser, cu as revokeKeyService, cv as revokeOAuth2GrantService, cw as revokePasskeyService, cx as rotateKeyService, cy as runAuthProfile, cz as selectAuthProfile, cA as sendVerificationCodeService, cB as startDeviceAuthService, cC as startPasskeyEnrollmentService, cD as startPasskeyLoginService, cE as startSessionBindingDisableService, cF as startSessionRenewService, cG as startStepUpService, cH as startTotpEnrolmentService, cI as stepUpService, cJ as sweepUnconfirmedMfaService, cK as userPublicKeys, cL as verifyCodeService, cM as verifyOneTimeTokenService, cN as verifySecondFactor } from './machine-principals-ZJd9anVT.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
-import { j as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
-export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
+import { l as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-CTdoTOxM.js';
+export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, j as SESSION_BINDINGS, k as SOCIAL_PROVIDERS, S as SessionBindingType, U as USER_STATUSES, m as UserStatus } from './types-CTdoTOxM.js';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';
 import { c as ClientIdentity } from './wire-version-CtzMKvBB.js';
@@ -10,7 +10,7 @@ import { Context } from 'hono';
 import * as _spfn_core_route from '@spfn/core/route';
 import { NamedMiddleware } from '@spfn/core/route';
 export { KeyPair, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, getKeySize, shouldRotateKey } from './crypto.js';
-export { S as SessionData, g as getSessionInfo, i as isSafeReturnPath, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-Dfwu5g2W.js';
+export { S as SessionData, g as getSessionInfo, i as isSafeReturnPath, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-BbhAGZtA.js';
 import { JWTPayload } from 'jose';
 import { SSETokenManager, SSETokenStore } from '@spfn/core/event/sse';
 import * as _spfn_core_logger from '@spfn/core/logger';
@@ -21,95 +21,6 @@ import '@spfn/core/event';
 import '@spfn/auth/server';
 import 'jsonwebtoken';
 
-/**
- * @spfn/auth - Signed Sign-Out-Everywhere Link
- *
- * A link an app mails to an account's proven address, which signs every device
- * of that account out without a session. It exists for the case the rest of the
- * key surface cannot serve: the owner suspects a device they do not recognise,
- * and the device they would have to sign in on to do something about it is the
- * one they no longer trust.
- *
- * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
- * mints the capability and hands the app a URL. `describeRevokeAllLink` says
- * whether that URL still works and changes nothing, so a mail scanner opening
- * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
- * and it takes the owner pressing the button.
- *
- * The caller's obligation, which this package cannot enforce: the URL
- * `createRevokeAllLink` returns carries the plaintext token, because the package
- * sends no mail here. Do not log it, do not persist it, do not put it in a job
- * payload — hand it to the mail template and let it go. Every other link in this
- * package is minted inside the worker that sends it precisely so that no caller
- * ever holds one; this one cannot be, and the obligation moves to the app.
- */
-interface CreateRevokeAllLinkOptions {
-    /**
-     * Minutes the link stays valid. Defaults to
-     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
-     */
-    ttlMinutes?: number;
-}
-interface RevokeAllLink {
-    /** Absolute URL of the app page, token in its query string. Never log it. */
-    url: string;
-    expiresAt: Date;
-}
-/** What the describe call tells the page, so it can say what pressing the button does. */
-interface RevokeAllLinkDescription {
-    expiresAt: Date;
-    activeKeyCount: number;
-}
-/**
- * Mint a sign-out-everywhere link for an account.
- *
- * Issuing supersedes every live link the account already has, the rule the
- * password-reset flow follows: an owner who asks twice must not leave the first
- * capability working in their mailbox after using the second.
- *
- * The row records the account's key generation, so the link dies the moment any
- * other path signs every device out — a password reset, a password change, a
- * deletion request, or the ordinary revoke-all route.
- *
- * Send it beside a password reset link. It ends the sessions; it does not change
- * the password that let them start.
- *
- * @param userId - The account to issue for
- * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
- * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
- */
-declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
-/**
- * Say whether a presented link still works, and what pressing the button would
- * do. Changes nothing — a mail scanner that opens the page has done nothing.
- *
- * @throws RevokeAllLinkError every refusal, in one shape
- */
-declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
-/**
- * Spend a link and sign every device of the account out.
- *
- * The claim is one statement, so of two requests carrying the same token exactly
- * one revokes and the other is refused as if the token were unknown — which by
- * then it is. `includeCurrent` is true because there is no current device here:
- * the caller holds a mailbox, not a session, and sparing something would mean
- * sparing whatever the owner is trying to cut off.
- *
- * @returns how many device keys were revoked; zero is a success, not a refusal
- * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
- */
-declare function consumeRevokeAllLink(token: string): Promise<{
-    revokedCount: number;
-}>;
-/**
- * Delete link rows that can no longer answer anything.
- *
- * @returns number of rows deleted
- */
-declare function purgeRevokeAllTokensService(): Promise<{
-    deleted: number;
-}>;
-
 /**
  * @spfn/auth - Global Configuration
  *
@@ -341,6 +252,27 @@ declare function getCsrfMode(): CsrfMode;
  * Get the paths exempted from the CSRF check (exact match, backend route paths)
  */
 declare function getCsrfExemptPaths(): string[];
+/**
+ * How long a key bound to a passkey lives, in milliseconds.
+ *
+ * A positive override is honoured; anything else falls back to the policy
+ * constant. Nothing refuses boot over it — unlike the passkey relying party, a
+ * nonsensical value here does not make every ceremony fail, it just means the
+ * default applies.
+ */
+declare function getBoundKeyTtlMs(): number;
+/** How long past expiry a bound key may still be renewed, in milliseconds. */
+declare function getBoundKeyRenewGraceMs(): number;
+/** How close two sightings from two addresses must be to count as concurrent. */
+declare function getConcurrentUseWindowMs(): number;
+/**
+ * The page a bound session whose key expired is sent to.
+ *
+ * `RequireAuth` redirects here instead of to the sign-in page; the app renders a
+ * client component there that calls `renewSession(api)` and returns the person to
+ * where they were.
+ */
+declare function getSessionRenewPath(): string;
 /**
  * The relying party this deployment presents to authenticators, resolved.
  *
@@ -421,6 +353,95 @@ interface MfaConfig {
  */
 declare function getMfaConfig(): MfaConfig;
 
+/**
+ * @spfn/auth - Signed Sign-Out-Everywhere Link
+ *
+ * A link an app mails to an account's proven address, which signs every device
+ * of that account out without a session. It exists for the case the rest of the
+ * key surface cannot serve: the owner suspects a device they do not recognise,
+ * and the device they would have to sign in on to do something about it is the
+ * one they no longer trust.
+ *
+ * Three calls, and each is deliberately not the other two. `createRevokeAllLink`
+ * mints the capability and hands the app a URL. `describeRevokeAllLink` says
+ * whether that URL still works and changes nothing, so a mail scanner opening
+ * the page costs nothing. `consumeRevokeAllLink` is the only one that revokes,
+ * and it takes the owner pressing the button.
+ *
+ * The caller's obligation, which this package cannot enforce: the URL
+ * `createRevokeAllLink` returns carries the plaintext token, because the package
+ * sends no mail here. Do not log it, do not persist it, do not put it in a job
+ * payload — hand it to the mail template and let it go. Every other link in this
+ * package is minted inside the worker that sends it precisely so that no caller
+ * ever holds one; this one cannot be, and the obligation moves to the app.
+ */
+interface CreateRevokeAllLinkOptions {
+    /**
+     * Minutes the link stays valid. Defaults to
+     * `SPFN_AUTH_REVOKE_ALL_LINK_TTL_MINUTES`, itself 30.
+     */
+    ttlMinutes?: number;
+}
+interface RevokeAllLink {
+    /** Absolute URL of the app page, token in its query string. Never log it. */
+    url: string;
+    expiresAt: Date;
+}
+/** What the describe call tells the page, so it can say what pressing the button does. */
+interface RevokeAllLinkDescription {
+    expiresAt: Date;
+    activeKeyCount: number;
+}
+/**
+ * Mint a sign-out-everywhere link for an account.
+ *
+ * Issuing supersedes every live link the account already has, the rule the
+ * password-reset flow follows: an owner who asks twice must not leave the first
+ * capability working in their mailbox after using the second.
+ *
+ * The row records the account's key generation, so the link dies the moment any
+ * other path signs every device out — a password reset, a password change, a
+ * deletion request, or the ordinary revoke-all route.
+ *
+ * Send it beside a password reset link. It ends the sessions; it does not change
+ * the password that let them start.
+ *
+ * @param userId - The account to issue for
+ * @throws ValidationError `ttlMinutes` that is not a positive integer — no row is written
+ * @throws NotFoundError no such account, rather than a foreign-key failure at the insert
+ */
+declare function createRevokeAllLink(userId: string | number, options?: CreateRevokeAllLinkOptions): Promise<RevokeAllLink>;
+/**
+ * Say whether a presented link still works, and what pressing the button would
+ * do. Changes nothing — a mail scanner that opens the page has done nothing.
+ *
+ * @throws RevokeAllLinkError every refusal, in one shape
+ */
+declare function describeRevokeAllLink(token: string): Promise<RevokeAllLinkDescription>;
+/**
+ * Spend a link and sign every device of the account out.
+ *
+ * The claim is one statement, so of two requests carrying the same token exactly
+ * one revokes and the other is refused as if the token were unknown — which by
+ * then it is. `includeCurrent` is true because there is no current device here:
+ * the caller holds a mailbox, not a session, and sparing something would mean
+ * sparing whatever the owner is trying to cut off.
+ *
+ * @returns how many device keys were revoked; zero is a success, not a refusal
+ * @throws RevokeAllLinkError every refusal, in the same shape `describe` uses
+ */
+declare function consumeRevokeAllLink(token: string): Promise<{
+    revokedCount: number;
+}>;
+/**
+ * Delete link rows that can no longer answer anything.
+ *
+ * @returns number of rows deleted
+ */
+declare function purgeRevokeAllTokensService(): Promise<{
+    deleted: number;
+}>;
+
 /**
  * @spfn/auth - Users Entity
  *
@@ -678,6 +699,36 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        sessionBinding: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["none", "passkey"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "users";
+            dataType: "string enum";
+            data: "none" | "passkey";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sessionBindingChangedAt: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "users";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         lastLoginAt: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
             tableName: "users";
@@ -725,6 +776,8 @@ declare function getUserByIdService(userId: number): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -747,6 +800,8 @@ declare function getUserByEmailService(email: string): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -769,6 +824,8 @@ declare function getUserByPhoneService(phone: string): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -810,6 +867,8 @@ declare function updateUsernameService(userId: string | number | bigint, usernam
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 
@@ -2839,282 +2898,57 @@ declare function revokeOAuth2TokenService(token: string, clientId: string): Prom
 interface VerifiedOAuth2AccessToken {
     /** The public `client_id` of the CLI holding the token. */
     clientId: string;
-    /** Scope names, as granted or as the refresh that minted it narrowed them to. */
-    scopes: string[];
-    /** Expiry as seconds since the epoch — the unit every OAuth field uses. */
-    expiresAt: number;
-    /** The account the CLI is acting for. */
-    userId: string;
-}
-/**
- * Verify a bearer token presented to a protected resource.
- *
- * @param token - The raw bearer value
- * @param resource - The resource being accessed, e.g. `https://api.example.com/mcp`
- * @returns the principal, or null for any reason at all
- */
-declare function verifyAccessToken(token: string, resource: string): Promise<VerifiedOAuth2AccessToken | null>;
-
-/**
- * @spfn/auth - Database Schema Definition
- *
- * Defines the 'spfn_auth' PostgreSQL schema for all auth-related tables
- */
-/**
- * Auth schema for all authentication and authorization tables
- * Tables: users, roles, permissions, user_invitations, etc.
- */
-declare const authSchema: drizzle_orm_pg_core.PgSchema<string>;
-
-/**
- * @spfn/auth - User Profiles Entity
- *
- * User profile information (separate from authentication data)
- *
- * Features:
- * - Display name and personal information
- * - Avatar and bio
- * - Locale and timezone preferences
- * - Optional demographic data
- * - Social links and professional info
- */
-declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_profiles";
-    schema: string;
-    columns: {
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        id: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "number int53";
-            data: number;
-            driverParam: number;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        displayName: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        firstName: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        lastName: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        avatarUrl: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        bio: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        locale: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        timezone: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        dateOfBirth: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        gender: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        website: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        location: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_profiles";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        company: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+    /** Scope names, as granted or as the refresh that minted it narrowed them to. */
+    scopes: string[];
+    /** Expiry as seconds since the epoch — the unit every OAuth field uses. */
+    expiresAt: number;
+    /** The account the CLI is acting for. */
+    userId: string;
+}
+/**
+ * Verify a bearer token presented to a protected resource.
+ *
+ * @param token - The raw bearer value
+ * @param resource - The resource being accessed, e.g. `https://api.example.com/mcp`
+ * @returns the principal, or null for any reason at all
+ */
+declare function verifyAccessToken(token: string, resource: string): Promise<VerifiedOAuth2AccessToken | null>;
+
+/**
+ * @spfn/auth - Database Schema Definition
+ *
+ * Defines the 'spfn_auth' PostgreSQL schema for all auth-related tables
+ */
+/**
+ * Auth schema for all authentication and authorization tables
+ * Tables: users, roles, permissions, user_invitations, etc.
+ */
+declare const authSchema: drizzle_orm_pg_core.PgSchema<string>;
+
+/**
+ * @spfn/auth - User Profiles Entity
+ *
+ * User profile information (separate from authentication data)
+ *
+ * Features:
+ * - Display name and personal information
+ * - Avatar and bio
+ * - Locale and timezone preferences
+ * - Optional demographic data
+ * - Social links and professional info
+ */
+declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_profiles";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
             tableName: "user_profiles";
-            dataType: "string";
-            data: string;
+            dataType: "object date";
+            data: Date;
             driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3122,14 +2956,14 @@ declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        jobTitle: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
             name: string;
             tableName: "user_profiles";
-            dataType: "string";
-            data: string;
+            dataType: "object date";
+            data: Date;
             driverParam: string;
-            notNull: false;
-            hasDefault: false;
+            notNull: true;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3137,44 +2971,9 @@ declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        metadata: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.Set$Type<drizzle_orm_pg_core.PgJsonbBuilder, Record<string, any>>, {
+        id: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
             name: string;
             tableName: "user_profiles";
-            dataType: "object json";
-            data: Record<string, any>;
-            driverParam: unknown;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-    };
-    dialect: "pg";
-}>;
-type UserProfile = typeof userProfiles.$inferSelect;
-type NewUserProfile = typeof userProfiles.$inferInsert;
-
-/**
- * @spfn/auth - User Public Keys Entity
- *
- * Stores client-generated public keys for JWT verification
- * Supports key rotation and multi-key management per user
- */
-/**
- * User Public Keys Table
- * Each user can have multiple public keys (for rotation)
- */
-declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_public_keys";
-    schema: string;
-    columns: {
-        id: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
-            name: string;
-            tableName: "user_public_keys";
             dataType: "number int53";
             data: number;
             driverParam: number;
@@ -3187,9 +2986,9 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+        userId: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "number int53";
             data: number;
             driverParam: string | number;
@@ -3202,13 +3001,13 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        keyId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        displayName: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3217,13 +3016,13 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        publicKey: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        firstName: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3232,28 +3031,13 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        algorithm: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ES256" | "RS256";
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["ES256", "RS256"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+        lastName: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -3262,9 +3046,9 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        deviceName: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        avatarUrl: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3277,24 +3061,9 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        platform: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ios" | "android" | "web" | "desktop";
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        registeredIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        bio: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3307,14 +3076,14 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        registeredUserAgent: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        locale: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
             notNull: false;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -3322,24 +3091,24 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        clientKind: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["web", "ios", "android"] & [string, ...string[]]>, {
+        timezone: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ios" | "android" | "web";
+            tableName: "user_profiles";
+            dataType: "string";
+            data: string;
             driverParam: string;
             notNull: false;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["web", "ios", "android"] & [string, ...string[]];
+            enumValues: undefined;
             identity: undefined;
             generated: undefined;
         }>;
-        clientVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        dateOfBirth: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3352,9 +3121,9 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        clientContractVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        gender: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
+            tableName: "user_profiles";
             dataType: "string";
             data: string;
             driverParam: string;
@@ -3367,11 +3136,11 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        clientSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        website: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
+            tableName: "user_profiles";
+            dataType: "string";
+            data: string;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -3382,41 +3151,11 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        isActive: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        location: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
+            tableName: "user_profiles";
+            dataType: "string";
+            data: string;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -3427,11 +3166,11 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        company: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
+            tableName: "user_profiles";
+            dataType: "string";
+            data: string;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -3442,11 +3181,11 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+        jobTitle: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
+            tableName: "user_profiles";
+            dataType: "string";
+            data: string;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -3457,12 +3196,12 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+        metadata: drizzle_orm_pg_core.PgBuildColumn<"user_profiles", drizzle_orm_pg_core.Set$Type<drizzle_orm_pg_core.PgJsonbBuilder, Record<string, any>>, {
             name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
+            tableName: "user_profiles";
+            dataType: "object json";
+            data: Record<string, any>;
+            driverParam: unknown;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
@@ -3475,8 +3214,8 @@ declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type UserPublicKey = typeof userPublicKeys.$inferSelect;
-type NewUserPublicKey = typeof userPublicKeys.$inferInsert;
+type UserProfile = typeof userProfiles.$inferSelect;
+type NewUserProfile = typeof userProfiles.$inferInsert;
 
 /**
  * @spfn/auth - User Social Accounts Entity
@@ -4429,8 +4168,15 @@ type NewKeyRevokeAllToken = typeof keyRevokeAllTokens.$inferInsert;
  * direction that matters most — an assertion collected as a second factor is
  * not a sign-in, and `passkeys/login/verify` refuses it for exactly the reason
  * the column exists.
+ *
+ * `'renewal'` is the fourth: the assertion that renews a bound session key, and
+ * the one that lets an account leave `session_binding: 'passkey'`. It is its own
+ * kind rather than a reused `'authentication'` because that kind's challenge is
+ * minted for nobody in particular — a discoverable sign-in names no account —
+ * while a renewal challenge is bound to the account it was issued for, and
+ * spending one where the other was expected would cross those two rules.
  */
-declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication", "mfa"];
+declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication", "mfa", "renewal"];
 type WebAuthnChallengeKind = typeof WEBAUTHN_CHALLENGE_KINDS[number];
 declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "webauthn_challenges";
@@ -4466,18 +4212,18 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication", "mfa"] & [string, ...string[]]>>, {
+        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication", "mfa", "renewal"] & [string, ...string[]]>>, {
             name: string;
             tableName: "webauthn_challenges";
             dataType: "string enum";
-            data: "registration" | "authentication" | "mfa";
+            data: "registration" | "authentication" | "mfa" | "renewal";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["registration", "authentication", "mfa"] & [string, ...string[]];
+            enumValues: ["registration", "authentication", "mfa", "renewal"] & [string, ...string[]];
             identity: undefined;
             generated: undefined;
         }>;
@@ -6294,6 +6040,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6320,6 +6068,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6357,6 +6107,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6390,6 +6142,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6413,6 +6167,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6436,6 +6192,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6459,6 +6217,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6482,6 +6242,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     } | null>;
     /**
@@ -6508,6 +6270,8 @@ declare class UsersRepository extends BaseRepository {
             emailVerifiedAt: Date | null;
             phoneVerifiedAt: Date | null;
             keyEpoch: number;
+            sessionBinding: "none" | "passkey";
+            sessionBindingChangedAt: Date | null;
             lastLoginAt: Date | null;
         };
         role: {
@@ -6523,6 +6287,7 @@ declare class UsersRepository extends BaseRepository {
     create(data: NewUser): Promise<{
         email: string | null;
         phone: string | null;
+        sessionBinding: "none" | "passkey";
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
@@ -6535,6 +6300,7 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -6605,6 +6371,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6633,6 +6401,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6656,6 +6426,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6679,6 +6451,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6688,6 +6462,7 @@ declare class UsersRepository extends BaseRepository {
     deleteById(id: number): Promise<{
         email: string | null;
         phone: string | null;
+        sessionBinding: "none" | "passkey";
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
@@ -6700,6 +6475,7 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -6803,6 +6579,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6829,6 +6610,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6855,6 +6641,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6874,6 +6665,10 @@ declare class KeysRepository extends BaseRepository {
      *
      * `includeRevoked`는 이미 끊은 기기까지 보여준다 — "내가 언제 무엇을 끊었나"를
      * 확인하는 용도라, 폐기 시각과 사유를 함께 고른다.
+     *
+     * `lastSeenIp` is not selected, deliberately. The concurrent-use moment is
+     * what the owner acts on; the trail of addresses behind it is stored PII the
+     * account surface has no use for.
      * Read replica 사용
      */
     listForUser(userId: number, includeRevoked?: boolean): Promise<{
@@ -6889,6 +6684,8 @@ declare class KeysRepository extends BaseRepository {
         revokedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        binding: "none" | "passkey";
+        concurrentUseAt: Date | null;
     }[]>;
     /**
      * 공개키 생성
@@ -6910,6 +6707,11 @@ declare class KeysRepository extends BaseRepository {
         lastUsedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -6937,6 +6739,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -7000,6 +6807,11 @@ declare class KeysRepository extends BaseRepository {
         lastUsedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -7029,6 +6841,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -7055,6 +6872,46 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
+        clientKind: "ios" | "android" | "web" | null;
+        clientVersion: string | null;
+        clientContractVersion: string | null;
+        clientSeenAt: Date | null;
+        isActive: boolean;
+        createdAt: Date;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        revokedReason: string | null;
+    }>;
+    /**
+     * Bind one live key to the account's passkey, and give it the short life
+     * that goes with it.
+     *
+     * Scoped by user and by `isActive`, like every other targeted update here, so
+     * the answer is "this call bound something" rather than "a row exists".
+     * Write primary 사용
+     */
+    bindByKeyIdAndUserId(keyId: string, userId: number, expiresAt: Date): Promise<{
+        id: number;
+        userId: number;
+        keyId: string;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -7066,6 +6923,15 @@ declare class KeysRepository extends BaseRepository {
         revokedAt: Date | null;
         revokedReason: string | null;
     }>;
+    /**
+     * Return every one of a user's bound keys to an ordinary long-lived key.
+     *
+     * One statement, because turning the setting off has to leave no key behind:
+     * a row still marked `'passkey'` would keep expiring in hours with nothing
+     * left to renew it, and its owner has just said they do not want that.
+     * Write primary 사용
+     */
+    unbindActiveByUserId(userId: number, expiresAt: Date): Promise<number>;
     /**
      * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
      *
@@ -7084,6 +6950,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -7110,6 +6981,11 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
@@ -7140,8 +7016,28 @@ declare class KeysRepository extends BaseRepository {
      * `clientSeenAt` moves only when one of the three values differs from what is
      * stored, so it answers "since when has this device been on this release"
      * rather than "when was it last seen", which lastUsedAt already answers.
+     *
+     * `ip` is the client address this request resolved to, or null when none did.
+     * It joins this statement rather than getting one of its own: the rule the
+     * concurrent-use signal needs — write the address, and move
+     * `concurrentUseAt` when it differs from the stored one inside the window —
+     * is the rule already implemented here, and a second fire-and-forget write
+     * beside it would double the per-request write on the authenticated path. It
+     * is also why the comparison is a `CASE` over the stored value rather than a
+     * read followed by a write: the row comes off the read replica, and a
+     * replica-lagged address compared in application code both misses real
+     * switches and invents ones that did not happen.
+     */
+    updateLastUsedById(id: number, identity?: ClientIdentity | null, ip?: string | null): Promise<void>;
+    /**
+     * The boundary a previous sighting has to be newer than to count as concurrent.
+     *
+     * Computed here rather than written as `now() - interval` so that the moment
+     * the row is stamped with and the moment the window is measured from are the
+     * same one — a statement that used the database clock for the boundary and
+     * ours for the value would disagree with itself by the round trip.
      */
-    updateLastUsedById(id: number, identity?: ClientIdentity | null): Promise<void>;
+    private concurrentUseSince;
 }
 declare const keysRepository: KeysRepository;
 
@@ -9661,6 +9557,31 @@ declare function verifyKeyFingerprint(publicKeyB64: string, expectedFingerprint:
  */
 declare function assertKeyMatchesAlgorithm(publicKeyB64: string, algorithm: KeyAlgorithmType): void;
 
+/**
+ * Whether a key may sign a renewal — the one clause that differs from `authenticate`.
+ *
+ * Bound, and within its grace. Early renewal is allowed, because a browser that
+ * asks a minute before its key runs out should not have to wait for the failure
+ * first; late renewal is allowed for the grace window, so a laptop closed over a
+ * long weekend comes back to one prompt instead of a sign-in. Past it there is
+ * nothing to continue, and an unbound key was never in this ceremony at all.
+ */
+declare function admitsForRenewal(key: UserPublicKey): boolean;
+/**
+ * Renewal authentication middleware
+ *
+ * Auto-skips the global `auth` middleware, the way `optionalAuth` does: a route
+ * that carries this one must not also be asked for a live key.
+ *
+ * @example
+ * ```typescript
+ * export const sessionRenewOptions = route.post('/_auth/session/renew/options')
+ *   .use([authenticateForRenewal])
+ *   .handler(async (c) => startSessionRenewService({ expiredKeyId: getAuth(c).keyId }));
+ * ```
+ */
+declare const authenticateForRenewal: _spfn_core_route.NamedMiddleware<"authForRenewal">;
+
 /**
  * @spfn/auth - Permission Middleware
  *
@@ -10005,6 +9926,7 @@ declare function getUser(c: Context | {
 }): {
     email: string | null;
     phone: string | null;
+    sessionBinding: "none" | "passkey";
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     publicId: string;
     passwordChangeRequired: boolean;
@@ -10017,6 +9939,7 @@ declare function getUser(c: Context | {
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
     deletedAt: Date | null;
     deletedBy: string | null;
@@ -11011,4 +10934,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };