@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.24

package/dist/server.js

@@ -4455,13 +4455,14 @@ var init_esm = __esm({
 });
 
 // src/server/types.ts
-var KEY_ALGORITHM, KEY_PLATFORM, KEY_DEVICE_NAME_MAX_LENGTH, INVITATION_STATUSES, USER_STATUSES, SOCIAL_PROVIDERS, ACCOUNT_DELETION_REQUEST_STATUSES, ACCOUNT_DELETION_REQUESTED_BY, PURGE_STRATEGIES;
+var KEY_ALGORITHM, KEY_PLATFORM, KEY_DEVICE_NAME_MAX_LENGTH, SESSION_BINDINGS, INVITATION_STATUSES, USER_STATUSES, SOCIAL_PROVIDERS, ACCOUNT_DELETION_REQUEST_STATUSES, ACCOUNT_DELETION_REQUESTED_BY, PURGE_STRATEGIES;
 var init_types = __esm({
   "src/server/types.ts"() {
     "use strict";
     KEY_ALGORITHM = ["ES256", "RS256"];
     KEY_PLATFORM = ["ios", "android", "web", "desktop"];
     KEY_DEVICE_NAME_MAX_LENGTH = 64;
+    SESSION_BINDINGS = ["none", "passkey"];
     INVITATION_STATUSES = ["pending", "accepted", "expired", "cancelled"];
     USER_STATUSES = ["active", "inactive", "suspended", "pending_deletion", "deleted"];
     SOCIAL_PROVIDERS = ["google", "apple", "github", "kakao", "naver", "superself"];
@@ -4523,7 +4524,15 @@ var init_schema3 = __esm({
         publicId: Type.String(),
         email: Type.Optional(Type.String()),
         phone: Type.Optional(Type.String()),
-        passwordChangeRequired: Type.Boolean()
+        passwordChangeRequired: Type.Boolean(),
+        // The approved branch is a `LoginResult` spread whole, so it carries the
+        // binding fields a sign-in can carry (#97). In practice it never does: a
+        // waiting device polls the backend directly, and a key is bound only on a
+        // request that reached it through the trusted Next.js proxy. Declared
+        // anyway, because the branch is whatever the login answered and the two
+        // must not be able to drift apart.
+        sessionBinding: Type.Optional(Type.Union(SESSION_BINDINGS.map((mode) => Type.Literal(mode)))),
+        keyExpiresAtMillis: Type.Optional(Type.Integer())
       })
     ], {
       description: "Pending, or the login the approval produced"
@@ -4685,6 +4694,20 @@ var init_users = __esm({
         // it was issued against — a link is dead once any other path has already
         // signed every device out
         keyEpoch: integer2("key_epoch").notNull().default(0),
+        // Whether this account's web sessions run on a key bound to a passkey
+        // 'none' (default): the key lives 90 days and a copy of the session
+        //   cookie signs with it for as long as it lasts — the behaviour every
+        //   account had before this column existed
+        // 'passkey': a web session started through the trusted Next.js proxy gets
+        //   a key that expires in hours, and only a fresh WebAuthn assertion can
+        //   put a new one in the cookie
+        // Opt-in, and only while the account has a live platform passkey to renew
+        // with. Leaving 'passkey' needs a fresh credential, never key age alone
+        sessionBinding: enumText("session_binding", SESSION_BINDINGS).notNull().default("none"),
+        // When the setting above last changed, so an account timeline can say
+        // when the protection was turned on or off
+        // null: never changed — the account has been on the default since it existed
+        sessionBindingChangedAt: utcTimestamp("session_binding_changed_at"),
         // Metadata
         // Last successful login timestamp
         // Used for: security auditing, dormant account detection
@@ -4849,6 +4872,56 @@ var init_user_public_keys = __esm({
         // Written once at registration, for the same reason and with the same
         // standing as registeredIp above
         registeredUserAgent: text4("registered_user_agent"),
+        // Browser family the registering request's user-agent named — one of the
+        // five badges uaFamily() answers with, never the raw string
+        // null: the request sent no user-agent, or the key predates this column
+        // Written once at registration, like the two columns above. The proxy is
+        // what compares a family against a request (the browser's user-agent does
+        // not survive a server-component hop), so this is the displayable record
+        // of where the key came from rather than the value any check reads
+        registeredUaFamily: text4("registered_ua_family"),
+        // Client address this key was last seen signing from, as getClientIp
+        // resolved it on that request
+        // null: that request resolved no address, or the key predates this column
+        //
+        // Unlike registeredIp above, this MOVES: it is overwritten by the same
+        // throttled UPDATE that stamps lastUsedAt, so it is a new class of stored
+        // PII in this table — an address that follows the device around rather
+        // than one captured once. It exists for one purpose: to notice that one
+        // key was used from two addresses inside a short window, which is what
+        // concurrentUseAt records. Nothing else reads it and nothing is refused
+        // by it, because addresses change legitimately all the time.
+        //
+        // It is NOT exposed. `listKeys` returns concurrentUseAt and never this,
+        // so the account surface can say "this device was in two places at once"
+        // without publishing a trail of where. Retention is the row's: it holds
+        // only the most recent observation, is overwritten on the next one, and
+        // goes with the key when the key is deleted.
+        //
+        // The literal string 'unknown' is never stored — getClientIp's fallback
+        // becomes NULL, which reads as "no observation" everywhere it is compared.
+        lastSeenIp: text4("last_seen_ip"),
+        // When lastSeenIp was written, which is the same moment lastUsedAt was
+        // The pair is what makes "within the window" answerable in one statement
+        lastSeenAt: utcTimestamp2("last_seen_at"),
+        // The last time this key was seen from an address different from the one
+        // recorded, within SPFN_AUTH_CONCURRENT_USE_WINDOW_MS of the previous
+        // sighting
+        // null: never observed, which is the ordinary state for every key
+        // Surfaced on listKeys as concurrentUseAtMillis for the owner to act on.
+        // A signal, never a refusal — a phone moving between wifi and cellular
+        // does this several times an hour, and so does a laptop behind a pool of
+        // egress addresses
+        concurrentUseAt: utcTimestamp2("concurrent_use_at"),
+        // Whether this key is bound to a passkey — decided by the server when the
+        // key was registered, from the owner's session_binding setting and
+        // whether the request came through the trusted Next.js proxy
+        // 'none' (default): a 90-day key, the behaviour that predates #97
+        // 'passkey': a short-lived key; only a fresh WebAuthn assertion renews it,
+        //   and a login that re-registers it does not extend its expiry
+        // Never read off a request body, and `platform` is not consulted: that
+        // field is display-only and a native client may declare any value it likes
+        binding: enumText2("binding", SESSION_BINDINGS).notNull().default("none"),
         // What the client said about itself on the last request signed by this key.
         //
         // The three come from x-spfn-client-kind, x-spfn-client-version and
@@ -5274,7 +5347,7 @@ var init_webauthn_challenges = __esm({
     "use strict";
     init_users();
     init_schema4();
-    WEBAUTHN_CHALLENGE_KINDS = ["registration", "authentication", "mfa"];
+    WEBAUTHN_CHALLENGE_KINDS = ["registration", "authentication", "mfa", "renewal"];
     webauthnChallenges = authSchema.table(
       "webauthn_challenges",
       {
@@ -6523,6 +6596,333 @@ var init_users_repository = __esm({
   }
 });
 
+// src/server/lib/key-policy.ts
+function decideKeyBinding(accountBinding, webProxy) {
+  return accountBinding === "passkey" && webProxy === true ? "passkey" : "none";
+}
+var KEY_TTL_DAYS, BOUND_KEY_TTL_HOURS, BOUND_KEY_RENEW_GRACE_HOURS, CONCURRENT_USE_WINDOW_MS;
+var init_key_policy = __esm({
+  "src/server/lib/key-policy.ts"() {
+    "use strict";
+    KEY_TTL_DAYS = 90;
+    BOUND_KEY_TTL_HOURS = 24;
+    BOUND_KEY_RENEW_GRACE_HOURS = 168;
+    CONCURRENT_USE_WINDOW_MS = 3e5;
+  }
+});
+
+// src/server/logger.ts
+import { logger as rootLogger } from "@spfn/core/logger";
+var authLogger;
+var init_logger = __esm({
+  "src/server/logger.ts"() {
+    "use strict";
+    authLogger = {
+      plugin: rootLogger.child("@spfn/auth:plugin"),
+      middleware: rootLogger.child("@spfn/auth:middleware"),
+      interceptor: {
+        general: rootLogger.child("@spfn/auth:interceptor:general"),
+        login: rootLogger.child("@spfn/auth:interceptor:login"),
+        keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
+        oauth: rootLogger.child("@spfn/auth:interceptor:oauth"),
+        csrf: rootLogger.child("@spfn/auth:interceptor:csrf")
+      },
+      session: rootLogger.child("@spfn/auth:session"),
+      service: rootLogger.child("@spfn/auth:service"),
+      setup: rootLogger.child("@spfn/auth:setup"),
+      email: rootLogger.child("@spfn/auth:email"),
+      sms: rootLogger.child("@spfn/auth:sms")
+    };
+  }
+});
+
+// src/server/lib/config.ts
+import { env as env3 } from "@spfn/auth/config";
+import { PasskeyConfigError } from "@spfn/auth/errors";
+function getCookieSuffix() {
+  const port = process.env.SPFN_PORT;
+  return port ? `_${port}` : "";
+}
+function matchOAuthCsrfCookies(cookies) {
+  return Object.entries(cookies).filter(([name]) => /^spfn_oauth_csrf(_\d+)?$/.test(name)).map(([name, value]) => ({ name, value }));
+}
+function parseDuration(duration) {
+  if (typeof duration === "number") {
+    return duration;
+  }
+  const match = duration.match(/^(\d+)([dhms]?)$/);
+  if (!match) {
+    throw new Error(`Invalid duration format: ${duration}. Use format like '30d', '12h', '45m', '3600s', or plain number.`);
+  }
+  const value = parseInt(match[1], 10);
+  const unit = match[2] || "s";
+  switch (unit) {
+    case "d":
+      return value * 24 * 60 * 60;
+    case "h":
+      return value * 60 * 60;
+    case "m":
+      return value * 60;
+    case "s":
+      return value;
+    default:
+      throw new Error(`Unknown duration unit: ${unit}`);
+  }
+}
+function configureAuth(config4) {
+  globalConfig = {
+    ...globalConfig,
+    ...config4
+  };
+}
+function getAuthConfig() {
+  return { ...globalConfig };
+}
+async function runBeforeRegister(context) {
+  const { beforeRegister } = globalConfig;
+  if (beforeRegister) {
+    await beforeRegister({ ...context, email: normalizeOptionalEmail(context.email) });
+  }
+}
+function getSessionTtl(override) {
+  if (override !== void 0) {
+    return parseDuration(override);
+  }
+  if (globalConfig.sessionTtl !== void 0) {
+    return parseDuration(globalConfig.sessionTtl);
+  }
+  const envTtl = env3.SPFN_AUTH_SESSION_TTL;
+  if (envTtl) {
+    return parseDuration(envTtl);
+  }
+  return 7 * 24 * 60 * 60;
+}
+function getCsrfMode() {
+  const configured2 = globalConfig.csrf?.mode ?? env3.SPFN_AUTH_CSRF;
+  if (!configured2) {
+    return "warn";
+  }
+  const normalized = String(configured2).trim().toLowerCase();
+  if (!CSRF_MODES.includes(normalized)) {
+    if (!unrecognizedCsrfModeReported) {
+      unrecognizedCsrfModeReported = true;
+      authLogger.interceptor.csrf.error(
+        `Unrecognized CSRF mode "${configured2}" \u2014 expected off | warn | enforce. Enforcing.`
+      );
+    }
+    return "enforce";
+  }
+  return normalized;
+}
+function getCsrfExemptPaths() {
+  return [...PACKAGE_CSRF_EXEMPT_PATHS, ...globalConfig.csrf?.exemptPaths ?? []];
+}
+function getBoundKeyTtlMs() {
+  return positiveOr(env3.SPFN_AUTH_BOUND_KEY_TTL_HOURS, BOUND_KEY_TTL_HOURS) * 60 * 60 * 1e3;
+}
+function getBoundKeyRenewGraceMs() {
+  return positiveOr(env3.SPFN_AUTH_BOUND_KEY_RENEW_GRACE_HOURS, BOUND_KEY_RENEW_GRACE_HOURS) * 60 * 60 * 1e3;
+}
+function getConcurrentUseWindowMs() {
+  return positiveOr(env3.SPFN_AUTH_CONCURRENT_USE_WINDOW_MS, CONCURRENT_USE_WINDOW_MS);
+}
+function getSessionRenewPath() {
+  return env3.SPFN_AUTH_SESSION_RENEW_PATH?.trim() || DEFAULT_SESSION_RENEW_PATH;
+}
+function positiveOr(configured2, fallback) {
+  return Number.isFinite(configured2) && configured2 > 0 ? configured2 : fallback;
+}
+function passkeyEnvSource() {
+  return { ...process.env, SPFN_APP_URL: process.env.SPFN_APP_URL || env3.SPFN_APP_URL };
+}
+function passkeyAppUrl(env21) {
+  const configured2 = env21.NEXT_PUBLIC_SPFN_APP_URL || env21.SPFN_APP_URL;
+  if (!configured2) {
+    throw new PasskeyConfigError({
+      message: "Passkeys need a relying party ID. Set SPFN_AUTH_PASSKEY_RP_ID, or set NEXT_PUBLIC_SPFN_APP_URL / SPFN_APP_URL to the app origin it should be derived from."
+    });
+  }
+  try {
+    return new URL(configured2);
+  } catch {
+    throw new PasskeyConfigError({
+      message: `Passkeys cannot derive a relying party ID: "${configured2}" is not a URL. Fix NEXT_PUBLIC_SPFN_APP_URL / SPFN_APP_URL, or set SPFN_AUTH_PASSKEY_RP_ID explicitly.`
+    });
+  }
+}
+function isLocalhost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function isUnderRpId(hostname, rpId) {
+  return hostname === rpId || hostname.endsWith(`.${rpId}`);
+}
+function assertOriginServesRpId(origin, rpId) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
+    throw new PasskeyConfigError({
+      message: `SPFN_AUTH_PASSKEY_ORIGINS contains "${origin}", which is not a URL. List full origins, e.g. https://app.example.com.`
+    });
+  }
+  if (url.protocol !== "https:" && !isLocalhost(url.hostname)) {
+    throw new PasskeyConfigError({
+      message: `Passkey origin "${origin}" is not https. WebAuthn runs only in a secure context, and localhost is the only host a browser treats as one over plain http.`
+    });
+  }
+  if (!isUnderRpId(url.hostname, rpId)) {
+    throw new PasskeyConfigError({
+      message: `Passkey origin "${origin}" is not on relying party ID "${rpId}". Each origin must be that host or a subdomain of it, or the browser refuses the ceremony.`
+    });
+  }
+}
+function resolveUserVerification(env21) {
+  const configured2 = env21.SPFN_AUTH_PASSKEY_USER_VERIFICATION;
+  if (!configured2) {
+    return "preferred";
+  }
+  const normalized = configured2.trim().toLowerCase();
+  if (!PASSKEY_USER_VERIFICATIONS.includes(normalized)) {
+    throw new PasskeyConfigError({
+      message: `SPFN_AUTH_PASSKEY_USER_VERIFICATION is "${configured2}" \u2014 expected preferred or required. A passkey is the whole credential here, so an assertion that skipped user verification would sign someone in on an unlocked device alone.`
+    });
+  }
+  return normalized;
+}
+function resolvePositiveNumber(env21, variable, fallback) {
+  const configured2 = env21[variable];
+  if (!configured2) {
+    return fallback;
+  }
+  const parsed = Number(configured2);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new PasskeyConfigError({
+      message: `${variable} is "${configured2}" \u2014 expected a positive number.`
+    });
+  }
+  return parsed;
+}
+function getPasskeyConfig(env21 = passkeyEnvSource()) {
+  const rpId = env21.SPFN_AUTH_PASSKEY_RP_ID?.trim() || passkeyAppUrl(env21).hostname;
+  const configuredOrigins = env21.SPFN_AUTH_PASSKEY_ORIGINS?.split(",").map((origin) => origin.trim()).filter(Boolean);
+  const origins = configuredOrigins?.length ? configuredOrigins : [passkeyAppUrl(env21).origin];
+  for (const origin of origins) {
+    assertOriginServesRpId(origin, rpId);
+  }
+  return {
+    rpId,
+    rpName: env21.SPFN_AUTH_PASSKEY_RP_NAME?.trim() || rpId,
+    origins,
+    userVerification: resolveUserVerification(env21),
+    challengeTtlMs: resolvePositiveNumber(
+      env21,
+      "SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS",
+      DEFAULT_CHALLENGE_TTL_SECONDS
+    ) * 1e3,
+    recentAuthMs: resolvePositiveNumber(
+      env21,
+      "SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES",
+      DEFAULT_RECENT_AUTH_MINUTES
+    ) * 6e4
+  };
+}
+function assertPasskeyConfig(env21 = passkeyEnvSource()) {
+  if (PASSKEY_VARS.some((variable) => env21[variable])) {
+    getPasskeyConfig(env21);
+    return;
+  }
+  try {
+    getPasskeyConfig(env21);
+  } catch (error) {
+    authLogger.service.info(
+      `Passkeys cannot be served with the configuration derived from the app URL, and no SPFN_AUTH_PASSKEY_* variable is set, so boot continues. ${error.message}`
+    );
+  }
+}
+function getMfaConfig() {
+  const configuredMinutes = Number(process.env.SPFN_AUTH_MFA_STEP_UP_MINUTES);
+  const minutes = Number.isFinite(configuredMinutes) && configuredMinutes > 0 ? configuredMinutes : DEFAULT_STEP_UP_MINUTES;
+  return {
+    issuer: process.env.SPFN_AUTH_MFA_ISSUER?.trim() || process.env.SPFN_AUTH_PASSKEY_RP_NAME?.trim() || mfaIssuerFromAppUrl() || DEFAULT_MFA_ISSUER,
+    stepUpWindowMs: minutes * 6e4
+  };
+}
+function mfaIssuerFromAppUrl() {
+  const configured2 = process.env.NEXT_PUBLIC_SPFN_APP_URL || process.env.SPFN_APP_URL;
+  if (!configured2) {
+    return null;
+  }
+  try {
+    return new URL(configured2).hostname;
+  } catch {
+    return null;
+  }
+}
+var COOKIE_NAMES, globalConfig, CSRF_MODES, unrecognizedCsrfModeReported, PACKAGE_CSRF_EXEMPT_PATHS, DEFAULT_SESSION_RENEW_PATH, PASSKEY_USER_VERIFICATIONS, DEFAULT_CHALLENGE_TTL_SECONDS, DEFAULT_RECENT_AUTH_MINUTES, PASSKEY_VARS, DEFAULT_MFA_ISSUER, DEFAULT_STEP_UP_MINUTES;
+var init_config = __esm({
+  "src/server/lib/config.ts"() {
+    "use strict";
+    init_key_policy();
+    init_email();
+    init_logger();
+    COOKIE_NAMES = {
+      /** Encrypted session data (userId, privateKey, keyId, algorithm) */
+      get SESSION() {
+        return `spfn_session${getCookieSuffix()}`;
+      },
+      /** Current key ID (for key rotation) */
+      get SESSION_KEY_ID() {
+        return `spfn_session_key_id${getCookieSuffix()}`;
+      },
+      /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
+      get OAUTH_PENDING() {
+        return `spfn_oauth_pending${getCookieSuffix()}`;
+      },
+      /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
+      get OAUTH_CSRF() {
+        return `spfn_oauth_csrf${getCookieSuffix()}`;
+      },
+      /** Password-setup session for verified-email signup — temporary, single-purpose */
+      get SIGNUP_SETUP() {
+        return `spfn_signup_setup${getCookieSuffix()}`;
+      },
+      /** Password-setup session for a password reset — temporary, single-purpose */
+      get PASSWORD_RESET_SETUP() {
+        return `spfn_password_reset_setup${getCookieSuffix()}`;
+      },
+      /** CSRF token — the only cookie here the browser can read */
+      get CSRF() {
+        return `spfn_csrf${getCookieSuffix()}`;
+      }
+    };
+    globalConfig = {
+      sessionTtl: "7d"
+      // Default: 7 days
+    };
+    CSRF_MODES = ["off", "warn", "enforce"];
+    unrecognizedCsrfModeReported = false;
+    PACKAGE_CSRF_EXEMPT_PATHS = [
+      "/_auth/oauth2/register",
+      "/_auth/oauth2/token",
+      "/_auth/oauth2/revoke"
+    ];
+    DEFAULT_SESSION_RENEW_PATH = "/auth/renew";
+    PASSKEY_USER_VERIFICATIONS = ["preferred", "required"];
+    DEFAULT_CHALLENGE_TTL_SECONDS = 300;
+    DEFAULT_RECENT_AUTH_MINUTES = 10;
+    PASSKEY_VARS = [
+      "SPFN_AUTH_PASSKEY_RP_ID",
+      "SPFN_AUTH_PASSKEY_RP_NAME",
+      "SPFN_AUTH_PASSKEY_ORIGINS",
+      "SPFN_AUTH_PASSKEY_USER_VERIFICATION",
+      "SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS",
+      "SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES"
+    ];
+    DEFAULT_MFA_ISSUER = "SPFN";
+    DEFAULT_STEP_UP_MINUTES = 10;
+  }
+});
+
 // src/server/repositories/keys.repository.ts
 import { BaseRepository as BaseRepository2 } from "@spfn/core/db";
 import { eq as eq2, and as and2, or, isNull, lt, desc, sql as sql5 } from "drizzle-orm";
@@ -6532,6 +6932,7 @@ var init_keys_repository = __esm({
     "use strict";
     init_user_public_keys();
     init_users();
+    init_config();
     LAST_USED_THROTTLE_MS = 6e4;
     KeysRepository = class extends BaseRepository2 {
       /**
@@ -6574,6 +6975,10 @@ var init_keys_repository = __esm({
        *
        * `includeRevoked`는 이미 끊은 기기까지 보여준다 — "내가 언제 무엇을 끊었나"를
        * 확인하는 용도라, 폐기 시각과 사유를 함께 고른다.
+       *
+       * `lastSeenIp` is not selected, deliberately. The concurrent-use moment is
+       * what the owner acts on; the trail of addresses behind it is stored PII the
+       * account surface has no use for.
        * Read replica 사용
        */
       async listForUser(userId, includeRevoked = false) {
@@ -6589,7 +6994,9 @@ var init_keys_repository = __esm({
           expiresAt: userPublicKeys.expiresAt,
           revokedAt: userPublicKeys.revokedAt,
           registeredIp: userPublicKeys.registeredIp,
-          registeredUserAgent: userPublicKeys.registeredUserAgent
+          registeredUserAgent: userPublicKeys.registeredUserAgent,
+          binding: userPublicKeys.binding,
+          concurrentUseAt: userPublicKeys.concurrentUseAt
         }).from(userPublicKeys).where(
           includeRevoked ? eq2(userPublicKeys.userId, userId) : and2(
             eq2(userPublicKeys.userId, userId),
@@ -6737,19 +7144,55 @@ var init_keys_repository = __esm({
         return result[0] ?? null;
       }
       /**
-       * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
+       * Bind one live key to the account's passkey, and give it the short life
+       * that goes with it.
        *
-       * 폐기(isActive=false)·만료(expiresAt 경과)를 SESSION_REVOKED로, 미등록을
-       * PROOF_INVALID로 구분해야 하므로 활성 필터 없이 조회한다. keyId는 UNIQUE.
-       * Read replica 사용
+       * Scoped by user and by `isActive`, like every other targeted update here, so
+       * the answer is "this call bound something" rather than "a row exists".
+       * Write primary 사용
        */
-      async findByKeyId(keyId) {
-        const result = await this.readDb.select().from(userPublicKeys).where(eq2(userPublicKeys.keyId, keyId)).limit(1);
-        return result[0] ?? null;
-      }
-      /**
-       * Key ID로 활성 공개키 조회 (authenticate용)
-       * Read replica 사용
+      async bindByKeyIdAndUserId(keyId, userId, expiresAt) {
+        const result = await this.db.update(userPublicKeys).set({ binding: "passkey", expiresAt }).where(
+          and2(
+            eq2(userPublicKeys.keyId, keyId),
+            eq2(userPublicKeys.userId, userId),
+            eq2(userPublicKeys.isActive, true)
+          )
+        ).returning();
+        return result[0] ?? null;
+      }
+      /**
+       * Return every one of a user's bound keys to an ordinary long-lived key.
+       *
+       * One statement, because turning the setting off has to leave no key behind:
+       * a row still marked `'passkey'` would keep expiring in hours with nothing
+       * left to renew it, and its owner has just said they do not want that.
+       * Write primary 사용
+       */
+      async unbindActiveByUserId(userId, expiresAt) {
+        const result = await this.db.update(userPublicKeys).set({ binding: "none", expiresAt }).where(
+          and2(
+            eq2(userPublicKeys.userId, userId),
+            eq2(userPublicKeys.isActive, true),
+            eq2(userPublicKeys.binding, "passkey")
+          )
+        ).returning();
+        return result.length;
+      }
+      /**
+       * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
+       *
+       * 폐기(isActive=false)·만료(expiresAt 경과)를 SESSION_REVOKED로, 미등록을
+       * PROOF_INVALID로 구분해야 하므로 활성 필터 없이 조회한다. keyId는 UNIQUE.
+       * Read replica 사용
+       */
+      async findByKeyId(keyId) {
+        const result = await this.readDb.select().from(userPublicKeys).where(eq2(userPublicKeys.keyId, keyId)).limit(1);
+        return result[0] ?? null;
+      }
+      /**
+       * Key ID로 활성 공개키 조회 (authenticate용)
+       * Read replica 사용
        */
       async findActiveByKeyId(keyId) {
         const result = await this.readDb.select().from(userPublicKeys).where(
@@ -6779,35 +7222,75 @@ var init_keys_repository = __esm({
        * `clientSeenAt` moves only when one of the three values differs from what is
        * stored, so it answers "since when has this device been on this release"
        * rather than "when was it last seen", which lastUsedAt already answers.
+       *
+       * `ip` is the client address this request resolved to, or null when none did.
+       * It joins this statement rather than getting one of its own: the rule the
+       * concurrent-use signal needs — write the address, and move
+       * `concurrentUseAt` when it differs from the stored one inside the window —
+       * is the rule already implemented here, and a second fire-and-forget write
+       * beside it would double the per-request write on the authenticated path. It
+       * is also why the comparison is a `CASE` over the stored value rather than a
+       * read followed by a write: the row comes off the read replica, and a
+       * replica-lagged address compared in application code both misses real
+       * switches and invents ones that did not happen.
        */
-      async updateLastUsedById(id25, identity) {
+      async updateLastUsedById(id25, identity, ip) {
+        const now = /* @__PURE__ */ new Date();
+        const nowParam = sql5`${now.toISOString()}::timestamptz`;
         const staleBefore = new Date(Date.now() - LAST_USED_THROTTLE_MS);
         const lastUsedIsStale = or(
           isNull(userPublicKeys.lastUsedAt),
           lt(userPublicKeys.lastUsedAt, staleBefore)
         );
-        if (!identity) {
-          await this.db.update(userPublicKeys).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(and2(eq2(userPublicKeys.id, id25), lastUsedIsStale));
-          return;
-        }
-        const identityChanged = sql5`(
-            ${userPublicKeys.clientKind} IS DISTINCT FROM ${identity.kind}
-            OR ${userPublicKeys.clientVersion} IS DISTINCT FROM ${identity.version}
-            OR ${userPublicKeys.clientContractVersion} IS DISTINCT FROM ${identity.contractVersion}
+        const ipChanged = sql5`(
+            ${ip ?? null}::text IS NOT NULL
+            AND ${userPublicKeys.lastSeenIp} IS DISTINCT FROM ${ip ?? null}::text
         )`;
-        const now = /* @__PURE__ */ new Date();
-        const nowParam = sql5`${now.toISOString()}::timestamptz`;
+        const notStampedThisWindow = sql5`(
+            ${userPublicKeys.concurrentUseAt} IS NULL
+            OR ${userPublicKeys.concurrentUseAt} < ${this.concurrentUseSince(now)}
+        )`;
+        const identityChanged = identity ? sql5`(
+                ${userPublicKeys.clientKind} IS DISTINCT FROM ${identity.kind}
+                OR ${userPublicKeys.clientVersion} IS DISTINCT FROM ${identity.version}
+                OR ${userPublicKeys.clientContractVersion} IS DISTINCT FROM ${identity.contractVersion}
+            )` : sql5`false`;
         await this.db.update(userPublicKeys).set({
           lastUsedAt: now,
-          clientKind: identity.kind,
-          clientVersion: identity.version,
-          clientContractVersion: identity.contractVersion,
-          clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
+          lastSeenIp: ip ?? null,
+          lastSeenAt: now,
+          // `last_seen_ip IS NOT NULL` is the second observation this needs:
+          // a request whose address did not resolve stores NULL and stamps
+          // `last_seen_at`, so without it the next ordinary request would
+          // read as an address change and raise the signal from one device
+          // that never moved.
+          concurrentUseAt: sql5`CASE WHEN ${ipChanged}
+                    AND ${userPublicKeys.lastSeenIp} IS NOT NULL
+                    AND ${userPublicKeys.lastSeenAt} > ${this.concurrentUseSince(now)}
+                    THEN ${nowParam} ELSE ${userPublicKeys.concurrentUseAt} END`,
+          ...identity ? {
+            clientKind: identity.kind,
+            clientVersion: identity.version,
+            clientContractVersion: identity.contractVersion,
+            clientSeenAt: sql5`CASE WHEN ${identityChanged} THEN ${nowParam} ELSE ${userPublicKeys.clientSeenAt} END`
+          } : {}
         }).where(and2(
           eq2(userPublicKeys.id, id25),
-          or(lastUsedIsStale, identityChanged)
+          or(lastUsedIsStale, identityChanged, sql5`(${ipChanged} AND ${notStampedThisWindow})`)
         ));
       }
+      /**
+       * The boundary a previous sighting has to be newer than to count as concurrent.
+       *
+       * Computed here rather than written as `now() - interval` so that the moment
+       * the row is stamped with and the moment the window is measured from are the
+       * same one — a statement that used the database clock for the boundary and
+       * ours for the value would disagree with itself by the round trip.
+       */
+      concurrentUseSince(now) {
+        const since = new Date(now.getTime() - getConcurrentUseWindowMs());
+        return sql5`${since.toISOString()}::timestamptz`;
+      }
     };
     keysRepository = new KeysRepository();
   }
@@ -8884,6 +9367,43 @@ var init_schema5 = __esm({
         })
       },
       // ============================================================================
+      // Session binding (#97)
+      // ============================================================================
+      SPFN_AUTH_BOUND_KEY_TTL_HOURS: {
+        ...envNumber({
+          description: "How long a session key bound to a passkey lives. This is the window in which a copied session cookie is still indistinguishable from the original, so it is hours rather than days; past it the browser runs one WebAuthn ceremony and gets a new key. Only applies to accounts that turned session binding on.",
+          default: 24,
+          required: false,
+          examples: [8, 24, 72]
+        })
+      },
+      SPFN_AUTH_BOUND_KEY_RENEW_GRACE_HOURS: {
+        ...envNumber({
+          description: "How long after a bound key expires a passkey renewal is still offered. Past it the account signs in again. Open-ended grace would make an expired key a long-lived key with extra steps.",
+          default: 168,
+          required: false,
+          examples: [24, 168, 720]
+        })
+      },
+      SPFN_AUTH_CONCURRENT_USE_WINDOW_MS: {
+        ...envNumber({
+          description: "How far apart two sightings of one device key from two client addresses still count as concurrent use, surfaced as `concurrentUseAtMillis` on the key list. A signal for the owner to read, never a refusal \u2014 addresses change legitimately. Meaningful only where proxy-guard is configured, since without it every web request carries the Next.js server's address.",
+          default: 3e5,
+          required: false,
+          examples: [6e4, 3e5, 9e5]
+        })
+      },
+      SPFN_AUTH_SESSION_RENEW_PATH: {
+        ...envString({
+          description: "Page in your app that runs the renewal ceremony. `RequireAuth` redirects a bound session whose key expired here instead of to the sign-in page; the page calls `renewSession(api)` and returns the user to where they were. Override per guard with the `renewalPath` prop.",
+          default: "/auth/renew",
+          required: false,
+          nextjs: true,
+          // Read by RequireAuth, which renders in the Next.js runtime
+          examples: ["/auth/renew", "/session/renew"]
+        })
+      },
+      // ============================================================================
       // API Configuration
       // ============================================================================
       SPFN_API_URL: {
@@ -9142,21 +9662,21 @@ var init_schema5 = __esm({
 
 // src/config/index.ts
 import { createEnvRegistry } from "@spfn/core/env";
-var registry, env3;
-var init_config = __esm({
+var registry, env4;
+var init_config2 = __esm({
   "src/config/index.ts"() {
     "use strict";
     init_schema5();
     init_schema5();
     registry = createEnvRegistry(authEnvSchema);
-    env3 = registry.validate();
+    env4 = registry.validate();
   }
 });
 
 // src/server/lib/oauth/token-cipher.ts
 import crypto3 from "crypto";
 function getEncryptionKeyring() {
-  const raw = env3.SPFN_AUTH_TOKEN_ENCRYPTION_KEYS;
+  const raw = env4.SPFN_AUTH_TOKEN_ENCRYPTION_KEYS;
   if (!raw) {
     return [];
   }
@@ -9226,7 +9746,7 @@ function decryptAesGcm(payload, encoding, key, aad) {
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
 function getLegacyV1Key() {
-  return crypto3.createHash("sha256").update(`social-token:${env3.SPFN_AUTH_SESSION_SECRET}`).digest();
+  return crypto3.createHash("sha256").update(`social-token:${env4.SPFN_AUTH_SESSION_SECRET}`).digest();
 }
 function configureOAuthTokenCipher(cipher) {
   configuredCipher = cipher;
@@ -9244,7 +9764,7 @@ var V1_PREFIX, V2_PREFIX, ENCRYPTED_PREFIX, IV_BYTES, TAG_BYTES, KEY_BYTES, KEY_
 var init_token_cipher = __esm({
   "src/server/lib/oauth/token-cipher.ts"() {
     "use strict";
-    init_config();
+    init_config2();
     V1_PREFIX = "enc:v1:";
     V2_PREFIX = "enc:v2:";
     ENCRYPTED_PREFIX = "enc:";
@@ -10344,7 +10864,7 @@ function getKeyId(c) {
 // src/server/routes/auth/index.ts
 init_types();
 import { KeyNotFoundError } from "@spfn/auth/errors";
-import { ValidationError as ValidationError14 } from "@spfn/core/errors";
+import { ValidationError as ValidationError15 } from "@spfn/core/errors";
 
 // src/server/services/auth.service.ts
 init_repositories();
@@ -10361,28 +10881,8 @@ import {
 
 // src/server/services/oauth2-grant.service.ts
 init_oauth2_grants_repository();
+init_logger();
 import { OAuth2GrantNotFoundError } from "@spfn/auth/errors";
-
-// src/server/logger.ts
-import { logger as rootLogger } from "@spfn/core/logger";
-var authLogger = {
-  plugin: rootLogger.child("@spfn/auth:plugin"),
-  middleware: rootLogger.child("@spfn/auth:middleware"),
-  interceptor: {
-    general: rootLogger.child("@spfn/auth:interceptor:general"),
-    login: rootLogger.child("@spfn/auth:interceptor:login"),
-    keyRotation: rootLogger.child("@spfn/auth:interceptor:key-rotation"),
-    oauth: rootLogger.child("@spfn/auth:interceptor:oauth"),
-    csrf: rootLogger.child("@spfn/auth:interceptor:csrf")
-  },
-  session: rootLogger.child("@spfn/auth:session"),
-  service: rootLogger.child("@spfn/auth:service"),
-  setup: rootLogger.child("@spfn/auth:setup"),
-  email: rootLogger.child("@spfn/auth:email"),
-  sms: rootLogger.child("@spfn/auth:sms")
-};
-
-// src/server/services/oauth2-grant.service.ts
 async function listOAuth2GrantsService(userId) {
   const rows = await oauth2GrantsRepository.listActiveByUserId(userId);
   return rows.map(({ grant, client }) => ({
@@ -10395,299 +10895,41 @@ async function listOAuth2GrantsService(userId) {
     lastUsedAtMillis: client.lastUsedAt?.getTime()
   }));
 }
-async function revokeOAuth2GrantService(id25, userId) {
-  const revoked = await oauth2GrantsRepository.revokeByIdForUser(id25, userId);
-  if (!revoked) {
-    throw new OAuth2GrantNotFoundError();
-  }
-  await oauth2GrantsRepository.revokeTokensOfGrants([revoked.id]);
-}
-async function revokeAllOAuth2GrantsForUser(userId) {
-  const grantIds = await oauth2GrantsRepository.revokeAllActiveByUserId(userId);
-  if (grantIds.length === 0) {
-    return;
-  }
-  const tokens = await oauth2GrantsRepository.revokeTokensOfGrants(grantIds);
-  authLogger.service.info("OAuth2 grants revoked for a user", {
-    userId,
-    grants: grantIds.length,
-    tokens
-  });
-}
-
-// src/server/lib/config.ts
-init_email();
-import { env as env4 } from "@spfn/auth/config";
-import { PasskeyConfigError } from "@spfn/auth/errors";
-function getCookieSuffix() {
-  const port = process.env.SPFN_PORT;
-  return port ? `_${port}` : "";
-}
-var COOKIE_NAMES = {
-  /** Encrypted session data (userId, privateKey, keyId, algorithm) */
-  get SESSION() {
-    return `spfn_session${getCookieSuffix()}`;
-  },
-  /** Current key ID (for key rotation) */
-  get SESSION_KEY_ID() {
-    return `spfn_session_key_id${getCookieSuffix()}`;
-  },
-  /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
-  get OAUTH_PENDING() {
-    return `spfn_oauth_pending${getCookieSuffix()}`;
-  },
-  /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
-  get OAUTH_CSRF() {
-    return `spfn_oauth_csrf${getCookieSuffix()}`;
-  },
-  /** Password-setup session for verified-email signup — temporary, single-purpose */
-  get SIGNUP_SETUP() {
-    return `spfn_signup_setup${getCookieSuffix()}`;
-  },
-  /** Password-setup session for a password reset — temporary, single-purpose */
-  get PASSWORD_RESET_SETUP() {
-    return `spfn_password_reset_setup${getCookieSuffix()}`;
-  },
-  /** CSRF token — the only cookie here the browser can read */
-  get CSRF() {
-    return `spfn_csrf${getCookieSuffix()}`;
-  }
-};
-function matchOAuthCsrfCookies(cookies) {
-  return Object.entries(cookies).filter(([name]) => /^spfn_oauth_csrf(_\d+)?$/.test(name)).map(([name, value]) => ({ name, value }));
-}
-function parseDuration(duration) {
-  if (typeof duration === "number") {
-    return duration;
-  }
-  const match = duration.match(/^(\d+)([dhms]?)$/);
-  if (!match) {
-    throw new Error(`Invalid duration format: ${duration}. Use format like '30d', '12h', '45m', '3600s', or plain number.`);
-  }
-  const value = parseInt(match[1], 10);
-  const unit = match[2] || "s";
-  switch (unit) {
-    case "d":
-      return value * 24 * 60 * 60;
-    case "h":
-      return value * 60 * 60;
-    case "m":
-      return value * 60;
-    case "s":
-      return value;
-    default:
-      throw new Error(`Unknown duration unit: ${unit}`);
-  }
-}
-var globalConfig = {
-  sessionTtl: "7d"
-  // Default: 7 days
-};
-function configureAuth(config4) {
-  globalConfig = {
-    ...globalConfig,
-    ...config4
-  };
-}
-function getAuthConfig() {
-  return { ...globalConfig };
-}
-async function runBeforeRegister(context) {
-  const { beforeRegister } = globalConfig;
-  if (beforeRegister) {
-    await beforeRegister({ ...context, email: normalizeOptionalEmail(context.email) });
-  }
-}
-function getSessionTtl(override) {
-  if (override !== void 0) {
-    return parseDuration(override);
-  }
-  if (globalConfig.sessionTtl !== void 0) {
-    return parseDuration(globalConfig.sessionTtl);
-  }
-  const envTtl = env4.SPFN_AUTH_SESSION_TTL;
-  if (envTtl) {
-    return parseDuration(envTtl);
-  }
-  return 7 * 24 * 60 * 60;
-}
-var CSRF_MODES = ["off", "warn", "enforce"];
-var unrecognizedCsrfModeReported = false;
-function getCsrfMode() {
-  const configured2 = globalConfig.csrf?.mode ?? env4.SPFN_AUTH_CSRF;
-  if (!configured2) {
-    return "warn";
-  }
-  const normalized = String(configured2).trim().toLowerCase();
-  if (!CSRF_MODES.includes(normalized)) {
-    if (!unrecognizedCsrfModeReported) {
-      unrecognizedCsrfModeReported = true;
-      authLogger.interceptor.csrf.error(
-        `Unrecognized CSRF mode "${configured2}" \u2014 expected off | warn | enforce. Enforcing.`
-      );
-    }
-    return "enforce";
-  }
-  return normalized;
-}
-var PACKAGE_CSRF_EXEMPT_PATHS = [
-  "/_auth/oauth2/register",
-  "/_auth/oauth2/token",
-  "/_auth/oauth2/revoke"
-];
-function getCsrfExemptPaths() {
-  return [...PACKAGE_CSRF_EXEMPT_PATHS, ...globalConfig.csrf?.exemptPaths ?? []];
-}
-var PASSKEY_USER_VERIFICATIONS = ["preferred", "required"];
-var DEFAULT_CHALLENGE_TTL_SECONDS = 300;
-var DEFAULT_RECENT_AUTH_MINUTES = 10;
-function passkeyEnvSource() {
-  return { ...process.env, SPFN_APP_URL: process.env.SPFN_APP_URL || env4.SPFN_APP_URL };
-}
-function passkeyAppUrl(env21) {
-  const configured2 = env21.NEXT_PUBLIC_SPFN_APP_URL || env21.SPFN_APP_URL;
-  if (!configured2) {
-    throw new PasskeyConfigError({
-      message: "Passkeys need a relying party ID. Set SPFN_AUTH_PASSKEY_RP_ID, or set NEXT_PUBLIC_SPFN_APP_URL / SPFN_APP_URL to the app origin it should be derived from."
-    });
-  }
-  try {
-    return new URL(configured2);
-  } catch {
-    throw new PasskeyConfigError({
-      message: `Passkeys cannot derive a relying party ID: "${configured2}" is not a URL. Fix NEXT_PUBLIC_SPFN_APP_URL / SPFN_APP_URL, or set SPFN_AUTH_PASSKEY_RP_ID explicitly.`
-    });
-  }
-}
-function isLocalhost(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function isUnderRpId(hostname, rpId) {
-  return hostname === rpId || hostname.endsWith(`.${rpId}`);
-}
-function assertOriginServesRpId(origin, rpId) {
-  let url;
-  try {
-    url = new URL(origin);
-  } catch {
-    throw new PasskeyConfigError({
-      message: `SPFN_AUTH_PASSKEY_ORIGINS contains "${origin}", which is not a URL. List full origins, e.g. https://app.example.com.`
-    });
-  }
-  if (url.protocol !== "https:" && !isLocalhost(url.hostname)) {
-    throw new PasskeyConfigError({
-      message: `Passkey origin "${origin}" is not https. WebAuthn runs only in a secure context, and localhost is the only host a browser treats as one over plain http.`
-    });
-  }
-  if (!isUnderRpId(url.hostname, rpId)) {
-    throw new PasskeyConfigError({
-      message: `Passkey origin "${origin}" is not on relying party ID "${rpId}". Each origin must be that host or a subdomain of it, or the browser refuses the ceremony.`
-    });
-  }
-}
-function resolveUserVerification(env21) {
-  const configured2 = env21.SPFN_AUTH_PASSKEY_USER_VERIFICATION;
-  if (!configured2) {
-    return "preferred";
-  }
-  const normalized = configured2.trim().toLowerCase();
-  if (!PASSKEY_USER_VERIFICATIONS.includes(normalized)) {
-    throw new PasskeyConfigError({
-      message: `SPFN_AUTH_PASSKEY_USER_VERIFICATION is "${configured2}" \u2014 expected preferred or required. A passkey is the whole credential here, so an assertion that skipped user verification would sign someone in on an unlocked device alone.`
-    });
-  }
-  return normalized;
-}
-function resolvePositiveNumber(env21, variable, fallback) {
-  const configured2 = env21[variable];
-  if (!configured2) {
-    return fallback;
-  }
-  const parsed = Number(configured2);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new PasskeyConfigError({
-      message: `${variable} is "${configured2}" \u2014 expected a positive number.`
-    });
-  }
-  return parsed;
-}
-function getPasskeyConfig(env21 = passkeyEnvSource()) {
-  const rpId = env21.SPFN_AUTH_PASSKEY_RP_ID?.trim() || passkeyAppUrl(env21).hostname;
-  const configuredOrigins = env21.SPFN_AUTH_PASSKEY_ORIGINS?.split(",").map((origin) => origin.trim()).filter(Boolean);
-  const origins = configuredOrigins?.length ? configuredOrigins : [passkeyAppUrl(env21).origin];
-  for (const origin of origins) {
-    assertOriginServesRpId(origin, rpId);
-  }
-  return {
-    rpId,
-    rpName: env21.SPFN_AUTH_PASSKEY_RP_NAME?.trim() || rpId,
-    origins,
-    userVerification: resolveUserVerification(env21),
-    challengeTtlMs: resolvePositiveNumber(
-      env21,
-      "SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS",
-      DEFAULT_CHALLENGE_TTL_SECONDS
-    ) * 1e3,
-    recentAuthMs: resolvePositiveNumber(
-      env21,
-      "SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES",
-      DEFAULT_RECENT_AUTH_MINUTES
-    ) * 6e4
-  };
-}
-var PASSKEY_VARS = [
-  "SPFN_AUTH_PASSKEY_RP_ID",
-  "SPFN_AUTH_PASSKEY_RP_NAME",
-  "SPFN_AUTH_PASSKEY_ORIGINS",
-  "SPFN_AUTH_PASSKEY_USER_VERIFICATION",
-  "SPFN_AUTH_PASSKEY_CHALLENGE_TTL_SECONDS",
-  "SPFN_AUTH_PASSKEY_RECENT_AUTH_MINUTES"
-];
-function assertPasskeyConfig(env21 = passkeyEnvSource()) {
-  if (PASSKEY_VARS.some((variable) => env21[variable])) {
-    getPasskeyConfig(env21);
-    return;
-  }
-  try {
-    getPasskeyConfig(env21);
-  } catch (error) {
-    authLogger.service.info(
-      `Passkeys cannot be served with the configuration derived from the app URL, and no SPFN_AUTH_PASSKEY_* variable is set, so boot continues. ${error.message}`
-    );
-  }
-}
-var DEFAULT_MFA_ISSUER = "SPFN";
-var DEFAULT_STEP_UP_MINUTES = 10;
-function getMfaConfig() {
-  const configuredMinutes = Number(process.env.SPFN_AUTH_MFA_STEP_UP_MINUTES);
-  const minutes = Number.isFinite(configuredMinutes) && configuredMinutes > 0 ? configuredMinutes : DEFAULT_STEP_UP_MINUTES;
-  return {
-    issuer: process.env.SPFN_AUTH_MFA_ISSUER?.trim() || process.env.SPFN_AUTH_PASSKEY_RP_NAME?.trim() || mfaIssuerFromAppUrl() || DEFAULT_MFA_ISSUER,
-    stepUpWindowMs: minutes * 6e4
-  };
-}
-function mfaIssuerFromAppUrl() {
-  const configured2 = process.env.NEXT_PUBLIC_SPFN_APP_URL || process.env.SPFN_APP_URL;
-  if (!configured2) {
-    return null;
+async function revokeOAuth2GrantService(id25, userId) {
+  const revoked = await oauth2GrantsRepository.revokeByIdForUser(id25, userId);
+  if (!revoked) {
+    throw new OAuth2GrantNotFoundError();
   }
-  try {
-    return new URL(configured2).hostname;
-  } catch {
-    return null;
+  await oauth2GrantsRepository.revokeTokensOfGrants([revoked.id]);
+}
+async function revokeAllOAuth2GrantsForUser(userId) {
+  const grantIds = await oauth2GrantsRepository.revokeAllActiveByUserId(userId);
+  if (grantIds.length === 0) {
+    return;
   }
+  const tokens = await oauth2GrantsRepository.revokeTokensOfGrants(grantIds);
+  authLogger.service.info("OAuth2 grants revoked for a user", {
+    userId,
+    grants: grantIds.length,
+    tokens
+  });
 }
 
+// src/server/services/auth.service.ts
+init_config();
+
 // src/server/services/verification.service.ts
+init_logger();
+init_email();
+init_repositories();
 import crypto5 from "crypto";
 import { env as env8 } from "@spfn/auth/config";
 import { InvalidVerificationCodeError } from "@spfn/auth/errors";
 import jwt2 from "jsonwebtoken";
 import { sendEmail as sendEmail2, sendSMS as sendSMS2 } from "@spfn/notification/server";
-init_email();
-init_repositories();
 
 // src/server/lib/link-mail-delivery.ts
+init_logger();
 import { env as env7 } from "@spfn/auth/config";
 import { getBoss } from "@spfn/core/job";
 
@@ -10697,6 +10939,7 @@ init_schema3();
 import { job } from "@spfn/core/job";
 
 // src/server/services/link-mail.service.ts
+init_logger();
 import { env as env6 } from "@spfn/auth/config";
 import { sendEmail, sendSMS } from "@spfn/notification/server";
 
@@ -11019,8 +11262,23 @@ async function verifyCodeService(params) {
   };
 }
 
-// src/server/lib/key-policy.ts
-var KEY_TTL_DAYS = 90;
+// src/server/services/key.service.ts
+init_key_policy();
+init_config();
+
+// src/server/lib/ua-family.ts
+var FAMILY_MARKERS = [
+  { family: "edge", marker: /\bEdg(?:A|iOS)?\// },
+  { family: "chrome", marker: /\b(?:Chrome|CriOS)\// },
+  { family: "firefox", marker: /\b(?:Firefox|FxiOS)\// },
+  { family: "safari", marker: /\bSafari\// }
+];
+function uaFamily(userAgent) {
+  if (!userAgent) {
+    return "other";
+  }
+  return FAMILY_MARKERS.find((entry) => entry.marker.test(userAgent))?.family ?? "other";
+}
 
 // src/server/services/key.service.ts
 init_repositories();
@@ -11065,7 +11323,8 @@ var DeviceRegistrationChannelSchema = Type.Union([
   Type.Literal("oauth-native"),
   Type.Literal("device-code"),
   Type.Literal("password-reset"),
-  Type.Literal("passkey")
+  Type.Literal("passkey"),
+  Type.Literal("renewal")
 ]);
 var authDeviceRegisteredEvent = defineEvent(
   "auth.device.registered",
@@ -11175,6 +11434,8 @@ var authPasswordResetEvent = defineEvent(
 );
 
 // src/server/services/mfa.service.ts
+init_logger();
+init_config();
 import { onAfterCommit, runInTransaction as runInTransaction2 } from "@spfn/core/db";
 import { ValidationError } from "@spfn/core/errors";
 import {
@@ -11466,8 +11727,9 @@ init_repositories();
 init_mfa_totp();
 
 // src/server/services/webauthn-challenge.service.ts
-import crypto9 from "crypto";
+init_config();
 init_repositories();
+import crypto9 from "crypto";
 var CHALLENGE_BYTES = 32;
 async function mintChallenge(kind, userId) {
   const challenge = crypto9.randomBytes(CHALLENGE_BYTES).toString("base64url");
@@ -11715,7 +11977,10 @@ async function emitDeviceRegistered(row, channel) {
 // src/server/services/key.service.ts
 var KEY_FINGERPRINT_PREFIX_LENGTH = 8;
 var DEFAULT_KEY_ALGORITHM = "ES256";
-function getKeyExpiryDate() {
+function getKeyExpiryDate(binding) {
+  if (binding === "passkey") {
+    return new Date(Date.now() + getBoundKeyTtlMs());
+  }
   const expiresAt = /* @__PURE__ */ new Date();
   expiresAt.setDate(expiresAt.getDate() + KEY_TTL_DAYS);
   return expiresAt;
@@ -11725,13 +11990,11 @@ function isExpired(expiresAt) {
 }
 async function registerPublicKeyService(params) {
   const { userId, keyId, publicKey, fingerprint, algorithm = DEFAULT_KEY_ALGORITHM, deviceName, platform } = params;
+  const binding = params.binding ?? "none";
   const existing = await keysRepository.findByKeyId(keyId);
   if (existing) {
     if (existing.userId === userId && existing.isActive) {
-      if (isExpired(existing.expiresAt)) {
-        await keysRepository.extendExpiry(keyId, userId, getKeyExpiryDate());
-      }
-      return;
+      return await reRegisterOwnActiveKey(existing, userId);
     }
     throw new KeyIdAlreadyRegisteredError();
   }
@@ -11748,16 +12011,27 @@ async function registerPublicKeyService(params) {
     fingerprint,
     deviceName,
     platform,
+    binding,
     registeredIp: params.ip ?? null,
     registeredUserAgent: params.userAgent ?? null,
+    registeredUaFamily: params.userAgent ? uaFamily(params.userAgent) : null,
     isActive: true,
-    expiresAt: getKeyExpiryDate()
+    expiresAt: getKeyExpiryDate(binding)
   });
-  if (!params.replacesKeyId) {
+  if (params.replacesKeyId) {
+    await carryStepUpVerification(userId, params.replacesKeyId, keyId);
+  } else {
     await emitDeviceRegistered(row, params.channel);
-    return;
   }
-  await carryStepUpVerification(userId, params.replacesKeyId, keyId);
+  return { binding, expiresAt: row.expiresAt };
+}
+async function reRegisterOwnActiveKey(existing, userId) {
+  if (existing.binding !== "passkey" && isExpired(existing.expiresAt)) {
+    const extended = getKeyExpiryDate("none");
+    await keysRepository.extendExpiry(existing.keyId, userId, extended);
+    return { binding: "none", expiresAt: extended };
+  }
+  return { binding: existing.binding, expiresAt: existing.expiresAt };
 }
 async function rotateKeyService(params) {
   const { userId, oldKeyId, newKeyId, newPublicKey, fingerprint, algorithm = DEFAULT_KEY_ALGORITHM } = params;
@@ -11780,8 +12054,12 @@ async function rotateKeyService(params) {
     fingerprint,
     deviceName: params.deviceName ?? replaced?.deviceName ?? void 0,
     platform: params.platform ?? replaced?.platform ?? void 0,
+    binding: replaced?.binding ?? "none",
+    registeredIp: replaced?.registeredIp ?? null,
+    registeredUserAgent: replaced?.registeredUserAgent ?? null,
+    registeredUaFamily: replaced?.registeredUaFamily ?? null,
     isActive: true,
-    expiresAt: getKeyExpiryDate()
+    expiresAt: replaced?.binding === "passkey" ? replaced.expiresAt : getKeyExpiryDate("none")
   });
   await carryStepUpVerification(userId, oldKeyId, newKeyId);
   return {
@@ -11809,7 +12087,9 @@ async function listKeysService(params) {
     isActive: row.isActive,
     revokedAtMillis: row.revokedAt?.getTime(),
     registeredIp: row.registeredIp ?? void 0,
-    registeredUserAgent: row.registeredUserAgent ?? void 0
+    registeredUserAgent: row.registeredUserAgent ?? void 0,
+    binding: row.binding === "passkey" ? row.binding : void 0,
+    concurrentUseAtMillis: row.concurrentUseAt?.getTime()
   }));
 }
 async function revokeAllKeysService(params) {
@@ -11826,6 +12106,9 @@ async function revokeAllKeysService(params) {
   return { revokedCount: revoked.length, currentKeyRevoked: includeCurrent };
 }
 
+// src/server/services/auth.service.ts
+init_key_policy();
+
 // src/server/services/user.service.ts
 init_repositories();
 import { ValidationError as ValidationError3 } from "@spfn/core/errors";
@@ -11940,6 +12223,7 @@ function getDeletionConfig() {
 }
 
 // src/server/services/account-deletion.service.ts
+init_logger();
 var POSTGRES_UNIQUE_VIOLATION = "23505";
 function isUniqueViolation(error) {
   return typeof error === "object" && error !== null && error.code === POSTGRES_UNIQUE_VIOLATION;
@@ -12224,6 +12508,12 @@ async function sweepDuePurges(now = /* @__PURE__ */ new Date()) {
 }
 
 // src/server/services/auth.service.ts
+function loginBindingFields(registered) {
+  if (registered.binding !== "passkey" || !registered.expiresAt) {
+    return {};
+  }
+  return { sessionBinding: "passkey", keyExpiresAtMillis: registered.expiresAt.getTime() };
+}
 async function registerService(params) {
   const { email, verificationToken } = params;
   const phone = params.phone?.trim();
@@ -12327,7 +12617,7 @@ async function loginService(params) {
     });
     replacesKeyId = revoked ? oldKeyId : void 0;
   }
-  await registerPublicKeyService({
+  const registered = await registerPublicKeyService({
     userId: user.id,
     keyId,
     publicKey,
@@ -12338,6 +12628,7 @@ async function loginService(params) {
     channel: "password",
     ip: params.ip,
     userAgent: params.userAgent,
+    binding: decideKeyBinding(user.sessionBinding, params.webProxy),
     replacesKeyId
   });
   await updateLastLoginService(user.id);
@@ -12346,7 +12637,8 @@ async function loginService(params) {
     publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
-    passwordChangeRequired: user.passwordChangeRequired
+    passwordChangeRequired: user.passwordChangeRequired,
+    ...loginBindingFields(registered)
   };
   await authLoginEvent.emit({
     userId: result.userId,
@@ -12395,9 +12687,10 @@ async function changePasswordService(params) {
 }
 
 // src/server/services/signup-link.service.ts
+init_logger();
+init_repositories();
 import { env as env10 } from "@spfn/auth/config";
 import { InvalidSignupLinkError, InvalidSignupSetupSessionError } from "@spfn/auth/errors";
-init_repositories();
 
 // src/lib/return-path.ts
 var URL_STRIPPED_CHARACTER = /[\t\n\r]/;
@@ -12524,11 +12817,13 @@ async function completeSignupService(params) {
 }
 
 // src/server/services/password-reset.service.ts
+init_logger();
+init_repositories();
 import { env as env11 } from "@spfn/auth/config";
 import { PasswordResetLinkError, PasswordResetSessionError } from "@spfn/auth/errors";
 import { ValidationError as ValidationError6 } from "@spfn/core/errors";
 import { onAfterCommit as onAfterCommit4 } from "@spfn/core/db";
-init_repositories();
+init_key_policy();
 async function activeUserOf(userId) {
   const user = await usersRepository.findByIdOnPrimary(userId);
   return user?.status === "active" ? user : null;
@@ -12591,7 +12886,7 @@ async function replaceCredentials(row, user, params) {
   await deviceAuthorizationsRepository.denyAllActiveByUserId(user.id);
   await revokeAllOAuth2GrantsForUser(user.id);
   await keysRepository.revokeAllActiveByUserId(user.id, "Revoked by password reset");
-  await registerPublicKeyService({
+  const registered = await registerPublicKeyService({
     userId: user.id,
     keyId: params.keyId,
     publicKey: params.publicKey,
@@ -12601,13 +12896,15 @@ async function replaceCredentials(row, user, params) {
     platform: params.platform,
     channel: "password-reset",
     ip: params.ip,
-    userAgent: params.userAgent
+    userAgent: params.userAgent,
+    binding: decideKeyBinding(user.sessionBinding, params.webProxy)
   });
   await updateLastLoginService(user.id);
   if (!await passwordResetTokensRepository.complete(row.id)) {
     authLogger.service.warn("Password reset session refused", { reason: "lost the claim race" });
     throw new PasswordResetSessionError();
   }
+  return loginBindingFields(registered);
 }
 async function completePasswordResetService(params) {
   if (!params.publicKey || !params.keyId || !params.fingerprint) {
@@ -12626,7 +12923,7 @@ async function completePasswordResetService(params) {
     authLogger.service.warn("Password reset session refused", { reason: "account is no longer active" });
     throw new PasswordResetSessionError();
   }
-  await replaceCredentials(row, user, params);
+  const binding = await replaceCredentials(row, user, params);
   onAfterCommit4(() => authPasswordResetEvent.emit({
     userId: String(user.id),
     email: row.email
@@ -12635,11 +12932,13 @@ async function completePasswordResetService(params) {
     userId: String(user.id),
     publicId: user.publicId,
     email: user.email || void 0,
-    phone: user.phone || void 0
+    phone: user.phone || void 0,
+    ...binding
   };
 }
 
 // src/server/services/revoke-all-link.service.ts
+init_logger();
 import { env as env12 } from "@spfn/auth/config";
 import { NotFoundError as NotFoundError3, ValidationError as ValidationError7 } from "@spfn/core/errors";
 import { RevokeAllLinkError } from "@spfn/auth/errors";
@@ -12766,6 +13065,7 @@ function hashDeviceCode(deviceCode) {
 }
 
 // src/server/services/device-auth.service.ts
+init_key_policy();
 var USER_CODE_ATTEMPTS = 3;
 function assertActionable(record) {
   if (!record || record.status === "consumed") {
@@ -12904,7 +13204,7 @@ async function completeDeviceLogin(record, provenance) {
     }
     throw new AccountDisabledError2({ status: user.status });
   }
-  await registerPublicKeyService({
+  const registered = await registerPublicKeyService({
     userId: user.id,
     keyId: record.keyId,
     publicKey: record.publicKey,
@@ -12914,7 +13214,8 @@ async function completeDeviceLogin(record, provenance) {
     platform: record.platform ?? void 0,
     channel: "device-code",
     ip: provenance.ip,
-    userAgent: provenance.userAgent
+    userAgent: provenance.userAgent,
+    binding: decideKeyBinding(user.sessionBinding, provenance.webProxy)
   });
   await updateLastLoginService(user.id);
   const result = {
@@ -12922,7 +13223,8 @@ async function completeDeviceLogin(record, provenance) {
     publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
-    passwordChangeRequired: user.passwordChangeRequired
+    passwordChangeRequired: user.passwordChangeRequired,
+    ...loginBindingFields(registered)
   };
   const mfaEnrolled = await mfaEnrolledForUser(Number(result.userId));
   onAfterCommit5(() => authLoginEvent.emit({
@@ -12936,6 +13238,8 @@ async function completeDeviceLogin(record, provenance) {
 }
 
 // src/server/services/passkey.service.ts
+init_logger();
+init_config();
 import { onAfterCommit as onAfterCommit6, runInTransaction as runInTransaction4 } from "@spfn/core/db";
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
 import {
@@ -12949,6 +13253,7 @@ import {
   RecentAuthenticationRequiredError
 } from "@spfn/auth/errors";
 init_repositories();
+init_key_policy();
 var NO_PASSWORD_PRESENTED = "spfn-passkey-no-password-presented";
 function toSummary(row) {
   return {
@@ -13066,6 +13371,42 @@ async function startPasskeyLoginService() {
     challenge: await mintChallenge("authentication", null)
   });
 }
+async function startRenewalCeremonyService(userId) {
+  return await buildAuthenticationOptions({
+    config: getPasskeyConfig(),
+    challenge: await mintChallenge("renewal", userId)
+  });
+}
+async function verifyRenewalAssertionService(userId, response) {
+  const challenge = response?.response?.clientDataJSON ? presentedChallenge(response.response.clientDataJSON) : "";
+  if (!await spendChallenge(challenge, "renewal", userId)) {
+    authLogger.service.warn("Renewal challenge refused");
+    return false;
+  }
+  return await assertionMatchesLivePasskey(userId, response, challenge);
+}
+async function assertionMatchesLivePasskey(userId, response, challenge) {
+  const passkey = await passkeysRepository.findLiveByCredentialId(response.id);
+  if (!passkey || passkey.userId !== userId) {
+    return false;
+  }
+  const outcome = await verifyAuthentication({
+    config: getPasskeyConfig(),
+    response,
+    expectedChallenge: challenge,
+    credential: {
+      credentialId: passkey.credentialId,
+      publicKey: passkey.publicKey,
+      counter: passkey.counter,
+      transports: passkey.transports
+    }
+  });
+  if (!outcome.verified) {
+    return false;
+  }
+  await passkeysRepository.recordUse(passkey.id, outcome.newCounter);
+  return true;
+}
 async function finishPasskeyLoginService(params) {
   assertDeviceKeyPresent(params);
   return runInTransaction4(async () => {
@@ -13090,7 +13431,7 @@ async function startSession(user, params) {
     });
     replacesKeyId = revoked ? params.oldKeyId : void 0;
   }
-  await registerPublicKeyService({
+  const registered = await registerPublicKeyService({
     userId: user.id,
     keyId: params.keyId,
     publicKey: params.publicKey,
@@ -13101,6 +13442,7 @@ async function startSession(user, params) {
     channel: "passkey",
     ip: params.ip,
     userAgent: params.userAgent,
+    binding: decideKeyBinding(user.sessionBinding, params.webProxy),
     replacesKeyId
   });
   await updateLastLoginService(user.id);
@@ -13109,7 +13451,8 @@ async function startSession(user, params) {
     publicId: user.publicId,
     email: user.email || void 0,
     phone: user.phone || void 0,
-    passwordChangeRequired: user.passwordChangeRequired
+    passwordChangeRequired: user.passwordChangeRequired,
+    ...loginBindingFields(registered)
   };
   const mfaEnrolled = await mfaEnrolledForUser(user.id);
   onAfterCommit6(() => authLoginEvent.emit({
@@ -13206,6 +13549,8 @@ async function revokePasskeyService(params) {
 // src/server/services/rbac.service.ts
 init_repositories();
 init_rbac();
+init_config();
+init_logger();
 import { createHash as createHash2 } from "crypto";
 var RBAC_HASH_KEY = "rbac_config_hash";
 function computeConfigHash(allRoles, allPermissions, allMappings) {
@@ -13345,6 +13690,7 @@ async function syncMappings(allMappings, rolesByName, permsByName) {
 }
 
 // src/server/services/email-normalization.service.ts
+init_logger();
 init_repositories();
 var BACKFILL_KEY = "auth:email_normalization";
 async function normalizeStoredEmails() {
@@ -13456,6 +13802,7 @@ init_role_service();
 
 // src/server/services/invitation.service.ts
 init_repositories();
+init_config();
 import crypto10 from "crypto";
 import { BadRequestError, NotFoundError as NotFoundError4, ConflictError } from "@spfn/core/errors";
 function generateInvitationToken() {
@@ -13783,6 +14130,7 @@ async function updateUserProfileService(userId, params) {
 
 // src/server/services/oauth.service.ts
 init_repositories();
+init_logger();
 import { env as env17 } from "@spfn/auth/config";
 import { ValidationError as ValidationError13 } from "@spfn/core/errors";
 import {
@@ -13790,6 +14138,7 @@ import {
   AccountPendingDeletionError as AccountPendingDeletionError4,
   UnverifiedEmailLinkError
 } from "@spfn/auth/errors";
+init_config();
 
 // src/server/lib/oauth/google.ts
 import { env as env13 } from "@spfn/auth/config";
@@ -13951,6 +14300,7 @@ function getRegisteredProviders() {
 }
 
 // src/server/lib/oauth/jwks-verify.ts
+init_logger();
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { InvalidSocialTokenError } from "@spfn/auth/errors";
 var CLOCK_TOLERANCE_SECONDS = 30;
@@ -14121,7 +14471,7 @@ var appleProvider = {
 registerOAuthProvider(appleProvider);
 
 // src/server/lib/oauth/github-provider.ts
-init_config();
+init_config2();
 import { ValidationError as ValidationError10 } from "@spfn/core/errors";
 var GITHUB_AUTH_URL = "https://github.com/login/oauth/authorize";
 var GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
@@ -14130,22 +14480,22 @@ var GITHUB_EMAILS_URL = "https://api.github.com/user/emails";
 var GITHUB_USER_AGENT = "spfn-auth";
 var GITHUB_DEFAULT_EXPIRES_IN = 60 * 60 * 24 * 365;
 function getGithubConfig() {
-  const clientId = env3.SPFN_AUTH_GITHUB_CLIENT_ID;
-  const clientSecret = env3.SPFN_AUTH_GITHUB_CLIENT_SECRET;
+  const clientId = env4.SPFN_AUTH_GITHUB_CLIENT_ID;
+  const clientSecret = env4.SPFN_AUTH_GITHUB_CLIENT_SECRET;
   if (!clientId || !clientSecret) {
     throw new ValidationError10({
       message: "GitHub OAuth is not configured. Set SPFN_AUTH_GITHUB_CLIENT_ID and SPFN_AUTH_GITHUB_CLIENT_SECRET."
     });
   }
-  const baseUrl = env3.NEXT_PUBLIC_SPFN_APP_URL || env3.SPFN_APP_URL;
+  const baseUrl = env4.NEXT_PUBLIC_SPFN_APP_URL || env4.SPFN_APP_URL;
   return {
     clientId,
     clientSecret,
-    redirectUri: env3.SPFN_AUTH_GITHUB_REDIRECT_URI || `${baseUrl}/_auth/oauth/github/callback`
+    redirectUri: env4.SPFN_AUTH_GITHUB_REDIRECT_URI || `${baseUrl}/_auth/oauth/github/callback`
   };
 }
 function getGithubScopes() {
-  const configured2 = env3.SPFN_AUTH_GITHUB_SCOPES;
+  const configured2 = env4.SPFN_AUTH_GITHUB_SCOPES;
   return configured2 ? configured2.split(",").map((scope) => scope.trim()).filter(Boolean) : ["read:user", "user:email"];
 }
 async function requestGithubTokens(params) {
@@ -14195,7 +14545,7 @@ async function fetchPrimaryEmail(accessToken) {
 var githubProvider = {
   id: "github",
   isEnabled() {
-    return !!(env3.SPFN_AUTH_GITHUB_CLIENT_ID && env3.SPFN_AUTH_GITHUB_CLIENT_SECRET);
+    return !!(env4.SPFN_AUTH_GITHUB_CLIENT_ID && env4.SPFN_AUTH_GITHUB_CLIENT_SECRET);
   },
   getAuthUrl(state, scopes) {
     const config4 = getGithubConfig();
@@ -14254,7 +14604,8 @@ var githubProvider = {
 registerOAuthProvider(githubProvider);
 
 // src/server/lib/oauth/kakao-provider.ts
-init_config();
+init_config2();
+init_logger();
 import { ValidationError as ValidationError11 } from "@spfn/core/errors";
 import { NativeSignInUnsupportedError as NativeSignInUnsupportedError3 } from "@spfn/auth/errors";
 import { timingSafeEqual } from "crypto";
@@ -14265,28 +14616,28 @@ var KAKAO_ISSUER = "https://kauth.kakao.com";
 var KAKAO_JWKS_URI = "https://kauth.kakao.com/.well-known/jwks.json";
 var USERINFO_TIMEOUT_MS = 5e3;
 function getKakaoConfig() {
-  const clientId = env3.SPFN_AUTH_KAKAO_CLIENT_ID;
-  const clientSecret = env3.SPFN_AUTH_KAKAO_CLIENT_SECRET;
+  const clientId = env4.SPFN_AUTH_KAKAO_CLIENT_ID;
+  const clientSecret = env4.SPFN_AUTH_KAKAO_CLIENT_SECRET;
   if (!clientId) {
     throw new ValidationError11({
       message: "Kakao OAuth is not configured. Set SPFN_AUTH_KAKAO_CLIENT_ID."
     });
   }
-  const baseUrl = env3.NEXT_PUBLIC_SPFN_APP_URL || env3.SPFN_APP_URL;
+  const baseUrl = env4.NEXT_PUBLIC_SPFN_APP_URL || env4.SPFN_APP_URL;
   return {
     clientId,
     clientSecret,
-    redirectUri: env3.SPFN_AUTH_KAKAO_REDIRECT_URI || `${baseUrl}/_auth/oauth/kakao/callback`
+    redirectUri: env4.SPFN_AUTH_KAKAO_REDIRECT_URI || `${baseUrl}/_auth/oauth/kakao/callback`
   };
 }
 function getKakaoScopes() {
-  const configured2 = env3.SPFN_AUTH_KAKAO_SCOPES;
+  const configured2 = env4.SPFN_AUTH_KAKAO_SCOPES;
   return configured2 ? configured2.split(",").map((scope) => scope.trim()).filter(Boolean) : ["account_email"];
 }
 function getKakaoNativeAudiences() {
-  const ids = (env3.SPFN_AUTH_KAKAO_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
-  if (env3.SPFN_AUTH_KAKAO_CLIENT_ID) {
-    ids.push(env3.SPFN_AUTH_KAKAO_CLIENT_ID);
+  const ids = (env4.SPFN_AUTH_KAKAO_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (env4.SPFN_AUTH_KAKAO_CLIENT_ID) {
+    ids.push(env4.SPFN_AUTH_KAKAO_CLIENT_ID);
   }
   return ids;
 }
@@ -14366,7 +14717,7 @@ var kakaoProvider = {
    * 실패하므로, 판정을 웹 키에 그대로 둔다.
    */
   isEnabled() {
-    return !!env3.SPFN_AUTH_KAKAO_CLIENT_ID;
+    return !!env4.SPFN_AUTH_KAKAO_CLIENT_ID;
   },
   getAuthUrl(state, scopes) {
     const config4 = getKakaoConfig();
@@ -14449,7 +14800,7 @@ var kakaoProvider = {
    * 본문 필드는 app_id · user_id · referrer_type.
    */
   async verifyUnlinkNotification(request) {
-    const adminKey = env3.SPFN_AUTH_KAKAO_ADMIN_KEY;
+    const adminKey = env4.SPFN_AUTH_KAKAO_ADMIN_KEY;
     if (!adminKey) {
       throw new UnlinkNotifyRejection(401, "SPFN_AUTH_KAKAO_ADMIN_KEY is not configured");
     }
@@ -14471,7 +14822,8 @@ var kakaoProvider = {
 registerOAuthProvider(kakaoProvider);
 
 // src/server/lib/oauth/naver-provider.ts
-init_config();
+init_config2();
+init_logger();
 import { ValidationError as ValidationError12 } from "@spfn/core/errors";
 import { NativeSignInUnsupportedError as NativeSignInUnsupportedError4 } from "@spfn/auth/errors";
 import { createDecipheriv, createHash as createHash4, createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
@@ -14482,24 +14834,24 @@ var NAVER_ISSUER = "https://nid.naver.com";
 var NAVER_JWKS_URI = "https://nid.naver.com/oauth2/jwks";
 var USERINFO_TIMEOUT_MS2 = 5e3;
 function getNaverConfig() {
-  const clientId = env3.SPFN_AUTH_NAVER_CLIENT_ID;
-  const clientSecret = env3.SPFN_AUTH_NAVER_CLIENT_SECRET;
+  const clientId = env4.SPFN_AUTH_NAVER_CLIENT_ID;
+  const clientSecret = env4.SPFN_AUTH_NAVER_CLIENT_SECRET;
   if (!clientId || !clientSecret) {
     throw new ValidationError12({
       message: "Naver OAuth is not configured. Set SPFN_AUTH_NAVER_CLIENT_ID and SPFN_AUTH_NAVER_CLIENT_SECRET."
     });
   }
-  const baseUrl = env3.NEXT_PUBLIC_SPFN_APP_URL || env3.SPFN_APP_URL;
+  const baseUrl = env4.NEXT_PUBLIC_SPFN_APP_URL || env4.SPFN_APP_URL;
   return {
     clientId,
     clientSecret,
-    redirectUri: env3.SPFN_AUTH_NAVER_REDIRECT_URI || `${baseUrl}/_auth/oauth/naver/callback`
+    redirectUri: env4.SPFN_AUTH_NAVER_REDIRECT_URI || `${baseUrl}/_auth/oauth/naver/callback`
   };
 }
 function getNaverNativeAudiences() {
-  const ids = (env3.SPFN_AUTH_NAVER_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
-  if (env3.SPFN_AUTH_NAVER_CLIENT_ID) {
-    ids.push(env3.SPFN_AUTH_NAVER_CLIENT_ID);
+  const ids = (env4.SPFN_AUTH_NAVER_NATIVE_CLIENT_IDS || "").split(",").map((s) => s.trim()).filter(Boolean);
+  if (env4.SPFN_AUTH_NAVER_CLIENT_ID) {
+    ids.push(env4.SPFN_AUTH_NAVER_CLIENT_ID);
   }
   return ids;
 }
@@ -14592,7 +14944,7 @@ async function withNaverProfile(identity, accessToken) {
 var naverProvider = {
   id: "naver",
   isEnabled() {
-    return !!(env3.SPFN_AUTH_NAVER_CLIENT_ID && env3.SPFN_AUTH_NAVER_CLIENT_SECRET);
+    return !!(env4.SPFN_AUTH_NAVER_CLIENT_ID && env4.SPFN_AUTH_NAVER_CLIENT_SECRET);
   },
   getAuthUrl(state) {
     const config4 = getNaverConfig();
@@ -14674,8 +15026,8 @@ var naverProvider = {
    * 삭제가 멱등이라는 점에 의존한다.
    */
   async verifyUnlinkNotification(request) {
-    const clientId = env3.SPFN_AUTH_NAVER_CLIENT_ID;
-    const clientSecret = env3.SPFN_AUTH_NAVER_CLIENT_SECRET;
+    const clientId = env4.SPFN_AUTH_NAVER_CLIENT_ID;
+    const clientSecret = env4.SPFN_AUTH_NAVER_CLIENT_SECRET;
     if (!clientId || !clientSecret) {
       throw new UnlinkNotifyRejection(403, "Naver OAuth is not configured");
     }
@@ -14703,6 +15055,7 @@ var naverProvider = {
 registerOAuthProvider(naverProvider);
 
 // src/server/services/oauth.service.ts
+init_key_policy();
 function requireEnabledProvider(provider) {
   const oauthProvider = getOAuthProvider(provider);
   if (!oauthProvider) {
@@ -14777,7 +15130,8 @@ async function oauthCallbackService(params) {
     isNewUser = result.isNewUser;
   }
   await assertActiveForOAuthSession(userId);
-  await registerPublicKeyService({
+  const user = await usersRepository.findById(userId);
+  const registered = await registerPublicKeyService({
     userId,
     keyId: stateData.keyId,
     publicKey: stateData.publicKey,
@@ -14785,7 +15139,8 @@ async function oauthCallbackService(params) {
     algorithm: stateData.algorithm,
     channel: "oauth",
     ip: params.ip,
-    userAgent: params.userAgent
+    userAgent: params.userAgent,
+    binding: decideKeyBinding(user?.sessionBinding ?? "none", params.webProxy)
   });
   await updateLastLoginService(userId);
   const appUrl = env17.NEXT_PUBLIC_SPFN_APP_URL || env17.SPFN_APP_URL;
@@ -14799,9 +15154,15 @@ async function oauthCallbackService(params) {
     // destination that leaves the app out of the callback URL no matter which
     // seam sealed it.
     returnUrl: isSafeReturnPath(stateData.returnUrl) ? stateData.returnUrl : "/",
-    isNewUser: String(isNewUser)
+    isNewUser: String(isNewUser),
+    // The callback page and `createOAuthCallbackHandler` are the two seams
+    // that seal a session out of this redirect, and neither calls a route
+    // that could tell them the key is bound. The two values ride the query
+    // for the same reason `userId` and `keyId` do — and, like those, nothing
+    // is authorized by them: the key row already expires when it says it
+    // does, whatever a tampered query claims the cookie should believe.
+    ...bindingRedirectParams(registered)
   });
-  const user = await usersRepository.findById(userId);
   const eventPayload = {
     userId: String(userId),
     provider,
@@ -14910,6 +15271,15 @@ async function createOrLinkUser(provider, identity, tokens, metadata) {
   });
   return { userId, isNewUser };
 }
+function bindingRedirectParams(registered) {
+  if (registered.binding !== "passkey" || !registered.expiresAt) {
+    return {};
+  }
+  return {
+    sessionBinding: registered.binding,
+    keyExpiresAtMillis: String(registered.expiresAt.getTime())
+  };
+}
 function buildRedirectUrl(baseUrl, params) {
   const url = new URL(baseUrl, "http://placeholder");
   for (const [key, value] of Object.entries(params)) {
@@ -15052,6 +15422,7 @@ async function persistNativeLogin(identity, params) {
 
 // src/server/services/ops-token.service.ts
 init_ops_tokens_repository();
+init_logger();
 import { createHash as createHash5, randomBytes as randomBytes2 } from "crypto";
 var OPS_TOKEN_PREFIX = "spfn_ops_";
 function isOpsToken(bearer) {
@@ -15106,6 +15477,7 @@ init_oauth2_clients_repository();
 import { randomBytes as randomBytes4 } from "crypto";
 
 // src/server/lib/oauth2/config.ts
+init_logger();
 var DEFAULT_ACCESS_TOKEN_TTL_MS = 8 * 60 * 60 * 1e3;
 var DEFAULT_REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var DEFAULT_CODE_TTL_MS = 60 * 1e3;
@@ -15367,6 +15739,7 @@ function secondsUntil(at, from = /* @__PURE__ */ new Date()) {
 }
 
 // src/server/services/oauth2-client.service.ts
+init_logger();
 var MAX_UNGRANTED_CLIENTS_PER_IP = 20;
 var UNGRANTED_CLIENT_WINDOW_MS = 60 * 60 * 1e3;
 var STALE_CLIENT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
@@ -15615,6 +15988,7 @@ init_oauth2_grants_repository();
 init_oauth2_authorization_codes_repository();
 init_oauth2_tokens_repository();
 import { runInTransaction as runInTransaction6 } from "@spfn/core/db";
+init_logger();
 function invalidGrant() {
   return {
     ok: false,
@@ -15805,6 +16179,7 @@ async function issuedToClient(grantId, clientId) {
 // src/server/services/oauth2-access-token.service.ts
 init_oauth2_grants_repository();
 init_oauth2_tokens_repository();
+init_logger();
 async function verifyAccessToken(token, resource) {
   if (!isAccessTokenShaped(token)) {
     return null;
@@ -15830,6 +16205,149 @@ function isUsable(record) {
   return record.kind === "access" && record.revokedAt === null && record.expiresAt.getTime() > Date.now();
 }
 
+// src/server/services/session-binding.service.ts
+init_config();
+init_repositories();
+init_key_policy();
+import { RecentAuthenticationRequiredError as RecentAuthenticationRequiredError2, SessionBindingUnavailableError } from "@spfn/auth/errors";
+import { ValidationError as ValidationError14 } from "@spfn/core/errors";
+async function getSessionBindingService(params) {
+  const user = await usersRepository.findById(params.userId);
+  const key = await keysRepository.findByKeyIdAndUserId(params.keyId, params.userId);
+  return {
+    mode: user?.sessionBinding ?? "none",
+    keyExpiresAtMillis: key?.binding === "passkey" ? key.expiresAt?.getTime() : void 0
+  };
+}
+async function keySessionBindingService(keyId) {
+  const key = await keysRepository.findByKeyId(keyId);
+  if (key?.binding !== "passkey" || !key.expiresAt) {
+    return {};
+  }
+  return { sessionBinding: "passkey", keyExpiresAtMillis: key.expiresAt.getTime() };
+}
+async function enableSessionBindingService(params) {
+  if (!params.webProxy) {
+    throw new SessionBindingUnavailableError();
+  }
+  const live = await passkeysRepository.listLiveByUserId(params.userId);
+  if (live.length === 0) {
+    throw new ValidationError14({
+      message: "Session binding needs a passkey to renew with. Enroll one first."
+    });
+  }
+  await assertRecentAuthentication({ userId: params.userId, keyId: params.keyId });
+  const user = await usersRepository.findById(params.userId);
+  if (user?.sessionBinding === "passkey") {
+    return await getSessionBindingService(params);
+  }
+  await usersRepository.updateById(params.userId, {
+    sessionBinding: "passkey",
+    sessionBindingChangedAt: /* @__PURE__ */ new Date()
+  });
+  const bound = await keysRepository.bindByKeyIdAndUserId(
+    params.keyId,
+    params.userId,
+    new Date(Date.now() + getBoundKeyTtlMs())
+  );
+  return { mode: "passkey", keyExpiresAtMillis: bound?.expiresAt?.getTime() };
+}
+async function disableSessionBindingService(params) {
+  if (!await provedOwnership(params)) {
+    throw new RecentAuthenticationRequiredError2({
+      message: "Turning session binding off needs a passkey or your current password."
+    });
+  }
+  await usersRepository.updateById(params.userId, {
+    sessionBinding: "none",
+    sessionBindingChangedAt: /* @__PURE__ */ new Date()
+  });
+  const unbound = /* @__PURE__ */ new Date();
+  unbound.setDate(unbound.getDate() + KEY_TTL_DAYS);
+  await keysRepository.unbindActiveByUserId(params.userId, unbound);
+  return { mode: "none" };
+}
+async function startSessionBindingDisableService(userId) {
+  return await startRenewalCeremonyService(userId);
+}
+async function provedOwnership(params) {
+  if (params.response) {
+    return await verifyRenewalAssertionService(params.userId, params.response);
+  }
+  const user = await usersRepository.findById(params.userId);
+  const storedHash = user?.passwordHash;
+  const matched = await verifyPassword(
+    params.currentPassword || NO_PASSWORD_PRESENTED2,
+    storedHash ?? await getDummyPasswordHash()
+  );
+  return Boolean(storedHash) && matched;
+}
+var NO_PASSWORD_PRESENTED2 = "spfn-session-binding-no-password-presented";
+
+// src/server/services/session-renew.service.ts
+init_config();
+init_repositories();
+import { SessionRenewalRefusedError } from "@spfn/auth/errors";
+var RENEWAL_REVOCATION_REASON = "Replaced by bound-session renewal";
+async function startSessionRenewService(params) {
+  const { key } = await admitForRenewal(params.expiredKeyId);
+  return await startRenewalCeremonyService(key.userId);
+}
+async function finishSessionRenewService(params) {
+  const { key, user } = await admitForRenewal(params.expiredKeyId);
+  if (!await verifyRenewalAssertionService(key.userId, params.response)) {
+    throw new SessionRenewalRefusedError();
+  }
+  const revoked = await revokeKeyService({
+    userId: key.userId,
+    keyId: key.keyId,
+    reason: RENEWAL_REVOCATION_REASON
+  });
+  if (!revoked) {
+    throw new SessionRenewalRefusedError();
+  }
+  const registered = await registerPublicKeyService({
+    userId: key.userId,
+    keyId: params.keyId,
+    publicKey: params.publicKey,
+    fingerprint: params.fingerprint,
+    algorithm: params.algorithm,
+    deviceName: key.deviceName ?? void 0,
+    platform: key.platform ?? void 0,
+    channel: "renewal",
+    // The old row's provenance, not this request's: renewing is not appearing
+    // for the first time. Passing the recorded `user-agent` also re-derives
+    // the same family, so `registered_ua_family` carries over unchanged.
+    ip: key.registeredIp ?? void 0,
+    userAgent: key.registeredUserAgent ?? void 0,
+    binding: "passkey",
+    replacesKeyId: key.keyId
+  });
+  return {
+    keyId: params.keyId,
+    userId: String(user.id),
+    publicId: user.publicId,
+    email: user.email || void 0,
+    phone: user.phone || void 0,
+    passwordChangeRequired: user.passwordChangeRequired,
+    ...loginBindingFields(registered)
+  };
+}
+async function admitForRenewal(expiredKeyId) {
+  const key = expiredKeyId ? await keysRepository.findByKeyId(expiredKeyId) : null;
+  if (!key || !key.isActive || key.binding !== "passkey" || !key.expiresAt) {
+    throw new SessionRenewalRefusedError();
+  }
+  if (Date.now() > key.expiresAt.getTime() + getBoundKeyRenewGraceMs()) {
+    throw new SessionRenewalRefusedError();
+  }
+  const user = await usersRepository.findById(key.userId);
+  if (!user || user.status !== "active") {
+    throw new SessionRenewalRefusedError();
+  }
+  return { key, user };
+}
+
 // src/server/routes/auth/index.ts
 init_esm();
 import { Transactional } from "@spfn/core/db";
@@ -15919,9 +16437,14 @@ function deviceProvenance(c) {
   const userAgent = c.req.header("user-agent");
   return {
     ip: ip === "unknown" ? void 0 : ip,
-    userAgent: userAgent?.slice(0, REGISTERED_USER_AGENT_MAX_LENGTH)
+    userAgent: userAgent?.slice(0, REGISTERED_USER_AGENT_MAX_LENGTH),
+    webProxy: c.get("clientType") === "web"
   };
 }
+function attestedClientIp(c) {
+  const provenance = deviceProvenance(c);
+  return provenance.webProxy ? provenance.ip ?? null : null;
+}
 
 // src/server/routes/auth/index.ts
 var sendVerificationCode = route.post("/_auth/codes").input({
@@ -15994,7 +16517,7 @@ var requestSignupLink = route.post("/_auth/signup/email").input({
 }).use([rateLimitPolicy("auth-signup-link", { limit: 5, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 20 }) })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (body.returnPath !== void 0 && !isSafeReturnPath(body.returnPath)) {
-    throw new ValidationError14({ message: "returnPath must be a relative path within the app" });
+    throw new ValidationError15({ message: "returnPath must be a relative path within the app" });
   }
   return await requestSignupLinkService(body);
 });
@@ -16251,7 +16774,7 @@ init_esm();
 init_schema3();
 init_types();
 import { Transactional as Transactional2 } from "@spfn/core/db";
-import { ValidationError as ValidationError15 } from "@spfn/core/errors";
+import { ValidationError as ValidationError16 } from "@spfn/core/errors";
 import { rateLimitPolicy as rateLimitPolicy2 } from "@spfn/core/middleware";
 import { route as route2 } from "@spfn/core/route";
 var requestPasswordReset = route2.post("/_auth/password/reset").input({
@@ -16265,7 +16788,7 @@ var requestPasswordReset = route2.post("/_auth/password/reset").input({
 }).use([rateLimitPolicy2("auth-password-reset", { limit: 5, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 20 }) })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (body.returnPath !== void 0 && !isSafeReturnPath(body.returnPath)) {
-    throw new ValidationError15({ message: "returnPath must be a relative path within the app" });
+    throw new ValidationError16({ message: "returnPath must be a relative path within the app" });
   }
   return await requestPasswordResetService(body);
 });
@@ -16418,130 +16941,75 @@ var mfaStepUpOptions = route4.post("/_auth/mfa/step-up/options").input({
   return await startStepUpService(Number(userId));
 });
 
-// src/server/routes/auth/passkeys.ts
+// src/server/routes/auth/session-binding.ts
 init_esm();
 import { Transactional as Transactional4 } from "@spfn/core/db";
 import { rateLimitPolicy as rateLimitPolicy5 } from "@spfn/core/middleware";
 import { route as route5 } from "@spfn/core/route";
-init_types();
-init_passkeys();
-init_schema3();
 var CredentialResponseSchema = Type.Unknown({
   description: "The credential from @simplewebauthn/browser, passed through unchanged"
 });
-var PasskeyIdSchema2 = Type.String({
-  pattern: "^[0-9]{1,19}$",
-  description: "Passkey identifier, as returned by list"
-});
-var PasskeyLabelSchema = Type.String({
-  minLength: 1,
-  maxLength: PASSKEY_LABEL_MAX_LENGTH,
-  description: `Owner-facing name in the passkey list (1-${PASSKEY_LABEL_MAX_LENGTH} chars)`
-});
 var CurrentPasswordSchema = Type.String({
   minLength: 1,
-  description: "Account password, needed when the session proved itself longer ago than the recent-authentication window"
-});
-var passkeyRegisterOptions = route5.post("/_auth/passkeys/register/options").input({
-  body: Type.Object({
-    currentPassword: Type.Optional(CurrentPasswordSchema)
-  })
-}).use([rateLimitPolicy5("auth-passkey-register-options", {
-  limit: 10,
-  windowMs: 6e4,
-  by: byIpAndCaller({ ipLimit: 100 })
-})]).handler(async (c) => {
-  const { body } = await c.data();
-  const { userId, keyId } = getAuth(c);
-  return await startPasskeyEnrollmentService({
-    userId: Number(userId),
-    keyId,
-    currentPassword: body.currentPassword
-  });
-});
-var passkeyRegisterVerify = route5.post("/_auth/passkeys/register/verify").input({
-  body: Type.Object({
-    response: CredentialResponseSchema,
-    label: Type.Optional(PasskeyLabelSchema)
-  })
-}).use([
-  rateLimitPolicy5("auth-passkey-register-verify", {
-    limit: 10,
-    windowMs: 6e4,
-    by: byIpAndCaller({ ipLimit: 100 })
-  }),
-  Transactional4()
-]).handler(async (c) => {
-  const { body } = await c.data();
-  const { userId } = getAuth(c);
-  return await finishPasskeyEnrollmentService({
-    userId: Number(userId),
-    response: body.response,
-    label: body.label
-  });
-});
-var passkeyLoginOptions = route5.post("/_auth/passkeys/login/options").input({
-  body: Type.Object({}, {
-    additionalProperties: false,
-    description: "No identifier is accepted \u2014 sign-in is discoverable"
-  })
-}).use([rateLimitPolicy5("auth-passkey-login-options", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async () => {
-  return await startPasskeyLoginService();
-});
-var passkeyLoginVerify = route5.post("/_auth/passkeys/login/verify").input({
-  body: Type.Object({
-    response: CredentialResponseSchema
-  })
-}).interceptor({
-  body: Type.Object({
-    publicKey: Type.String({ description: "Client public key" }),
-    keyId: Type.String({ description: "Key identifier" }),
-    fingerprint: Type.String({ description: "Key fingerprint" }),
-    algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
-    oldKeyId: Type.Optional(Type.String({ description: "Previous key ID for rotation" })),
-    deviceName: Type.Optional(DeviceNameSchema),
-    platform: Type.Optional(PlatformSchema)
-  })
-}).use([rateLimitPolicy5("auth-passkey-login-verify", { limit: 10, windowMs: 6e4 }), Transactional4()]).skip(["auth"]).handler(async (c) => {
-  const { body } = await c.data();
-  return await finishPasskeyLoginService({
-    ...body,
-    ...deviceProvenance(c.raw),
-    response: body.response
-  });
-});
-var listPasskeys = route5.post("/_auth/passkeys/list").input({
-  body: Type.Object({})
-}).handler(async (c) => {
-  const { userId } = getAuth(c);
-  return { passkeys: await listPasskeysService(Number(userId)) };
-});
-var renamePasskey = route5.post("/_auth/passkeys/rename").input({
-  body: Type.Object({
-    passkeyId: PasskeyIdSchema2,
-    label: PasskeyLabelSchema
-  })
-}).handler(async (c) => {
-  const { body } = await c.data();
-  const { userId } = getAuth(c);
-  return await renamePasskeyService({ userId: Number(userId), ...body });
+  description: "Account password \u2014 one of the two ways to prove ownership when turning binding off"
 });
-var revokePasskey = route5.post("/_auth/passkeys/revoke").input({
+var setSessionBinding = route5.post("/_auth/session/binding").input({
   body: Type.Object({
-    passkeyId: PasskeyIdSchema2,
+    mode: Type.Union([Type.Literal("passkey"), Type.Literal("none")], {
+      description: "passkey binds this account's web sessions; none returns them to ordinary long-lived keys"
+    }),
+    response: Type.Optional(CredentialResponseSchema),
     currentPassword: Type.Optional(CurrentPasswordSchema)
   })
 }).use([
-  rateLimitPolicy5("auth-passkey-revoke", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 100 }) }),
+  rateLimitPolicy5("auth-session-binding", {
+    limit: 10,
+    windowMs: 6e4,
+    by: byIpAndCaller({ ipLimit: 100 })
+  }),
   Transactional4()
 ]).handler(async (c) => {
   const { body } = await c.data();
   const { userId, keyId } = getAuth(c);
-  return await revokePasskeyService({ userId: Number(userId), keyId, ...body });
+  const params = { userId: Number(userId), keyId, webProxy: deviceProvenance(c.raw).webProxy };
+  if (body.mode === "none") {
+    return await disableSessionBindingService({
+      ...params,
+      response: body.response,
+      currentPassword: body.currentPassword
+    });
+  }
+  return await enableSessionBindingService(params);
+});
+var getSessionBinding = route5.get("/_auth/session/binding").handler(async (c) => {
+  const { userId, keyId } = getAuth(c);
+  return await getSessionBindingService({ userId: Number(userId), keyId });
+});
+var sessionBindingDisableOptions = route5.post("/_auth/session/binding/disable/options").input({
+  body: Type.Object({}, {
+    additionalProperties: false,
+    description: "No input \u2014 the session names the account"
+  })
+}).use([rateLimitPolicy5("auth-session-binding-disable-options", {
+  limit: 10,
+  windowMs: 6e4,
+  by: byIpAndCaller({ ipLimit: 100 })
+})]).handler(async (c) => {
+  const { userId } = getAuth(c);
+  return await startSessionBindingDisableService(Number(userId));
 });
 
-// src/server/routes/invitations/index.ts
-import { EMAIL_PATTERN as EMAIL_PATTERN2, UUID_PATTERN } from "@spfn/auth";
+// src/server/routes/auth/session-renew.ts
+init_esm();
+import { Transactional as Transactional5 } from "@spfn/core/db";
+import { rateLimitPolicy as rateLimitPolicy6 } from "@spfn/core/middleware";
+import { route as route6 } from "@spfn/core/route";
+
+// src/server/middleware/authenticate-for-renewal.ts
+init_config();
+init_repositories();
+import { defineMiddleware as defineMiddleware3 } from "@spfn/core/route";
+import { SessionRenewalRefusedError as SessionRenewalRefusedError2 } from "@spfn/auth/errors";
 
 // src/server/middleware/authenticate.ts
 import { defineMiddleware as defineMiddleware2 } from "@spfn/core/route";
@@ -17014,12 +17482,13 @@ function contractViolation(message) {
 }
 
 // src/server/client-proof/contract-bundle.ts
+init_key_policy();
+init_types();
 import { createHash as createHash9 } from "crypto";
 import {
   CORE_TIME_OPERATION_ID as CORE_TIME_OPERATION_ID2,
   ServerTimeResponseSchema
 } from "@spfn/core/server";
-init_types();
 
 // src/server/client-proof/proof.ts
 import { createHash as createHash8, createPrivateKey, createPublicKey, sign, verify as verify2 } from "crypto";
@@ -17184,8 +17653,8 @@ var CORE_PREREQUISITE_OPERATIONS = [
 
 // src/server/client-proof/contract-bundle.ts
 init_wire_headers();
-var CONTRACT_VERSION = "0.11.0";
-var CONTRACT_SUPPORTED_RANGE = ">=0.11.0 <0.12.0";
+var CONTRACT_VERSION = "0.12.0";
+var CONTRACT_SUPPORTED_RANGE = ">=0.12.0 <0.13.0";
 function required(name, type) {
   return { name, type, optional: false };
 }
@@ -17306,7 +17775,9 @@ var CONTRACT_TYPES = [
       required("publicId", "string"),
       optional("email", "string"),
       optional("phone", "string"),
-      required("passwordChangeRequired", "boolean")
+      required("passwordChangeRequired", "boolean"),
+      optional("sessionBinding", "KeyBinding"),
+      optional("keyExpiresAtMillis", "integer")
     ]
   },
   {
@@ -17366,7 +17837,9 @@ var CONTRACT_TYPES = [
       required("isActive", "boolean"),
       optional("revokedAtMillis", "integer"),
       optional("registeredIp", "string"),
-      optional("registeredUserAgent", "string")
+      optional("registeredUserAgent", "string"),
+      optional("binding", "KeyBinding"),
+      optional("concurrentUseAtMillis", "integer")
     ]
   },
   {
@@ -17446,7 +17919,9 @@ var CONTRACT_TYPES = [
       optional("publicId", "string"),
       optional("email", "string"),
       optional("phone", "string"),
-      optional("passwordChangeRequired", "boolean")
+      optional("passwordChangeRequired", "boolean"),
+      optional("sessionBinding", "KeyBinding"),
+      optional("keyExpiresAtMillis", "integer")
     ]
   },
   /**
@@ -17487,6 +17962,7 @@ var CONTRACT_TYPES = [
 var CONTRACT_ENUMS = [
   { name: "KeyAlgorithm", values: [...KEY_ALGORITHM] },
   { name: "KeyPlatform", values: [...KEY_PLATFORM] },
+  { name: "KeyBinding", values: [...SESSION_BINDINGS] },
   { name: "DeviceAuthPollStatus", values: ["pending", "approved"] }
 ];
 var BUNDLE_FILENAME = "spfn-mobile-contract.json";
@@ -17716,7 +18192,7 @@ async function verifyClientProofProfile(c) {
     throw refusalError(ClientProofRefusal.proofReplayed());
   }
   const { user, role, locale } = await resolveAuthenticatedUser(keyRecord.userId);
-  keysRepository2.updateLastUsedById(keyRecord.id, readContextClientIdentity(c)).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
+  keysRepository2.updateLastUsedById(keyRecord.id, readContextClientIdentity(c), attestedClientIp(c)).catch((err) => authLogger2.middleware.error("Failed to update lastUsedAt", err));
   authLogger2.middleware.info("API access", {
     userId: user.id,
     email: user.email,
@@ -17789,6 +18265,7 @@ function registerAuthProfile(profileId, verifier) {
 import { decodeProtectedHeader } from "jose";
 import { defineMiddleware } from "@spfn/core/route";
 import { ForbiddenError as ForbiddenError2, UnauthorizedError as UnauthorizedError2 } from "@spfn/core/errors";
+init_logger();
 function getMachinePrincipal(c) {
   return c.get("machinePrincipal") ?? null;
 }
@@ -17950,69 +18427,100 @@ function extractBearer(header) {
 
 // src/server/middleware/authenticate.ts
 var INVALID_TOKEN_MESSAGE = "Invalid token: missing keyId";
-var authenticate = defineMiddleware2("auth", async (c, next) => {
-  const profile = await runAuthProfile(c);
-  if (profile.kind === "refused") {
-    return profile.response;
-  }
-  if (profile.kind === "authenticated") {
-    c.set("auth", profile.auth);
-    await next();
-    return void 0;
-  }
+async function admitBearerKey(c, admitsExpired) {
   const authHeader = c.req.header("Authorization");
   if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    authLogger3.middleware.error("Missing or invalid authorization header. If using Next.js API routes, ensure you have imported '@spfn/auth/nextjs/api' in your API route handler (e.g., src/app/api/actions/[[...path]]/route.ts) to enable automatic authentication header forwarding from client to backend.", {
-      headers: c.req.header(),
-      path: c.req.path
-    });
-    throw new UnauthorizedError3({ message: "Authentication header missing or invalid: Bearer {token}" });
+    return { refused: "absent" };
   }
   const token = authHeader.substring(7);
   if (matchesMachineDiscriminator(token)) {
     authLogger3.middleware.warn("Machine credential presented to the user path \u2014 refused", { path: c.req.path });
-    throw new UnauthorizedError3({ message: INVALID_TOKEN_MESSAGE });
+    return { refused: "machine" };
   }
   const decoded = decodeToken2(token);
   if (!decoded || !decoded.keyId) {
-    throw new UnauthorizedError3({ message: INVALID_TOKEN_MESSAGE });
+    return { refused: "undecodable" };
   }
-  const keyId = decoded.keyId;
-  const keyRecord = await keysRepository3.findActiveByKeyId(keyId);
-  if (!keyRecord) {
-    throw new UnauthorizedError3({ message: "Invalid or revoked key" });
+  const key = await keysRepository3.findActiveByKeyId(decoded.keyId);
+  if (!key) {
+    return { refused: "unknown" };
   }
-  if (keyRecord.expiresAt && /* @__PURE__ */ new Date() > keyRecord.expiresAt) {
-    throw new KeyExpiredError();
+  if (key.expiresAt && /* @__PURE__ */ new Date() > key.expiresAt && !admitsExpired(key)) {
+    return { refused: "expired" };
   }
+  return signatureOutcome(token, key);
+}
+function signatureOutcome(token, key) {
   try {
     verifyClientToken2(
       token,
-      keyRecord.publicKey,
-      keyRecord.algorithm
+      key.publicKey,
+      key.algorithm
       // entity.algorithm is always defined
     );
   } catch (err) {
-    if (err instanceof Error) {
-      if (err.name === "TokenExpiredError") {
-        throw new TokenExpiredError();
-      }
-      if (err.name === "JsonWebTokenError") {
-        throw new InvalidTokenError({ message: "Invalid token signature" });
-      }
+    const name = err instanceof Error ? err.name : "";
+    if (name === "TokenExpiredError") {
+      return { refused: "token-expired" };
     }
-    throw new UnauthorizedError3({ message: "Authentication failed" });
+    return { refused: name === "JsonWebTokenError" ? "bad-signature" : "unverifiable" };
   }
-  const { user, role, locale } = await resolveAuthenticatedUser(keyRecord.userId);
-  keysRepository3.updateLastUsedById(keyRecord.id, readContextClientIdentity(c)).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
-  c.set("auth", {
-    user,
-    userId: String(user.id),
+  return { key };
+}
+function bearerRefusal(c, refused) {
+  if (refused === "absent") {
+    authLogger3.middleware.error("Missing or invalid authorization header. If using Next.js API routes, ensure you have imported '@spfn/auth/nextjs/api' in your API route handler (e.g., src/app/api/actions/[[...path]]/route.ts) to enable automatic authentication header forwarding from client to backend.", {
+      headers: c.req.header(),
+      path: c.req.path
+    });
+    return new UnauthorizedError3({ message: "Authentication header missing or invalid: Bearer {token}" });
+  }
+  switch (refused) {
+    case "machine":
+    case "undecodable":
+      return new UnauthorizedError3({ message: INVALID_TOKEN_MESSAGE });
+    case "unknown":
+      return new UnauthorizedError3({ message: "Invalid or revoked key" });
+    case "expired":
+      return new KeyExpiredError();
+    case "token-expired":
+      return new TokenExpiredError();
+    case "bad-signature":
+      return new InvalidTokenError({ message: "Invalid token signature" });
+    default:
+      return new UnauthorizedError3({ message: "Authentication failed" });
+  }
+}
+function bearerAuthContext(keyId, resolved) {
+  return {
+    user: resolved.user,
+    userId: String(resolved.user.id),
     keyId,
-    role,
-    locale,
+    role: resolved.role,
+    locale: resolved.locale,
     scheme: "bearer"
-  });
+  };
+}
+var authenticate = defineMiddleware2("auth", async (c, next) => {
+  const profile = await runAuthProfile(c);
+  if (profile.kind === "refused") {
+    return profile.response;
+  }
+  if (profile.kind === "authenticated") {
+    c.set("auth", profile.auth);
+    await next();
+    return void 0;
+  }
+  const outcome = await admitBearerKey(c, () => false);
+  if ("refused" in outcome) {
+    throw bearerRefusal(c, outcome.refused);
+  }
+  const keyRecord = outcome.key;
+  const keyId = keyRecord.keyId;
+  const resolved = await resolveAuthenticatedUser(keyRecord.userId);
+  const { user } = resolved;
+  keysRepository3.updateLastUsedById(keyRecord.id, readContextClientIdentity(c), attestedClientIp(c)).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
+  c.set("auth", bearerAuthContext(keyId, resolved));
   const method = c.req.method;
   const path = c.req.path;
   authLogger3.middleware.info("API access", {
@@ -18077,7 +18585,7 @@ var optionalAuth = defineMiddleware2("optionalAuth", async (c, next) => {
       return void 0;
     }
     const { user, role } = result;
-    keysRepository3.updateLastUsedById(keyRecord.id, readContextClientIdentity(c)).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
+    keysRepository3.updateLastUsedById(keyRecord.id, readContextClientIdentity(c), attestedClientIp(c)).catch((err) => authLogger3.middleware.error("Failed to update lastUsedAt", err));
     c.set("auth", {
       user,
       userId: String(user.id),
@@ -18092,12 +18600,199 @@ var optionalAuth = defineMiddleware2("optionalAuth", async (c, next) => {
   return void 0;
 }, { skips: ["auth"] });
 
+// src/server/middleware/authenticate-for-renewal.ts
+function admitsForRenewal(key) {
+  return key.binding === "passkey" && key.expiresAt !== null && Date.now() < key.expiresAt.getTime() + getBoundKeyRenewGraceMs();
+}
+var authenticateForRenewal = defineMiddleware3("authForRenewal", async (c, next) => {
+  const outcome = await admitBearerKey(c, admitsForRenewal);
+  if ("refused" in outcome || !admitsForRenewal(outcome.key)) {
+    throw new SessionRenewalRefusedError2();
+  }
+  const resolved = await activeAccount(outcome.key.userId);
+  if (!resolved) {
+    throw new SessionRenewalRefusedError2();
+  }
+  c.set("auth", bearerAuthContext(outcome.key.keyId, resolved));
+  await next();
+  return void 0;
+}, { skips: ["auth"] });
+async function activeAccount(userId) {
+  const [result, locale] = await Promise.all([
+    usersRepository.findByIdWithRole(userId),
+    userProfilesRepository.findLocaleByUserId(userId)
+  ]);
+  if (!result || result.user.status !== "active") {
+    return null;
+  }
+  return { user: result.user, role: result.role?.name ?? null, locale };
+}
+
+// src/server/routes/auth/session-renew.ts
+init_types();
+var CredentialResponseSchema2 = Type.Unknown({
+  description: "The credential from @simplewebauthn/browser, passed through unchanged"
+});
+var RENEW_RATE_LIMIT = { limit: 10, windowMs: 6e4 };
+var sessionRenewOptions = route6.post("/_auth/session/renew/options").input({
+  body: Type.Object({})
+}).use([rateLimitPolicy6("auth-session-renew", RENEW_RATE_LIMIT), authenticateForRenewal]).handler(async (c) => {
+  return await startSessionRenewService({ expiredKeyId: getAuth(c).keyId });
+});
+var sessionRenewVerify = route6.post("/_auth/session/renew/verify").input({
+  body: Type.Object({
+    response: CredentialResponseSchema2
+  })
+}).interceptor({
+  body: Type.Object({
+    publicKey: Type.String({ description: "Client public key" }),
+    keyId: Type.String({ description: "Key identifier" }),
+    fingerprint: Type.String({ description: "Key fingerprint" }),
+    algorithm: Type.Optional(Type.Union(
+      KEY_ALGORITHM.map((algo) => Type.Literal(algo)),
+      { description: "Signature algorithm \u2014 the service default when absent" }
+    ))
+  })
+}).use([rateLimitPolicy6("auth-session-renew", RENEW_RATE_LIMIT), authenticateForRenewal, Transactional5()]).handler(async (c) => {
+  const { body } = await c.data();
+  return await finishSessionRenewService({
+    ...body,
+    expiredKeyId: getAuth(c).keyId,
+    response: body.response
+  });
+});
+
+// src/server/routes/auth/passkeys.ts
+init_esm();
+import { Transactional as Transactional6 } from "@spfn/core/db";
+import { rateLimitPolicy as rateLimitPolicy7 } from "@spfn/core/middleware";
+import { route as route7 } from "@spfn/core/route";
+init_types();
+init_passkeys();
+init_schema3();
+var CredentialResponseSchema3 = Type.Unknown({
+  description: "The credential from @simplewebauthn/browser, passed through unchanged"
+});
+var PasskeyIdSchema2 = Type.String({
+  pattern: "^[0-9]{1,19}$",
+  description: "Passkey identifier, as returned by list"
+});
+var PasskeyLabelSchema = Type.String({
+  minLength: 1,
+  maxLength: PASSKEY_LABEL_MAX_LENGTH,
+  description: `Owner-facing name in the passkey list (1-${PASSKEY_LABEL_MAX_LENGTH} chars)`
+});
+var CurrentPasswordSchema2 = Type.String({
+  minLength: 1,
+  description: "Account password, needed when the session proved itself longer ago than the recent-authentication window"
+});
+var passkeyRegisterOptions = route7.post("/_auth/passkeys/register/options").input({
+  body: Type.Object({
+    currentPassword: Type.Optional(CurrentPasswordSchema2)
+  })
+}).use([rateLimitPolicy7("auth-passkey-register-options", {
+  limit: 10,
+  windowMs: 6e4,
+  by: byIpAndCaller({ ipLimit: 100 })
+})]).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId, keyId } = getAuth(c);
+  return await startPasskeyEnrollmentService({
+    userId: Number(userId),
+    keyId,
+    currentPassword: body.currentPassword
+  });
+});
+var passkeyRegisterVerify = route7.post("/_auth/passkeys/register/verify").input({
+  body: Type.Object({
+    response: CredentialResponseSchema3,
+    label: Type.Optional(PasskeyLabelSchema)
+  })
+}).use([
+  rateLimitPolicy7("auth-passkey-register-verify", {
+    limit: 10,
+    windowMs: 6e4,
+    by: byIpAndCaller({ ipLimit: 100 })
+  }),
+  Transactional6()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId } = getAuth(c);
+  return await finishPasskeyEnrollmentService({
+    userId: Number(userId),
+    response: body.response,
+    label: body.label
+  });
+});
+var passkeyLoginOptions = route7.post("/_auth/passkeys/login/options").input({
+  body: Type.Object({}, {
+    additionalProperties: false,
+    description: "No identifier is accepted \u2014 sign-in is discoverable"
+  })
+}).use([rateLimitPolicy7("auth-passkey-login-options", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async () => {
+  return await startPasskeyLoginService();
+});
+var passkeyLoginVerify = route7.post("/_auth/passkeys/login/verify").input({
+  body: Type.Object({
+    response: CredentialResponseSchema3
+  })
+}).interceptor({
+  body: Type.Object({
+    publicKey: Type.String({ description: "Client public key" }),
+    keyId: Type.String({ description: "Key identifier" }),
+    fingerprint: Type.String({ description: "Key fingerprint" }),
+    algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" }),
+    oldKeyId: Type.Optional(Type.String({ description: "Previous key ID for rotation" })),
+    deviceName: Type.Optional(DeviceNameSchema),
+    platform: Type.Optional(PlatformSchema)
+  })
+}).use([rateLimitPolicy7("auth-passkey-login-verify", { limit: 10, windowMs: 6e4 }), Transactional6()]).skip(["auth"]).handler(async (c) => {
+  const { body } = await c.data();
+  return await finishPasskeyLoginService({
+    ...body,
+    ...deviceProvenance(c.raw),
+    response: body.response
+  });
+});
+var listPasskeys = route7.post("/_auth/passkeys/list").input({
+  body: Type.Object({})
+}).handler(async (c) => {
+  const { userId } = getAuth(c);
+  return { passkeys: await listPasskeysService(Number(userId)) };
+});
+var renamePasskey = route7.post("/_auth/passkeys/rename").input({
+  body: Type.Object({
+    passkeyId: PasskeyIdSchema2,
+    label: PasskeyLabelSchema
+  })
+}).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId } = getAuth(c);
+  return await renamePasskeyService({ userId: Number(userId), ...body });
+});
+var revokePasskey = route7.post("/_auth/passkeys/revoke").input({
+  body: Type.Object({
+    passkeyId: PasskeyIdSchema2,
+    currentPassword: Type.Optional(CurrentPasswordSchema2)
+  })
+}).use([
+  rateLimitPolicy7("auth-passkey-revoke", { limit: 10, windowMs: 6e4, by: byIpAndCaller({ ipLimit: 100 }) }),
+  Transactional6()
+]).handler(async (c) => {
+  const { body } = await c.data();
+  const { userId, keyId } = getAuth(c);
+  return await revokePasskeyService({ userId: Number(userId), keyId, ...body });
+});
+
+// src/server/routes/invitations/index.ts
+import { EMAIL_PATTERN as EMAIL_PATTERN2, UUID_PATTERN } from "@spfn/auth";
+
 // src/server/middleware/require-permission.ts
-import { defineMiddleware as defineMiddleware3 } from "@spfn/core/route";
+import { defineMiddleware as defineMiddleware4 } from "@spfn/core/route";
 import { ForbiddenError as ForbiddenError3 } from "@spfn/core/errors";
 import { InsufficientPermissionsError } from "@spfn/auth/errors";
 import { getAuth as getAuth2, hasAllPermissions as hasAllPermissions2, hasAnyPermission as hasAnyPermission2, authLogger as authLogger4 } from "@spfn/auth/server";
-var requirePermissions = defineMiddleware3(
+var requirePermissions = defineMiddleware4(
   "permission",
   (...permissionNames) => async (c, next) => {
     const auth = getAuth2(c);
@@ -18125,7 +18820,7 @@ var requirePermissions = defineMiddleware3(
     await next();
   }
 );
-var requireAnyPermission = defineMiddleware3(
+var requireAnyPermission = defineMiddleware4(
   "anyPermission",
   (...permissionNames) => async (c, next) => {
     const auth = getAuth2(c);
@@ -18155,11 +18850,11 @@ var requireAnyPermission = defineMiddleware3(
 );
 
 // src/server/middleware/require-role.ts
-import { defineMiddleware as defineMiddleware4 } from "@spfn/core/route";
+import { defineMiddleware as defineMiddleware5 } from "@spfn/core/route";
 import { getAuth as getAuth3, authLogger as authLogger5 } from "@spfn/auth/server";
 import { ForbiddenError as ForbiddenError4 } from "@spfn/core/errors";
 import { InsufficientRoleError } from "@spfn/auth/errors";
-var requireRole = defineMiddleware4(
+var requireRole = defineMiddleware5(
   "role",
   (...roleNames) => async (c, next) => {
     const auth = getAuth3(c);
@@ -18190,11 +18885,11 @@ var requireRole = defineMiddleware4(
 );
 
 // src/server/middleware/role-guard.ts
-import { defineMiddleware as defineMiddleware5 } from "@spfn/core/route";
+import { defineMiddleware as defineMiddleware6 } from "@spfn/core/route";
 import { getAuth as getAuth4, authLogger as authLogger6 } from "@spfn/auth/server";
 import { ForbiddenError as ForbiddenError5 } from "@spfn/core/errors";
 import { InsufficientRoleError as InsufficientRoleError2 } from "@spfn/auth/errors";
-var roleGuard = defineMiddleware5(
+var roleGuard = defineMiddleware6(
   "roleGuard",
   (options) => async (c, next) => {
     const { allow, deny } = options;
@@ -18242,10 +18937,10 @@ var roleGuard = defineMiddleware5(
 );
 
 // src/server/middleware/one-time-token-auth.ts
-import { defineMiddleware as defineMiddleware6 } from "@spfn/core/route";
+import { defineMiddleware as defineMiddleware7 } from "@spfn/core/route";
 import { UnauthorizedError as UnauthorizedError4 } from "@spfn/core/errors";
 import { usersRepository as usersRepository4, userProfilesRepository as userProfilesRepository4 } from "@spfn/auth/server";
-var oneTimeTokenAuth = defineMiddleware6("oneTimeTokenAuth", async (c, next) => {
+var oneTimeTokenAuth = defineMiddleware7("oneTimeTokenAuth", async (c, next) => {
   const token = c.req.query("token") ?? extractOTTHeader(c.req.header("Authorization"));
   if (!token) {
     throw new UnauthorizedError4({ message: "One-time token required: ?token=xxx or Authorization: OTT xxx" });
@@ -18284,12 +18979,12 @@ function extractOTTHeader(header) {
 }
 
 // src/server/middleware/ops-token-auth.ts
-import { defineMiddleware as defineMiddleware7 } from "@spfn/core/route";
+import { defineMiddleware as defineMiddleware8 } from "@spfn/core/route";
 import { ForbiddenError as ForbiddenError6, UnauthorizedError as UnauthorizedError5 } from "@spfn/core/errors";
 function getOpsToken(c) {
   return c.get("opsToken") ?? null;
 }
-var opsTokenAuth = defineMiddleware7("opsTokenAuth", async (c, next) => {
+var opsTokenAuth = defineMiddleware8("opsTokenAuth", async (c, next) => {
   const token = extractBearer2(c.req.header("Authorization"));
   if (!token) {
     throw new UnauthorizedError5({ message: "Ops token required: Authorization: Bearer <token>" });
@@ -18301,7 +18996,7 @@ var opsTokenAuth = defineMiddleware7("opsTokenAuth", async (c, next) => {
   c.set("opsToken", verified);
   await next();
 }, { skips: ["auth"] });
-var requireOpsScope = defineMiddleware7(
+var requireOpsScope = defineMiddleware8(
   "opsScope",
   (...scopes) => async (c, next) => {
     const token = getOpsToken(c);
@@ -18362,18 +19057,18 @@ function chain(handlers) {
 // src/server/routes/invitations/index.ts
 init_types();
 init_esm();
-import { Transactional as Transactional5 } from "@spfn/core/db";
-import { rateLimitPolicy as rateLimitPolicy6 } from "@spfn/core/middleware";
-import { defineRouter as defineRouter2, route as route6 } from "@spfn/core/route";
+import { Transactional as Transactional7 } from "@spfn/core/db";
+import { rateLimitPolicy as rateLimitPolicy8 } from "@spfn/core/middleware";
+import { defineRouter as defineRouter2, route as route8 } from "@spfn/core/route";
 var INVITATION_STATUSES2 = ["pending", "accepted", "expired", "cancelled"];
-var getInvitation = route6.get("/_auth/invitations/:token").input({
+var getInvitation = route8.get("/_auth/invitations/:token").input({
   params: Type.Object({
     token: Type.String({
       pattern: UUID_PATTERN,
       description: "Invitation token (UUID v4)"
     })
   })
-}).use([rateLimitPolicy6("auth-invitation-lookup", { limit: 30, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy8("auth-invitation-lookup", { limit: 30, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params } = await c.data();
   const token = params.token;
   const validation = await validateInvitation(token);
@@ -18393,7 +19088,7 @@ var getInvitation = route6.get("/_auth/invitations/:token").input({
     metadata: invitation.metadata || void 0
   };
 });
-var acceptInvitation2 = route6.post("/_auth/invitations/accept").input({
+var acceptInvitation2 = route8.post("/_auth/invitations/accept").input({
   body: Type.Object({
     token: Type.String({
       pattern: UUID_PATTERN,
@@ -18412,7 +19107,7 @@ var acceptInvitation2 = route6.post("/_auth/invitations/accept").input({
     fingerprint: Type.String({ description: "Key fingerprint" }),
     algorithm: Type.Union(KEY_ALGORITHM.map((algo) => Type.Literal(algo)), { description: "Signature algorithm" })
   })
-}).use([rateLimitPolicy6("auth-invitation-accept", { limit: 10, windowMs: 6e4 }), Transactional5()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy8("auth-invitation-accept", { limit: 10, windowMs: 6e4 }), Transactional7()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   return await acceptInvitation({
     token: body.token,
@@ -18424,7 +19119,7 @@ var acceptInvitation2 = route6.post("/_auth/invitations/accept").input({
     ...deviceProvenance(c.raw)
   });
 });
-var createInvitation2 = route6.post("/_auth/invitations").input({
+var createInvitation2 = route8.post("/_auth/invitations").input({
   body: Type.Object({
     email: Type.String({
       pattern: EMAIL_PATTERN2,
@@ -18469,7 +19164,7 @@ var createInvitation2 = route6.post("/_auth/invitations").input({
     invitationUrl
   };
 });
-var listInvitations2 = route6.get("/_auth/invitations").input({
+var listInvitations2 = route8.get("/_auth/invitations").input({
   query: Type.Object({
     status: Type.Optional(Type.Union(
       INVITATION_STATUSES2.map((s) => Type.Literal(s)),
@@ -18498,7 +19193,7 @@ var listInvitations2 = route6.get("/_auth/invitations").input({
     invitations: formattedInvitations
   };
 });
-var cancelInvitation2 = route6.post("/_auth/invitations/cancel").input({
+var cancelInvitation2 = route8.post("/_auth/invitations/cancel").input({
   body: Type.Object({
     id: Type.Number({
       description: "Invitation ID"
@@ -18519,7 +19214,7 @@ var cancelInvitation2 = route6.post("/_auth/invitations/cancel").input({
     cancelledAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 });
-var resendInvitation2 = route6.post("/_auth/invitations/resend").input({
+var resendInvitation2 = route8.post("/_auth/invitations/resend").input({
   body: Type.Object({
     id: Type.Number({
       description: "Invitation ID"
@@ -18540,7 +19235,7 @@ var resendInvitation2 = route6.post("/_auth/invitations/resend").input({
     expiresAt: updated.expiresAt.toISOString()
   };
 });
-var deleteInvitation2 = route6.post("/_auth/invitations/delete").input({
+var deleteInvitation2 = route8.post("/_auth/invitations/delete").input({
   body: Type.Object({
     id: Type.Number({
       description: "Invitation ID"
@@ -18563,13 +19258,13 @@ var invitationRouter = defineRouter2({
 
 // src/server/routes/users/index.ts
 init_esm();
-import { rateLimitPolicy as rateLimitPolicy7 } from "@spfn/core/middleware";
-import { defineRouter as defineRouter3, route as route7 } from "@spfn/core/route";
-var getUserProfile = route7.get("/_auth/users/profile").handler(async (c) => {
+import { rateLimitPolicy as rateLimitPolicy9 } from "@spfn/core/middleware";
+import { defineRouter as defineRouter3, route as route9 } from "@spfn/core/route";
+var getUserProfile = route9.get("/_auth/users/profile").handler(async (c) => {
   const { userId } = getAuth(c);
   return await getUserProfileService(userId);
 });
-var updateUserProfile = route7.patch("/_auth/users/profile").input({
+var updateUserProfile = route9.patch("/_auth/users/profile").input({
   body: Type.Object({
     displayName: Type.Optional(Type.String({ description: "Display name shown in UI" })),
     firstName: Type.Optional(Type.String({ description: "First name" })),
@@ -18591,15 +19286,15 @@ var updateUserProfile = route7.patch("/_auth/users/profile").input({
   const { body } = await c.data();
   return await updateUserProfileService(userId, body);
 });
-var checkUsername = route7.get("/_auth/users/username/check").input({
+var checkUsername = route9.get("/_auth/users/username/check").input({
   query: Type.Object({
     username: Type.String({ minLength: 1 })
   })
-}).use([rateLimitPolicy7("auth-username-check", { limit: 30, windowMs: 6e4 })]).handler(async (c) => {
+}).use([rateLimitPolicy9("auth-username-check", { limit: 30, windowMs: 6e4 })]).handler(async (c) => {
   const { query } = await c.data();
   return { available: await checkUsernameAvailableService(query.username) };
 });
-var updateUsername = route7.patch("/_auth/users/username").input({
+var updateUsername = route9.patch("/_auth/users/username").input({
   body: Type.Object({
     username: Type.Union([
       Type.String({ minLength: 1 }),
@@ -18611,7 +19306,7 @@ var updateUsername = route7.patch("/_auth/users/username").input({
   const { body } = await c.data();
   return await updateUsernameService(userId, body.username);
 });
-var updateLocale = route7.patch("/_auth/users/locale").input({
+var updateLocale = route9.patch("/_auth/users/locale").input({
   body: Type.Object({
     locale: Type.String({ minLength: 1, description: "Locale code (e.g., en, ko, ja)" })
   })
@@ -18821,22 +19516,23 @@ var deleteCookie = (c, name, opt) => {
 // src/server/routes/oauth/index.ts
 init_types();
 init_schema3();
-import { Transactional as Transactional6 } from "@spfn/core/db";
-import { ValidationError as ValidationError16 } from "@spfn/core/errors";
-import { rateLimitPolicy as rateLimitPolicy8 } from "@spfn/core/middleware";
-import { defineRouter as defineRouter4, route as route8 } from "@spfn/core/route";
+init_config();
+import { Transactional as Transactional8 } from "@spfn/core/db";
+import { ValidationError as ValidationError17 } from "@spfn/core/errors";
+import { rateLimitPolicy as rateLimitPolicy10 } from "@spfn/core/middleware";
+import { defineRouter as defineRouter4, route as route10 } from "@spfn/core/route";
 var providerParams = Type.Object({
   provider: Type.Union(SOCIAL_PROVIDERS.map((p) => Type.Literal(p)), {
     description: "OAuth provider id (google, github, kakao, naver, superself)"
   })
 });
-var oauthGoogleStart = route8.get("/_auth/oauth/google").input({
+var oauthGoogleStart = route10.get("/_auth/oauth/google").input({
   query: Type.Object({
     state: Type.String({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).use([rateLimitPolicy8("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (!isGoogleOAuthEnabled()) {
     return c.redirect(buildOAuthErrorUrl("Google OAuth is not configured"));
@@ -18844,7 +19540,7 @@ var oauthGoogleStart = route8.get("/_auth/oauth/google").input({
   const authUrl = getGoogleAuthUrl(query.state);
   return c.redirect(authUrl);
 });
-var oauthGoogleCallback = route8.get("/_auth/oauth/google/callback").input({
+var oauthGoogleCallback = route10.get("/_auth/oauth/google/callback").input({
   query: Type.Object({
     code: Type.Optional(Type.String({
       description: "Authorization code from Google"
@@ -18859,7 +19555,7 @@ var oauthGoogleCallback = route8.get("/_auth/oauth/google/callback").input({
       description: "Error description from Google"
     }))
   })
-}).use([rateLimitPolicy8("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional6()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional8()]).skip(["auth"]).handler(async (c) => {
   const { query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -18886,7 +19582,7 @@ var oauthGoogleCallback = route8.get("/_auth/oauth/google/callback").input({
     return c.redirect(buildOAuthErrorUrl(message));
   }
 });
-var oauthStart = route8.post("/_auth/oauth/start").input({
+var oauthStart = route10.post("/_auth/oauth/start").input({
   body: Type.Object({
     provider: Type.Union(SOCIAL_PROVIDERS.map((p) => Type.Literal(p)), {
       description: "OAuth provider (google, github, kakao, naver)"
@@ -18910,10 +19606,10 @@ var oauthStart = route8.post("/_auth/oauth/start").input({
       description: "Custom metadata passed to authRegisterEvent (e.g. referral code, UTM params)"
     }))
   })
-}).use([rateLimitPolicy8("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isSafeReturnPath(body.returnUrl)) {
-    throw new ValidationError16({ message: "returnUrl must be a relative path within the app" });
+    throw new ValidationError17({ message: "returnUrl must be a relative path within the app" });
   }
   const nonce = generateOAuthNonce();
   setCookie(c.raw, COOKIE_NAMES.OAUTH_CSRF, nonce, {
@@ -18926,12 +19622,12 @@ var oauthStart = route8.post("/_auth/oauth/start").input({
   const result = await oauthStartService({ ...body, nonce });
   return result;
 });
-var oauthProviders = route8.get("/_auth/oauth/providers").skip(["auth"]).handler(async () => {
+var oauthProviders = route10.get("/_auth/oauth/providers").skip(["auth"]).handler(async () => {
   return {
     providers: getEnabledOAuthProviders()
   };
 });
-var getGoogleOAuthUrl = route8.post("/_auth/oauth/google/url").input({
+var getGoogleOAuthUrl = route10.post("/_auth/oauth/google/url").input({
   body: Type.Object({
     returnUrl: Type.Optional(Type.String({
       description: "URL to redirect after OAuth success"
@@ -18943,44 +19639,45 @@ var getGoogleOAuthUrl = route8.post("/_auth/oauth/google/url").input({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
   })
-}).use([rateLimitPolicy8("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isGoogleOAuthEnabled()) {
-    throw new ValidationError16({ message: "Google OAuth is not configured" });
+    throw new ValidationError17({ message: "Google OAuth is not configured" });
   }
   if (!body.state) {
-    throw new ValidationError16({
+    throw new ValidationError17({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
   return { authUrl: getGoogleAuthUrl(body.state) };
 });
-var oauthFinalize = route8.post("/_auth/oauth/finalize").input({
+var oauthFinalize = route10.post("/_auth/oauth/finalize").input({
   body: Type.Object({
     userId: Type.String({ description: "User ID from OAuth callback" }),
     keyId: Type.String({ description: "Key ID from OAuth state" }),
     returnUrl: Type.Optional(Type.String({ description: "URL to redirect after login" }))
   })
-}).use([rateLimitPolicy8("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (body.returnUrl && !isSafeReturnPath(body.returnUrl)) {
-    throw new ValidationError16({ message: "returnUrl must be a relative path within the app" });
+    throw new ValidationError17({ message: "returnUrl must be a relative path within the app" });
   }
   return {
     success: true,
     userId: body.userId,
     keyId: body.keyId,
-    returnUrl: body.returnUrl || "/"
+    returnUrl: body.returnUrl || "/",
+    ...await keySessionBindingService(body.keyId)
   };
 });
-var oauthProviderStart = route8.get("/_auth/oauth/:provider").input({
+var oauthProviderStart = route10.get("/_auth/oauth/:provider").input({
   params: providerParams,
   query: Type.Object({
     state: Type.String({
       description: "Encrypted OAuth state (returnUrl, publicKey, keyId, fingerprint, algorithm)"
     })
   })
-}).use([rateLimitPolicy8("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   const provider = getOAuthProvider(params.provider);
   if (!provider?.isEnabled()) {
@@ -18988,7 +19685,7 @@ var oauthProviderStart = route8.get("/_auth/oauth/:provider").input({
   }
   return c.redirect(provider.getAuthUrl(query.state));
 });
-var oauthProviderCallback = route8.get("/_auth/oauth/:provider/callback").input({
+var oauthProviderCallback = route10.get("/_auth/oauth/:provider/callback").input({
   params: providerParams,
   query: Type.Object({
     code: Type.Optional(Type.String({
@@ -19004,7 +19701,7 @@ var oauthProviderCallback = route8.get("/_auth/oauth/:provider/callback").input(
       description: "Error description from provider"
     }))
   })
-}).use([rateLimitPolicy8("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional6()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-callback", { limit: 30, windowMs: 6e4 }), Transactional8()]).skip(["auth"]).handler(async (c) => {
   const { params, query } = await c.data();
   if (query.error) {
     const errorMessage = query.error_description || query.error;
@@ -19031,7 +19728,7 @@ var oauthProviderCallback = route8.get("/_auth/oauth/:provider/callback").input(
     return c.redirect(buildOAuthErrorUrl(message));
   }
 });
-var getProviderOAuthUrl = route8.post("/_auth/oauth/:provider/url").input({
+var getProviderOAuthUrl = route10.post("/_auth/oauth/:provider/url").input({
   params: providerParams,
   body: Type.Object({
     returnUrl: Type.Optional(Type.String({
@@ -19044,17 +19741,17 @@ var getProviderOAuthUrl = route8.post("/_auth/oauth/:provider/url").input({
       description: "Encrypted OAuth state (injected by interceptor)"
     }))
   })
-}).use([rateLimitPolicy8("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy10("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params, body } = await c.data();
   const provider = requireEnabledProvider(params.provider);
   if (!body.state) {
-    throw new ValidationError16({
+    throw new ValidationError17({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
   return { authUrl: provider.getAuthUrl(body.state) };
 });
-var oauthNative = route8.post("/_auth/oauth/:provider/native").input({
+var oauthNative = route10.post("/_auth/oauth/:provider/native").input({
   params: providerParams,
   body: Type.Object({
     idToken: Type.String({ description: "id_token from native/web social SDK" }),
@@ -19081,7 +19778,7 @@ var oauthNative = route8.post("/_auth/oauth/:provider/native").input({
       description: "Custom metadata passed to auth events (e.g. referral code, UTM params)"
     }))
   })
-}).use([rateLimitPolicy8("oauth-native", {
+}).use([rateLimitPolicy10("oauth-native", {
   limit: 5,
   windowMs: 6e4,
   by: byIpAndIdToken({ ipLimit: 20 })
@@ -19129,12 +19826,12 @@ async function processUnlinkNotify(provider, raw) {
     return error instanceof UnlinkNotifyRejection ? error.status : 400;
   }
 }
-var oauthUnlinkNotify = route8.post("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy8("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+var oauthUnlinkNotify = route10.post("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy10("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params } = await c.data();
   const status = await processUnlinkNotify(params.provider, c.raw);
   return status === 204 ? c.noContent() : c.json({}, status);
 });
-var oauthUnlinkNotifyGet = route8.get("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy8("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+var oauthUnlinkNotifyGet = route10.get("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy10("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { params } = await c.data();
   const status = await processUnlinkNotify(params.provider, c.raw);
   return status === 204 ? c.noContent() : c.json({}, status);
@@ -19157,8 +19854,8 @@ var oauthRouter = defineRouter4({
 // src/server/routes/admin/index.ts
 init_esm();
 import { ForbiddenError as ForbiddenError7 } from "@spfn/core/errors";
-import { route as route9 } from "@spfn/core/route";
-var listRoles = route9.get("/_auth/admin/roles").input({
+import { route as route11 } from "@spfn/core/route";
+var listRoles = route11.get("/_auth/admin/roles").input({
   query: Type.Object({
     includeInactive: Type.Optional(Type.Boolean({
       description: "Include inactive roles (default: false)"
@@ -19169,7 +19866,7 @@ var listRoles = route9.get("/_auth/admin/roles").input({
   const roles2 = await getAllRoles(query.includeInactive ?? false);
   return { roles: roles2 };
 });
-var createAdminRole = route9.post("/_auth/admin/roles").input({
+var createAdminRole = route11.post("/_auth/admin/roles").input({
   body: Type.Object({
     name: Type.String({ description: "Unique role name (slug)" }),
     displayName: Type.String({ description: "Human-readable role name" }),
@@ -19191,7 +19888,7 @@ var createAdminRole = route9.post("/_auth/admin/roles").input({
   });
   return { role };
 });
-var updateAdminRole = route9.patch("/_auth/admin/roles/:id").input({
+var updateAdminRole = route11.patch("/_auth/admin/roles/:id").input({
   params: Type.Object({
     id: Type.Number({ description: "Role ID" })
   }),
@@ -19206,7 +19903,7 @@ var updateAdminRole = route9.patch("/_auth/admin/roles/:id").input({
   const role = await updateRole(params.id, body);
   return { role };
 });
-var deleteAdminRole = route9.delete("/_auth/admin/roles/:id").input({
+var deleteAdminRole = route11.delete("/_auth/admin/roles/:id").input({
   params: Type.Object({
     id: Type.Number({ description: "Role ID" })
   })
@@ -19215,7 +19912,7 @@ var deleteAdminRole = route9.delete("/_auth/admin/roles/:id").input({
   await deleteRole(params.id);
   return c.noContent();
 });
-var updateUserRole = route9.patch("/_auth/admin/users/:userId/role").input({
+var updateUserRole = route11.patch("/_auth/admin/users/:userId/role").input({
   params: Type.Object({
     userId: Type.Number({ description: "User ID" })
   }),
@@ -19240,17 +19937,17 @@ var updateUserRole = route9.patch("/_auth/admin/users/:userId/role").input({
 // src/server/routes/deletion/index.ts
 init_esm();
 init_schema3();
-import { Transactional as Transactional7 } from "@spfn/core/db";
-import { rateLimitPolicy as rateLimitPolicy9 } from "@spfn/core/middleware";
-import { defineRouter as defineRouter5, route as route10 } from "@spfn/core/route";
-var requestAccountDeletion = route10.post("/_auth/deletion/request").input({
+import { Transactional as Transactional9 } from "@spfn/core/db";
+import { rateLimitPolicy as rateLimitPolicy11 } from "@spfn/core/middleware";
+import { defineRouter as defineRouter5, route as route12 } from "@spfn/core/route";
+var requestAccountDeletion = route12.post("/_auth/deletion/request").input({
   body: Type.Object({
     password: Type.Optional(Type.String({ minLength: 1, description: "Current password, if the account has one" })),
     verificationToken: Type.Optional(Type.String({ description: "Verification token (purpose: account_deletion), for passwordless/OAuth-only accounts" })),
     reason: Type.Optional(Type.String({ maxLength: 500, description: "Optional free-text reason" })),
     immediate: Type.Optional(Type.Boolean({ description: "Skip the grace period \u2014 requires deletion.allowSelfImmediate on the server" }))
   })
-}).use([rateLimitPolicy9("auth-deletion-request", { limit: 5, windowMs: 6e4 }), Transactional7()]).handler(async (c) => {
+}).use([rateLimitPolicy11("auth-deletion-request", { limit: 5, windowMs: 6e4 }), Transactional9()]).handler(async (c) => {
   const { body } = await c.data();
   const { userId } = getAuth(c);
   const result = await requestAccountDeletionService(Number(userId), {
@@ -19264,7 +19961,7 @@ var requestAccountDeletion = route10.post("/_auth/deletion/request").input({
     purgeScheduledAt: result.purgeScheduledAt.toISOString()
   };
 });
-var cancelAccountDeletion = route10.post("/_auth/deletion/cancel").input({
+var cancelAccountDeletion = route12.post("/_auth/deletion/cancel").input({
   body: Type.Object({
     email: Type.Optional(EmailSchema),
     phone: Type.Optional(PhoneSchema),
@@ -19275,7 +19972,7 @@ var cancelAccountDeletion = route10.post("/_auth/deletion/cancel").input({
     // email/phone + password|verificationToken
     description: "Email or phone must be provided with password or verificationToken"
   })
-}).use([rateLimitPolicy9("auth-deletion-cancel", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 50 }) }), Transactional7()]).skip(["auth"]).handler(async (c) => {
+}).use([rateLimitPolicy11("auth-deletion-cancel", { limit: 10, windowMs: 6e4, by: byIpAndAccount({ ipLimit: 50 }) }), Transactional9()]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   await cancelAccountDeletionService(body);
   return c.noContent();
@@ -19287,7 +19984,7 @@ var deletionRouter = defineRouter5({
 
 // src/server/routes/ops-tokens/index.ts
 init_esm();
-import { route as route11 } from "@spfn/core/route";
+import { route as route13 } from "@spfn/core/route";
 import { BadRequestError as BadRequestError2, NotFoundError as NotFoundError5 } from "@spfn/core/errors";
 var MAX_EXPIRY_DAYS = 36500;
 function toSummary2(record) {
@@ -19301,7 +19998,7 @@ function toSummary2(record) {
     createdAt: record.createdAt ? record.createdAt.toISOString() : null
   };
 }
-var issueOpsToken = route11.post("/_auth/ops-tokens").input({
+var issueOpsToken = route13.post("/_auth/ops-tokens").input({
   body: Type.Object({
     name: Type.String({ minLength: 1, description: "Operator-facing label" }),
     scopes: Type.Array(Type.String({ minLength: 1 }), {
@@ -19327,10 +20024,10 @@ var issueOpsToken = route11.post("/_auth/ops-tokens").input({
   const { token, record } = await issueOpsTokenService(body.name, body.scopes, expiresAt);
   return { token, opsToken: toSummary2(record) };
 });
-var listOpsTokens = route11.get("/_auth/ops-tokens").use([authenticate, requireRole("admin", "superadmin")]).handler(async () => {
+var listOpsTokens = route13.get("/_auth/ops-tokens").use([authenticate, requireRole("admin", "superadmin")]).handler(async () => {
   return { opsTokens: (await listOpsTokensService()).map(toSummary2) };
 });
-var revokeOpsToken = route11.delete("/_auth/ops-tokens/:id").input({
+var revokeOpsToken = route13.delete("/_auth/ops-tokens/:id").input({
   params: Type.Object({
     id: Type.Number({ description: "Ops token id" })
   })
@@ -19345,8 +20042,8 @@ var revokeOpsToken = route11.delete("/_auth/ops-tokens/:id").input({
 
 // src/server/routes/oauth2/index.ts
 init_esm();
-import { route as route12 } from "@spfn/core/route";
-import { getClientIp as getClientIp3, rateLimitPolicy as rateLimitPolicy10 } from "@spfn/core/middleware";
+import { route as route14 } from "@spfn/core/route";
+import { getClientIp as getClientIp3, rateLimitPolicy as rateLimitPolicy12 } from "@spfn/core/middleware";
 
 // src/server/routes/oauth2/http.ts
 import { NotFoundError as NotFoundError6 } from "@spfn/core/errors";
@@ -19405,7 +20102,7 @@ function flatten(parsed) {
 }
 
 // src/server/routes/oauth2/index.ts
-var registerOAuth2Client = route12.post("/_auth/oauth2/register").use([rateLimitPolicy10("auth-oauth2-register", { limit: 10, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+var registerOAuth2Client = route14.post("/_auth/oauth2/register").use([rateLimitPolicy12("auth-oauth2-register", { limit: 10, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   requireAuthorizationServer();
   const body = await readRegistrationBody(c.raw);
   const result = await registerOAuth2ClientService(body, getClientIp3(c.raw) || null);
@@ -19422,17 +20119,17 @@ async function readRegistrationBody(c) {
     return {};
   }
 }
-var listOAuth2Grants = route12.get("/_auth/oauth2/grants").use([authenticate]).handler(async (c) => {
+var listOAuth2Grants = route14.get("/_auth/oauth2/grants").use([authenticate]).handler(async (c) => {
   requireAuthorizationServer();
   return { grants: await listOAuth2GrantsService(Number(getAuth(c).userId)) };
 });
-var revokeOAuth2Grant = route12.delete("/_auth/oauth2/grants/:id").input({ params: Type.Object({ id: Type.Number({ description: "Grant id from the list" }) }) }).use([authenticate]).handler(async (c) => {
+var revokeOAuth2Grant = route14.delete("/_auth/oauth2/grants/:id").input({ params: Type.Object({ id: Type.Number({ description: "Grant id from the list" }) }) }).use([authenticate]).handler(async (c) => {
   requireAuthorizationServer();
   const { params } = await c.data();
   await revokeOAuth2GrantService(params.id, Number(getAuth(c).userId));
   return { revoked: true };
 });
-var oauth2AuthorizationServerMetadata = route12.get("/.well-known/oauth-authorization-server").skip(["auth"]).handler(async (c) => {
+var oauth2AuthorizationServerMetadata = route14.get("/.well-known/oauth-authorization-server").skip(["auth"]).handler(async (c) => {
   const config4 = requireAuthorizationServer();
   return c.json({
     issuer: config4.issuer,
@@ -19450,8 +20147,8 @@ var oauth2AuthorizationServerMetadata = route12.get("/.well-known/oauth-authoriz
 
 // src/server/routes/oauth2/authorize.ts
 init_esm();
-import { route as route13 } from "@spfn/core/route";
-import { rateLimitPolicy as rateLimitPolicy11 } from "@spfn/core/middleware";
+import { route as route15 } from "@spfn/core/route";
+import { rateLimitPolicy as rateLimitPolicy13 } from "@spfn/core/middleware";
 var AUTHORIZE_FIELDS = {
   client_id: Type.String({ minLength: 1, description: "client_id from dynamic registration" }),
   redirect_uri: Type.String({ minLength: 1, description: "Where the code is sent; must be registered" }),
@@ -19472,17 +20169,17 @@ function toParams(input) {
     state: input.state
   };
 }
-var authorizeRateLimit = rateLimitPolicy11("auth-oauth2-authorize", {
+var authorizeRateLimit = rateLimitPolicy13("auth-oauth2-authorize", {
   limit: 30,
   windowMs: 6e4,
   by: byIpAndCaller({ ipLimit: 120 })
 });
-var getOAuth2Authorize = route13.get("/_auth/oauth2/authorize").input({ query: Type.Object(AUTHORIZE_FIELDS) }).use([authenticate, authorizeRateLimit]).handler(async (c) => {
+var getOAuth2Authorize = route15.get("/_auth/oauth2/authorize").input({ query: Type.Object(AUTHORIZE_FIELDS) }).use([authenticate, authorizeRateLimit]).handler(async (c) => {
   requireAuthorizationServer();
   const { query } = await c.data();
   return await describeOAuth2AuthorizeRequestService(toParams(query));
 });
-var createOAuth2AuthorizationCode = route13.post("/_auth/oauth2/authorize").input({
+var createOAuth2AuthorizationCode = route15.post("/_auth/oauth2/authorize").input({
   body: Type.Object({
     ...AUTHORIZE_FIELDS,
     approve: Type.Boolean({ description: "What the account owner decided" })
@@ -19498,9 +20195,9 @@ var createOAuth2AuthorizationCode = route13.post("/_auth/oauth2/authorize").inpu
 });
 
 // src/server/routes/oauth2/token.ts
-import { route as route14 } from "@spfn/core/route";
-import { rateLimitPolicy as rateLimitPolicy12 } from "@spfn/core/middleware";
-var oauth2Token = route14.post("/_auth/oauth2/token").use([rateLimitPolicy12("auth-oauth2-token", { limit: 60, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+import { route as route16 } from "@spfn/core/route";
+import { rateLimitPolicy as rateLimitPolicy14 } from "@spfn/core/middleware";
+var oauth2Token = route16.post("/_auth/oauth2/token").use([rateLimitPolicy14("auth-oauth2-token", { limit: 60, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   requireAuthorizationServer();
   const result = await oauth2TokenService(await readOAuth2Body(c.raw));
   if (!result.ok) {
@@ -19508,7 +20205,7 @@ var oauth2Token = route14.post("/_auth/oauth2/token").use([rateLimitPolicy12("au
   }
   return oauth2JsonResponse(c.raw, 200, result.tokens);
 });
-var oauth2Revoke = route14.post("/_auth/oauth2/revoke").use([rateLimitPolicy12("auth-oauth2-revoke", { limit: 60, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+var oauth2Revoke = route16.post("/_auth/oauth2/revoke").use([rateLimitPolicy14("auth-oauth2-revoke", { limit: 60, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   requireAuthorizationServer();
   const body = await readOAuth2Body(c.raw);
   if (!body.client_id) {
@@ -19571,6 +20268,13 @@ var mainAuthRouter = defineRouter6({
   consumeRevokeAllLink: consumeRevokeAllLink2,
   changePassword,
   getAuthSession,
+  // Session binding routes (#97)
+  setSessionBinding,
+  getSessionBinding,
+  sessionBindingDisableOptions,
+  // Session renewal routes (#97) — public, like the sign-in paths
+  sessionRenewOptions,
+  sessionRenewVerify,
   // One-Time Token routes
   issueOneTimeToken,
   // Account deletion routes
@@ -19732,6 +20436,7 @@ function shouldRotateKey(createdAt, rotationDays = 90) {
 }
 
 // src/server/lib/session.ts
+init_logger();
 import * as jose2 from "jose";
 import { env as env19 } from "@spfn/auth/config";
 import { env as coreEnv } from "@spfn/core/config";
@@ -19817,9 +20522,16 @@ async function shouldRefreshSession(jwt4, thresholdHours = 24) {
   return hoursRemaining < thresholdHours;
 }
 
+// src/server/lib/index.ts
+init_config();
+
+// src/server.ts
+init_logger();
+
 // src/server/setup.ts
 import { env as env20 } from "@spfn/auth/config";
 import { getRoleByName as getRoleByName2 } from "@spfn/auth/server";
+init_logger();
 init_repositories();
 function parseAdminAccounts() {
   const accounts = [];
@@ -19940,7 +20652,11 @@ async function ensureAdminExists() {
   }
 }
 
+// src/server/lifecycle.ts
+init_logger();
+
 // src/server/lib/oauth/redirect-uri-check.ts
+init_logger();
 var PROVIDERS = ["google", "kakao", "naver", "github"];
 var OPT_OUT_VAR = "SPFN_AUTH_OAUTH_CALLBACK_ORIGIN_CHECK";
 function redirectUriVar(provider) {
@@ -20045,6 +20761,7 @@ import { defineJobRouter } from "@spfn/core/job";
 
 // src/server/jobs/deletion-purge.ts
 import { job as job2 } from "@spfn/core/job";
+init_logger();
 function createAuthDeletionPurgeJob(cronExpression = DEFAULT_DELETION_PURGE_CRON) {
   return job2("auth.deletion.purge").cron(cronExpression).options({ retryLimit: 1 }).handler(async () => {
     const result = await sweepDuePurges();
@@ -20056,6 +20773,7 @@ function createAuthDeletionPurgeJob(cronExpression = DEFAULT_DELETION_PURGE_CRON
 
 // src/server/jobs/oauth2-client-purge.ts
 import { job as job3 } from "@spfn/core/job";
+init_logger();
 var DEFAULT_OAUTH2_CLIENT_PURGE_CRON = "0 5 * * *";
 function createOAuth2ClientPurgeJob(cronExpression = DEFAULT_OAUTH2_CLIENT_PURGE_CRON) {
   return job3("auth.oauth2.client-purge").cron(cronExpression).options({ retryLimit: 1 }).handler(async () => {
@@ -20068,6 +20786,7 @@ function createOAuth2ClientPurgeJob(cronExpression = DEFAULT_OAUTH2_CLIENT_PURGE
 
 // src/server/jobs/revoke-all-token-purge.ts
 import { job as job4 } from "@spfn/core/job";
+init_logger();
 var DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON = "0 6 * * *";
 function createRevokeAllTokenPurgeJob(cronExpression = DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON) {
   return job4("auth.revoke-all-token-purge").cron(cronExpression).options({ retryLimit: 1 }).handler(async () => {
@@ -20080,6 +20799,7 @@ function createRevokeAllTokenPurgeJob(cronExpression = DEFAULT_REVOKE_ALL_TOKEN_
 
 // src/server/jobs/mfa-sweep.ts
 import { job as job5 } from "@spfn/core/job";
+init_logger();
 var DEFAULT_MFA_SWEEP_CRON = "0 7 * * *";
 function createMfaSweepJob(cronExpression = DEFAULT_MFA_SWEEP_CRON) {
   return job5("auth.mfa.sweep").cron(cronExpression).options({ retryLimit: 1 }).handler(async () => {
@@ -20166,6 +20886,7 @@ export {
   PublicKeySchema,
   RolePermissionsRepository,
   RolesRepository,
+  SESSION_BINDINGS,
   SOCIAL_PROVIDERS,
   STALE_CLIENT_MAX_AGE_MS,
   SUPPORTED_GRANT_TYPES,
@@ -20192,6 +20913,8 @@ export {
   accountDeletionRequests,
   accountDeletionRequestsRepository,
   addPermissionToRole,
+  admitBearerKey,
+  admitsForRenewal,
   appleProvider,
   approveDeviceAuthService,
   approveOAuth2AuthorizeService,
@@ -20216,6 +20939,8 @@ export {
   mainAuthRouter as authRouter,
   authSchema,
   authenticate,
+  authenticateForRenewal,
+  bearerAuthContext,
   buildOAuthErrorUrl,
   cancelAccountDeletionService,
   cancelInvitation,
@@ -20254,11 +20979,14 @@ export {
   deviceAuthorizations,
   deviceAuthorizationsRepository,
   disableMfaService,
+  disableSessionBindingService,
+  enableSessionBindingService,
   encryptToken,
   exchangeCodeForTokens,
   expireOldInvitations,
   finishPasskeyEnrollmentService,
   finishPasskeyLoginService,
+  finishSessionRenewService,
   formatUserCode,
   generateAccessToken,
   generateAuthorizationCode,
@@ -20276,6 +21004,9 @@ export {
   getAuthConfig,
   getAuthSessionService,
   getAuthorizationServerConfig,
+  getBoundKeyRenewGraceMs,
+  getBoundKeyTtlMs,
+  getConcurrentUseWindowMs,
   getCsrfExemptPaths,
   getCsrfMode,
   getDeletionConfig,
@@ -20305,7 +21036,9 @@ export {
   getRole,
   getRoleByName,
   getRolePermissions,
+  getSessionBindingService,
   getSessionInfo,
+  getSessionRenewPath,
   getSessionTtl,
   getUser,
   getUserByEmailService,
@@ -20344,6 +21077,7 @@ export {
   kakaoProvider,
   keyRevokeAllTokens,
   keyRevokeAllTokensRepository,
+  keySessionBindingService,
   keysRepository,
   linkMailJob,
   listInvitations,
@@ -20459,6 +21193,8 @@ export {
   startDeviceAuthService,
   startPasskeyEnrollmentService,
   startPasskeyLoginService,
+  startSessionBindingDisableService,
+  startSessionRenewService,
   startStepUpService,
   startTotpEnrolmentService,
   stepUpService,