@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.24

package/dist/{machine-principals-CaEFq61K.d.ts → machine-principals-ZJd9anVT.d.ts}

@@ -1,7 +1,7 @@
 import * as _simplewebauthn_server from '@simplewebauthn/server';
-import { RegistrationResponseJSON, AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
+import { AuthenticationResponseJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server';
+import { S as SessionBindingType, K as KeyAlgorithmType, h as KeyPlatformType, l as SocialProvider } from './types-CTdoTOxM.js';
 import * as _spfn_core_route from '@spfn/core/route';
-import { K as KeyAlgorithmType, h as KeyPlatformType, j as SocialProvider } from './types-DYyhze28.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
@@ -91,561 +91,29 @@ interface UserProfile {
 }
 
 /**
- * @spfn/auth - Auth Service
- *
- * Core authentication logic: registration, login, logout, password management
- */
-
-interface RegisterParams {
-    email?: string;
-    phone?: string;
-    verificationToken: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    metadata?: Record<string, unknown>;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-interface RegisterResult {
-    userId: string;
-    publicId: string;
-    email?: string;
-    phone?: string;
-}
-interface LoginParams {
-    email?: string;
-    phone?: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    oldKeyId?: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-interface LoginResult {
-    userId: string;
-    publicId: string;
-    email?: string;
-    phone?: string;
-    passwordChangeRequired: boolean;
-}
-interface LogoutParams {
-    userId: number;
-    keyId: string;
-}
-interface ChangePasswordParams {
-    userId: number;
-    /**
-     * The device key this request is signed with.
-     *
-     * Only read to measure the second-factor window of an enrolled account —
-     * an account with nothing enrolled is answered exactly as before, so this
-     * adds no refusal for anybody who has not opted in.
-     */
-    keyId: string;
-    currentPassword?: string;
-    newPassword: string;
-    passwordHash?: string;
-}
-/**
- * Register a new user account
- */
-declare function registerService(params: RegisterParams): Promise<RegisterResult>;
-/**
- * Authenticate user and create session
- */
-declare function loginService(params: LoginParams): Promise<LoginResult>;
-/**
- * Logout user (revoke current key)
- */
-declare function logoutService(params: LogoutParams): Promise<void>;
-/**
- * Change user password
- *
- * An enrolled account steps up first (#95): a stolen session must not be able
- * to take the account over by setting a new password. An unenrolled account is
- * unaffected — including the OAuth-only account with no password and a key
- * older than ten minutes, which still sets a first password and gets a 200.
- */
-declare function changePasswordService(params: ChangePasswordParams): Promise<void>;
-
-declare const EmailSchema: _sinclair_typebox.TString;
-declare const PhoneSchema: _sinclair_typebox.TString;
-/**
- * Optional device labels a client may send when registering a key.
- *
- * Display only: the key list uses them to tell one device from another, and
- * nothing is authorized or refused by either value, so a client that lies about
- * them gains nothing. Both are omitted by every key registered before they
- * existed, hence optional rather than defaulted.
- */
-declare const DeviceNameSchema: _sinclair_typebox.TString;
-declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
-/**
- * Key material as a device sends it, bounded.
- *
- * The bounds exist for the one route that takes this material from a caller who
- * has not authenticated and cannot: `POST /_auth/device/start` persists what it
- * is given, and a correctly fingerprinted megabyte of base64 would sit in
- * `device_authorizations` until something swept it — and nothing sweeps it.
- *
- * The numbers are what real key material measures, with room to spare. The
- * package's own generators produce SPKI DER in base64: 124 characters for
- * ES256 (P-256), 392 for RS256 (RSA-2048). An RSA-4096 key would be 736, an
- * RSA-8192 key about 1400, and the same 4096-bit key PEM-armoured about 800 —
- * so 2048 admits every shape of key anyone could reasonably present, while a
- * megabyte is refused three orders of magnitude before it reaches a row.
- *
- * `keyId` is a UUID (36) everywhere this package generates one; 64 leaves room
- * for a client that prefixes or namespaces its own. `fingerprint` is SHA-256
- * hex, exactly 64, and nothing else can ever verify against the public key —
- * 128 is the length a longer digest would need, and no more.
- */
-declare const PublicKeySchema: _sinclair_typebox.TString;
-declare const KeyIdSchema: _sinclair_typebox.TString;
-declare const FingerprintSchema: _sinclair_typebox.TString;
-/**
- * The code a person reads off the waiting device and types on their own.
- *
- * Loose on purpose: 8 characters plus an optional dash is what is shown, but the
- * server folds whitespace, dashes and lower case away before looking anything up,
- * so refusing those spellings here would refuse a code that is on screen. The
- * bounds exist to stop an unbounded string reaching the database, not to spell
- * out the format — `USER_CODE_ALPHABET` is the only thing that can match a row.
- */
-declare const UserCodeSchema: _sinclair_typebox.TString;
-/**
- * What `POST /_auth/device/poll` answers with.
- *
- * A union, because the two answers are different kinds of thing rather than one
- * shape with optional fields: pending says "ask again in this long", approved is
- * a completed login carrying exactly what `/_auth/login` returns. `status` is the
- * discriminant, so a generated client narrows on it instead of testing which
- * fields happen to be present.
+ * @spfn/auth - Passkeys Entity
  *
- * The mobile contract has no union type, so it exports this as one object with
- * `status` required and every branch field optional — see
- * `deviceAuthorization.pollStatusRule` in the bundle. `intervalMillis` is an
- * integer for the same reason: that grammar carries no floating-point scalar,
- * and a count of milliseconds never needed one.
+ * A WebAuthn credential the account owner enrolled on one of their devices.
+ * It is a *credential*, not a session: an assertion proves who is asking, and
+ * the ordinary device key in `user_public_keys` is what the request afterwards
+ * is signed with. The two tables therefore never stand in for each other.
  *
- * That integer is a promise two things keep, because nothing validates a response
- * against this schema on the way out. `configureDeviceAuth` refuses an interval
- * that is not a whole number of milliseconds, so the only value this branch can
- * carry is one; and `contract-export.test.ts` reads this schema to check the
- * exported declaration, so writing `Type.Number` here fails the suite instead of
- * publishing an integer the server does not send.
- */
-declare const DeviceAuthPollResponseSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TObject<{
-    status: _sinclair_typebox.TLiteral<"pending">;
-    intervalMillis: _sinclair_typebox.TInteger;
-}>, _sinclair_typebox.TObject<{
-    status: _sinclair_typebox.TLiteral<"approved">;
-    userId: _sinclair_typebox.TString;
-    publicId: _sinclair_typebox.TString;
-    email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-    phone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-    passwordChangeRequired: _sinclair_typebox.TBoolean;
-}>]>;
-declare const PasswordSchema: _sinclair_typebox.TString;
-declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
-type VerificationTargetType = Static<typeof TargetTypeSchema>;
-declare const VERIFICATION_TARGET_TYPES: readonly ["email", "phone"];
-declare const VerificationPurposeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">, _sinclair_typebox.TLiteral<"account_deletion">]>;
-type VerificationPurpose = Static<typeof VerificationPurposeSchema>;
-declare const VERIFICATION_PURPOSES: readonly ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"];
-
-/**
- * @spfn/auth - Verification Service
+ * Nothing here is a bearer value, so nothing is hashed. `publicKey` is public by
+ * construction and `credentialId` is a handle the authenticator hands to any
+ * origin that asks — storing either in the clear costs nothing, and the lookup
+ * on `credentialId` has to be a plain equality match on an indexed column.
  *
- * Handles OTP code generation, validation, and delivery
- */
-
-interface SendVerificationCodeParams {
-    target: string;
-    targetType: VerificationTargetType;
-    purpose: VerificationPurpose;
-}
-interface SendVerificationCodeResult {
-    success: boolean;
-    expiresAt: string;
-}
-interface VerifyCodeParams {
-    target: string;
-    targetType: VerificationTargetType;
-    code: string;
-    purpose: VerificationPurpose;
-}
-interface VerifyCodeResult {
-    valid: boolean;
-    verificationToken: string;
-}
-/**
- * Send verification code via email or SMS
- */
-declare function sendVerificationCodeService(params: SendVerificationCodeParams): Promise<SendVerificationCodeResult>;
-/**
- * Verify OTP code and return verification token
+ * Revocation is soft, and `credentialId` stays unique across live and revoked
+ * rows alike: a credential someone cut off must never become enrollable again,
+ * on this account or on another one.
  */
-declare function verifyCodeService(params: VerifyCodeParams): Promise<{
-    valid: boolean;
-    verificationToken: string;
-}>;
-
 /**
- * @spfn/auth - Verified-Email Signup Service
- *
- * A signup where the address is proven before a password exists:
- *
- *   request  -> a one-time link is emailed
- *   confirm  -> the link is exchanged for a short-lived password-setup session
- *   password -> the account is created, the device registered, the user signed in
- *
- * The link token and the setup secret are bearer credentials, so neither is ever
- * stored. Only their SHA-256 hashes are, and lookup is by hash. A database dump
- * therefore yields nothing that can be presented to either step.
+ * Whether the credential can leave the authenticator that minted it.
  *
- * The six-digit-code registration path is untouched and remains the default; this
- * is a second entry point to the same account creation, not a replacement.
- */
-
-interface RequestSignupLinkParams {
-    email: string;
-    returnPath?: string;
-}
-interface RequestSignupLinkResult {
-    success: boolean;
-    expiresAt: string;
-}
-/**
- * Step 1 — issue a confirmation link for an address.
- *
- * Answers identically whether or not the address already has an account. When it
- * does, the owner gets a notice instead of a usable link, through the same
- * dedupe window the six-digit-code path uses.
- *
- * Requesting again is how a resend works: every live link for the address is
- * superseded first, so the newest link is the only one that opens, and any setup
- * session already opened from an older link dies with it.
- *
- * Neither branch sends mail: both hand it to `auth.link-mail`, so the answer
- * costs the same database work whichever one ran. With no pg-boss initialised
- * the mail still goes out on this request — see `lib/link-mail-delivery.ts`.
- */
-declare function requestSignupLinkService(params: RequestSignupLinkParams): Promise<RequestSignupLinkResult>;
-interface ConfirmSignupLinkParams {
-    token: string;
-}
-interface ConfirmSignupLinkResult {
-    email: string;
-    returnPath: string | null;
-    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
-    setupSecret: string;
-    setupExpiresAt: string;
-}
-/**
- * Step 2 — exchange a link for a password-setup session.
- *
- * Nothing binds the row to a device or a browser, which is what lets someone
- * request the link on a laptop and open it on a phone.
- */
-declare function confirmSignupLinkService(params: ConfirmSignupLinkParams): Promise<ConfirmSignupLinkResult>;
-interface CompleteSignupParams {
-    setupSecret?: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    metadata?: Record<string, unknown>;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-/**
- * Step 3 — set the password, which is what creates the account.
- *
- * Run under `Transactional()`: the user row, the device key and the completion
- * mark commit together. A device-key failure must not leave an account nobody
- * can sign into, and a completion mark must not survive a rolled-back account.
- *
- * A refusal that is the user's to fix — a weak password, an app policy that
- * rejects the registration — leaves the setup session usable, so the fix is
- * retyping the password rather than requesting a fresh email.
- */
-declare function completeSignupService(params: CompleteSignupParams): Promise<RegisterResult>;
-
-/**
- * @spfn/auth - Password Reset Service
- *
- * Getting back into an account whose password is gone, using the address the
- * account already proved:
- *
- *   request  -> a one-time link is emailed
- *   confirm  -> the link is exchanged for a short-lived password-setup session
- *   complete -> the new password is written, everything else is signed out,
- *               and the browser that reset is signed in on a fresh device key
- *
- * Mirrors the verified-email signup slice deliberately — same credentials, same
- * hashing, same supersede-on-resend, same interceptor moves — with two
- * differences that matter.
- *
- * First, the request answers identically for *every* input and sends mail only
- * to an account that can be reset. Signup can afford to tell an existing owner
- * "you already have an account"; a reset cannot send anything to a stranger's
- * mailbox, because the mail itself would be the answer to "does this address
- * have an account here".
- *
- * Second, completing it is a credential change on a live account, so it carries
- * the same blast radius as `changePasswordService`: pending device
- * authorizations are denied and every active key is revoked. Whoever was signed
- * in on the old password is signed out, including the attacker the reset was
- * needed for.
- */
-
-interface RequestPasswordResetParams {
-    email: string;
-    returnPath?: string;
-}
-interface RequestPasswordResetResult {
-    success: boolean;
-    expiresAt: string;
-}
-/**
- * Step 1 — issue a reset link for an address.
- *
- * Answers identically for every input: the same status, the same two fields, and
- * an `expiresAt` computed the same way whether or not a row was written. An
- * address with no account, an account that cannot be reset, and an account that
- * can are indistinguishable to the caller — only the first of the three gets
- * mail, and it goes to the owner.
- *
- * Requesting again is how a resend works: every live link for the account is
- * superseded first, so the newest link is the only one that opens, and any setup
- * session already opened from an older link dies with it.
- *
- * The eligible branch does not send the mail either — it hands it to
- * `auth.link-mail` — so the two branches differ by a few database writes and not
- * by a mail provider's round trip. With no pg-boss initialised the mail still
- * goes out on this request; see `lib/link-mail-delivery.ts`.
- */
-declare function requestPasswordResetService(params: RequestPasswordResetParams): Promise<RequestPasswordResetResult>;
-interface ConfirmPasswordResetParams {
-    token: string;
-}
-interface ConfirmPasswordResetResult {
-    email: string;
-    returnPath: string | null;
-    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
-    setupSecret: string;
-    setupExpiresAt: string;
-}
-/**
- * Step 2 — exchange a link for a password-setup session.
- *
- * Nothing binds the row to a device or a browser, which is what lets someone ask
- * for the link on a laptop and open it on a phone.
- */
-declare function confirmPasswordResetService(params: ConfirmPasswordResetParams): Promise<ConfirmPasswordResetResult>;
-interface CompletePasswordResetParams {
-    setupSecret?: string;
-    password: string;
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-/**
- * Step 3 — set the new password, which is what completes the reset.
- *
- * Run under `Transactional()`: the password, the revocations, the new device key
- * and the completion mark commit together. A key registration that failed after
- * the revoke-all would otherwise leave an account with a new password and
- * nothing signed in.
- *
- * A refusal that is the user's to fix — a password the policy rejects, a body
- * with no device key — leaves the setup session usable, so the fix is retyping
- * the password rather than asking for a fresh email.
- */
-declare function completePasswordResetService(params: CompletePasswordResetParams): Promise<RegisterResult>;
-
-/**
- * @spfn/auth - Device Auth Service
- *
- * Device-code login: a device with no key on file yet shows a short code, the
- * account owner types that code on a device that is already signed in, and the
- * waiting device's key is registered on approval.
- *
- * There is no token to hand over. Every request in this system is signed by the
- * calling device's own key, so "logging a device in" means one thing — getting
- * its public key into `user_public_keys` under the right account. That is what
- * the poll does, and it is why the poll returns exactly what `loginService`
- * returns: from the client's side the two ways in are indistinguishable.
- *
- * | state ↓ op → | info | approve | deny | poll |
- * | --- | --- | --- | --- | --- |
- * | pending | device details | → approved | → denied | pending |
- * | approved | AlreadyHandled | AlreadyHandled | AlreadyHandled | key registered, → consumed |
- * | denied | AlreadyHandled | AlreadyHandled | AlreadyHandled | Denied |
- * | consumed | NotFound | NotFound | NotFound | NotFound |
- * | expired | Expired | Expired | Expired | Expired |
- * | unknown | NotFound | NotFound | NotFound | NotFound |
- *
- * A global revocation — revoke-all, a password change, a deletion request —
- * refuses the account's live records too, as `denied`, so they land in that row
- * of the table. See `denyAllActiveByUserId`; the three callers are the three
- * places that revoke every key at once.
- */
-
-interface StartDeviceAuthParams {
-    publicKey: string;
-    keyId: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    /** Device label shown to the approver. Display only — nothing is authorized by it. */
-    deviceName?: string;
-    platform?: KeyPlatformType;
-}
-interface StartDeviceAuthResult {
-    /** Returned once. The waiting device polls with it; the server stores only its hash. */
-    deviceCode: string;
-    /** `XXXX-XXXX`, for the waiting device's screen and nowhere else. */
-    userCode: string;
-    expiresAtMillis: number;
-    /** Milliseconds the waiting device should wait between polls. */
-    intervalMillis: number;
-}
-interface DeviceAuthInfoParams {
-    userCode: string;
-}
-/** What the approver is shown about the device asking to be let in. */
-interface DeviceAuthInfoResult {
-    deviceName?: string;
-    /** One of `KEY_PLATFORM`, which is what the route accepts and the column stores. */
-    platform?: KeyPlatformType;
-    /** First bytes of the pending key's fingerprint, as the device list truncates it. */
-    fingerprintPrefix: string;
-    requestedAtMillis: number;
-    expiresAtMillis: number;
-}
-interface ApproveDeviceAuthParams {
-    userCode: string;
-    /** The approver, read from their session. Never from a request body. */
-    userId: number;
-}
-interface DenyDeviceAuthParams {
-    userCode: string;
-}
-interface PollDeviceAuthParams {
-    deviceCode: string;
-    /** Client address of the request, from `deviceProvenance` at the route. */
-    ip?: string;
-    /** `user-agent` of the request, already truncated at the route. */
-    userAgent?: string;
-}
-/** Nobody has answered yet. Not an error — the waiting device waits. */
-interface DeviceAuthPendingResult {
-    status: 'pending';
-    intervalMillis: number;
-}
-/** Approved and spent: the key is registered and this is the login it produced. */
-type DeviceAuthApprovedResult = {
-    status: 'approved';
-} & LoginResult;
-type PollDeviceAuthResult = DeviceAuthPendingResult | DeviceAuthApprovedResult;
-/**
- * Park a new device's key and hand back the codes it needs.
- *
- * The caller is unauthenticated by definition — this is what a device does before
- * it has any way to prove anything — so nothing here is attributed to an account.
- * The record gains an owner only when someone approves it.
- */
-declare function startDeviceAuthService(params: StartDeviceAuthParams): Promise<StartDeviceAuthResult>;
-/**
- * What the approver sees before deciding.
- *
- * This is the whole defence against being talked into approving someone else's
- * device: the answer names the device that is waiting, so the person holding the
- * phone can see that it is not theirs. An approval screen that showed only the
- * code would be asking them to confirm a number they were just told.
- */
-declare function getDeviceAuthInfoService(params: DeviceAuthInfoParams): Promise<DeviceAuthInfoResult>;
-/**
- * Bind the record to the approving account.
- *
- * The key is not registered here. The waiting device may never come back, and a
- * key registered for a device that stopped listening is a signing credential
- * nobody asked for — so approval records the decision and the poll acts on it.
- *
- * Answers with the same device description `info` returns, so a client that let
- * a user approve without looking first can still show them what they just let
- * in — which is the moment someone talked into approving an attacker's device
- * has to notice and revoke it.
- */
-declare function approveDeviceAuthService(params: ApproveDeviceAuthParams): Promise<DeviceAuthInfoResult>;
-/**
- * Refuse the record, so the waiting device is told no instead of timing out.
- *
- * Denying binds no user: the point of refusing is that the account owner wants
- * nothing to do with the request.
- */
-declare function denyDeviceAuthService(params: DenyDeviceAuthParams): Promise<void>;
-/**
- * The waiting device asking whether anyone has answered.
- *
- * Approved is the one branch with a side effect, and it is a one-shot: the record
- * is spent by a conditional update that names `approved`, so of two polls that
- * arrive together exactly one registers the key. The loser matches nothing and is
- * answered as if the code were unknown — which by then it is.
- */
-declare function pollDeviceAuthService(params: PollDeviceAuthParams): Promise<PollDeviceAuthResult>;
-
-/**
- * @spfn/auth - Passkeys Entity
- *
- * A WebAuthn credential the account owner enrolled on one of their devices.
- * It is a *credential*, not a session: an assertion proves who is asking, and
- * the ordinary device key in `user_public_keys` is what the request afterwards
- * is signed with. The two tables therefore never stand in for each other.
- *
- * Nothing here is a bearer value, so nothing is hashed. `publicKey` is public by
- * construction and `credentialId` is a handle the authenticator hands to any
- * origin that asks — storing either in the clear costs nothing, and the lookup
- * on `credentialId` has to be a plain equality match on an indexed column.
- *
- * Revocation is soft, and `credentialId` stays unique across live and revoked
- * rows alike: a credential someone cut off must never become enrollable again,
- * on this account or on another one.
- */
-/**
- * Whether the credential can leave the authenticator that minted it.
- *
- * `multiDevice` is a synced passkey (iCloud Keychain, Google Password Manager);
- * `singleDevice` is bound to one authenticator. Reported by the authenticator at
- * enrollment and shown in the management list, because "this one is only on that
- * phone" is what the owner needs to know before revoking the other entry.
+ * `multiDevice` is a synced passkey (iCloud Keychain, Google Password Manager);
+ * `singleDevice` is bound to one authenticator. Reported by the authenticator at
+ * enrollment and shown in the management list, because "this one is only on that
+ * phone" is what the owner needs to know before revoking the other entry.
  */
 declare const PASSKEY_DEVICE_TYPES: readonly ["singleDevice", "multiDevice"];
 type PasskeyDeviceType = typeof PASSKEY_DEVICE_TYPES[number];
@@ -898,8 +366,677 @@ declare const passkeys: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-type Passkey = typeof passkeys.$inferSelect;
-type NewPasskey = typeof passkeys.$inferInsert;
+type Passkey = typeof passkeys.$inferSelect;
+type NewPasskey = typeof passkeys.$inferInsert;
+
+/**
+ * @spfn/auth - Auth Service
+ *
+ * Core authentication logic: registration, login, logout, password management
+ */
+
+interface RegisterParams {
+    email?: string;
+    phone?: string;
+    verificationToken: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    metadata?: Record<string, unknown>;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. Carried for shape rather than effect: a brand-new account is on the
+     * default `session_binding: 'none'`, so its first key is never bound.
+     */
+    webProxy?: boolean;
+}
+interface RegisterResult {
+    userId: string;
+    publicId: string;
+    email?: string;
+    phone?: string;
+}
+interface LoginParams {
+    email?: string;
+    phone?: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    oldKeyId?: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
+}
+/**
+ * What a sign-in answers with, on every path that starts a session.
+ *
+ * The last two fields are the carrier #97 needed. The Next.js proxy generated
+ * the device key and sealed the cookie, but only the backend knows whether the
+ * account asked for a bound session and when the key it just registered runs
+ * out — so the sign-in says it here and the interceptor copies both into
+ * `SessionData`. A response without them seals an unbound session, which is what
+ * every account that did not opt in gets and what every path predating this
+ * change keeps getting.
+ */
+interface LoginResult {
+    userId: string;
+    publicId: string;
+    email?: string;
+    phone?: string;
+    passwordChangeRequired: boolean;
+    /** `'passkey'` when the key registered by this sign-in is bound. Absent otherwise. */
+    sessionBinding?: SessionBindingType;
+    /** Epoch milliseconds that key expires at. Only sent alongside `sessionBinding`. */
+    keyExpiresAtMillis?: number;
+}
+/**
+ * The binding half of a sign-in answer, as a type.
+ *
+ * Named because more than one result carries it: a password reset registers a
+ * device key exactly as a sign-in does, so its answer has to say so too or the
+ * proxy seals a cookie that does not know the key it holds is short-lived.
+ */
+type LoginBindingFields = Pick<LoginResult, 'sessionBinding' | 'keyExpiresAtMillis'>;
+interface LogoutParams {
+    userId: number;
+    keyId: string;
+}
+interface ChangePasswordParams {
+    userId: number;
+    /**
+     * The device key this request is signed with.
+     *
+     * Only read to measure the second-factor window of an enrolled account —
+     * an account with nothing enrolled is answered exactly as before, so this
+     * adds no refusal for anybody who has not opted in.
+     */
+    keyId: string;
+    currentPassword?: string;
+    newPassword: string;
+    passwordHash?: string;
+}
+/**
+ * Register a new user account
+ */
+declare function registerService(params: RegisterParams): Promise<RegisterResult>;
+/**
+ * Authenticate user and create session
+ */
+declare function loginService(params: LoginParams): Promise<LoginResult>;
+/**
+ * Logout user (revoke current key)
+ */
+declare function logoutService(params: LogoutParams): Promise<void>;
+/**
+ * Change user password
+ *
+ * An enrolled account steps up first (#95): a stolen session must not be able
+ * to take the account over by setting a new password. An unenrolled account is
+ * unaffected — including the OAuth-only account with no password and a key
+ * older than ten minutes, which still sets a first password and gets a 200.
+ */
+declare function changePasswordService(params: ChangePasswordParams): Promise<void>;
+
+/**
+ * @spfn/auth - Session Renewal Service
+ *
+ * What a bound session does when its key runs out: prove, with a fresh WebAuthn
+ * assertion, that the person who enrolled the passkey is still at the machine,
+ * and get a new short-lived key sealed into the cookie.
+ *
+ * Neither step is public. The expiring key is named by `expiredKeyId`, and that
+ * value reaches the service from `authenticateForRenewal` — the `keyId` of a
+ * bearer JWT this very key signed — rather than from the request body, so a
+ * caller who does not hold the private half cannot name a key at all. The
+ * assertion still has to be signed by a passkey that key's owner enrolled: the
+ * signature proves the cookie, and the cookie is the thing that may have been
+ * copied.
+ *
+ * The admission below is run again here all the same. The middleware and the
+ * service ask the same four questions of the row, and a service that trusted its
+ * caller to have asked them would be one refactor away from not being asked at
+ * all.
+ *
+ * Every refusal is the same refusal. A key that never existed, a stranger's key,
+ * an unbound key, a revoked one, one past its grace, an inactive account, a spent
+ * challenge, an assertion that did not verify — all `SessionRenewalRefusedError`,
+ * with the same body, because anything finer would answer "is this key id live"
+ * to whoever asked.
+ *
+ * Renewal announces nothing. No `auth.login`, no `auth.device.registered`, and
+ * `lastLoginAt` does not move: this is the same person on the same device
+ * continuing the session they already had, and a subscriber mailing "new sign-in"
+ * once a day per device would train its reader to ignore the notice that matters.
+ * A `lastLoginAt` that moved every day would make dormant-account detection
+ * meaningless for exactly the accounts that turned this protection on.
+ */
+
+interface StartSessionRenewParams {
+    /** The key that ran out, read off the JWT the request was signed with. */
+    expiredKeyId: string;
+}
+interface FinishSessionRenewParams extends StartSessionRenewParams {
+    /** The assertion, from `navigator.credentials.get()`. */
+    response: AuthenticationResponseJSON;
+    /**
+     * The new key pair, in the vocabulary the Next.js login interceptor already
+     * writes: `renew/verify` is on that interceptor's path list, so these arrive
+     * exactly as they do on a login.
+     */
+    keyId: string;
+    publicKey: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+}
+/**
+ * What a completed renewal answers: a sign-in result, plus the new key's id.
+ *
+ * The id is the one thing a renewal has that a sign-in does not need to say —
+ * `renewSession()` promises it to the app, which has no other way to learn it
+ * (the key pair is minted in the proxy and the private half never leaves the
+ * cookie). It is not a contract operation, so nothing generated reads it.
+ */
+interface SessionRenewResult extends LoginResult {
+    /** The key this renewal registered, the one the session now signs with. */
+    keyId: string;
+}
+/**
+ * Step 1 — the challenge the authenticator signs.
+ *
+ * `allowCredentials` is empty and the account lives only on the challenge row.
+ * See `startRenewalCeremonyService`.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없는 키·계정일 때 (모든 사유 동일)
+ */
+declare function startSessionRenewService(params: StartSessionRenewParams): Promise<PublicKeyCredentialRequestOptionsJSON>;
+/**
+ * Step 2 — verify the assertion, put a new bound key in place of the old one.
+ *
+ * The revocation runs first and its answer is the race winner: two verifies that
+ * both got past their own challenges meet at the same conditional UPDATE, and
+ * only the one that actually revoked the key goes on to register a replacement.
+ *
+ * The new key inherits the old row's provenance, so the device list keeps saying
+ * where this device first appeared rather than re-stamping itself every day. Its
+ * expiry is a fresh window from now — renewal is a renewal, not an extension of
+ * what the old key had.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없을 때 (증명 실패 포함, 모든 사유 동일)
+ */
+declare function finishSessionRenewService(params: FinishSessionRenewParams): Promise<SessionRenewResult>;
+
+declare const EmailSchema: _sinclair_typebox.TString;
+declare const PhoneSchema: _sinclair_typebox.TString;
+/**
+ * Optional device labels a client may send when registering a key.
+ *
+ * Display only: the key list uses them to tell one device from another, and
+ * nothing is authorized or refused by either value, so a client that lies about
+ * them gains nothing. Both are omitted by every key registered before they
+ * existed, hence optional rather than defaulted.
+ */
+declare const DeviceNameSchema: _sinclair_typebox.TString;
+declare const PlatformSchema: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>;
+/**
+ * Key material as a device sends it, bounded.
+ *
+ * The bounds exist for the one route that takes this material from a caller who
+ * has not authenticated and cannot: `POST /_auth/device/start` persists what it
+ * is given, and a correctly fingerprinted megabyte of base64 would sit in
+ * `device_authorizations` until something swept it — and nothing sweeps it.
+ *
+ * The numbers are what real key material measures, with room to spare. The
+ * package's own generators produce SPKI DER in base64: 124 characters for
+ * ES256 (P-256), 392 for RS256 (RSA-2048). An RSA-4096 key would be 736, an
+ * RSA-8192 key about 1400, and the same 4096-bit key PEM-armoured about 800 —
+ * so 2048 admits every shape of key anyone could reasonably present, while a
+ * megabyte is refused three orders of magnitude before it reaches a row.
+ *
+ * `keyId` is a UUID (36) everywhere this package generates one; 64 leaves room
+ * for a client that prefixes or namespaces its own. `fingerprint` is SHA-256
+ * hex, exactly 64, and nothing else can ever verify against the public key —
+ * 128 is the length a longer digest would need, and no more.
+ */
+declare const PublicKeySchema: _sinclair_typebox.TString;
+declare const KeyIdSchema: _sinclair_typebox.TString;
+declare const FingerprintSchema: _sinclair_typebox.TString;
+/**
+ * The code a person reads off the waiting device and types on their own.
+ *
+ * Loose on purpose: 8 characters plus an optional dash is what is shown, but the
+ * server folds whitespace, dashes and lower case away before looking anything up,
+ * so refusing those spellings here would refuse a code that is on screen. The
+ * bounds exist to stop an unbounded string reaching the database, not to spell
+ * out the format — `USER_CODE_ALPHABET` is the only thing that can match a row.
+ */
+declare const UserCodeSchema: _sinclair_typebox.TString;
+/**
+ * What `POST /_auth/device/poll` answers with.
+ *
+ * A union, because the two answers are different kinds of thing rather than one
+ * shape with optional fields: pending says "ask again in this long", approved is
+ * a completed login carrying exactly what `/_auth/login` returns. `status` is the
+ * discriminant, so a generated client narrows on it instead of testing which
+ * fields happen to be present.
+ *
+ * The mobile contract has no union type, so it exports this as one object with
+ * `status` required and every branch field optional — see
+ * `deviceAuthorization.pollStatusRule` in the bundle. `intervalMillis` is an
+ * integer for the same reason: that grammar carries no floating-point scalar,
+ * and a count of milliseconds never needed one.
+ *
+ * That integer is a promise two things keep, because nothing validates a response
+ * against this schema on the way out. `configureDeviceAuth` refuses an interval
+ * that is not a whole number of milliseconds, so the only value this branch can
+ * carry is one; and `contract-export.test.ts` reads this schema to check the
+ * exported declaration, so writing `Type.Number` here fails the suite instead of
+ * publishing an integer the server does not send.
+ */
+declare const DeviceAuthPollResponseSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TObject<{
+    status: _sinclair_typebox.TLiteral<"pending">;
+    intervalMillis: _sinclair_typebox.TInteger;
+}>, _sinclair_typebox.TObject<{
+    status: _sinclair_typebox.TLiteral<"approved">;
+    userId: _sinclair_typebox.TString;
+    publicId: _sinclair_typebox.TString;
+    email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+    phone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+    passwordChangeRequired: _sinclair_typebox.TBoolean;
+    sessionBinding: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"none" | "passkey">[]>>;
+    keyExpiresAtMillis: _sinclair_typebox.TOptional<_sinclair_typebox.TInteger>;
+}>]>;
+declare const PasswordSchema: _sinclair_typebox.TString;
+declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
+type VerificationTargetType = Static<typeof TargetTypeSchema>;
+declare const VERIFICATION_TARGET_TYPES: readonly ["email", "phone"];
+declare const VerificationPurposeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"registration">, _sinclair_typebox.TLiteral<"login">, _sinclair_typebox.TLiteral<"password_reset">, _sinclair_typebox.TLiteral<"email_change">, _sinclair_typebox.TLiteral<"phone_change">, _sinclair_typebox.TLiteral<"account_deletion">]>;
+type VerificationPurpose = Static<typeof VerificationPurposeSchema>;
+declare const VERIFICATION_PURPOSES: readonly ["registration", "login", "password_reset", "email_change", "phone_change", "account_deletion"];
+
+/**
+ * @spfn/auth - Verification Service
+ *
+ * Handles OTP code generation, validation, and delivery
+ */
+
+interface SendVerificationCodeParams {
+    target: string;
+    targetType: VerificationTargetType;
+    purpose: VerificationPurpose;
+}
+interface SendVerificationCodeResult {
+    success: boolean;
+    expiresAt: string;
+}
+interface VerifyCodeParams {
+    target: string;
+    targetType: VerificationTargetType;
+    code: string;
+    purpose: VerificationPurpose;
+}
+interface VerifyCodeResult {
+    valid: boolean;
+    verificationToken: string;
+}
+/**
+ * Send verification code via email or SMS
+ */
+declare function sendVerificationCodeService(params: SendVerificationCodeParams): Promise<SendVerificationCodeResult>;
+/**
+ * Verify OTP code and return verification token
+ */
+declare function verifyCodeService(params: VerifyCodeParams): Promise<{
+    valid: boolean;
+    verificationToken: string;
+}>;
+
+/**
+ * @spfn/auth - Verified-Email Signup Service
+ *
+ * A signup where the address is proven before a password exists:
+ *
+ *   request  -> a one-time link is emailed
+ *   confirm  -> the link is exchanged for a short-lived password-setup session
+ *   password -> the account is created, the device registered, the user signed in
+ *
+ * The link token and the setup secret are bearer credentials, so neither is ever
+ * stored. Only their SHA-256 hashes are, and lookup is by hash. A database dump
+ * therefore yields nothing that can be presented to either step.
+ *
+ * The six-digit-code registration path is untouched and remains the default; this
+ * is a second entry point to the same account creation, not a replacement.
+ */
+
+interface RequestSignupLinkParams {
+    email: string;
+    returnPath?: string;
+}
+interface RequestSignupLinkResult {
+    success: boolean;
+    expiresAt: string;
+}
+/**
+ * Step 1 — issue a confirmation link for an address.
+ *
+ * Answers identically whether or not the address already has an account. When it
+ * does, the owner gets a notice instead of a usable link, through the same
+ * dedupe window the six-digit-code path uses.
+ *
+ * Requesting again is how a resend works: every live link for the address is
+ * superseded first, so the newest link is the only one that opens, and any setup
+ * session already opened from an older link dies with it.
+ *
+ * Neither branch sends mail: both hand it to `auth.link-mail`, so the answer
+ * costs the same database work whichever one ran. With no pg-boss initialised
+ * the mail still goes out on this request — see `lib/link-mail-delivery.ts`.
+ */
+declare function requestSignupLinkService(params: RequestSignupLinkParams): Promise<RequestSignupLinkResult>;
+interface ConfirmSignupLinkParams {
+    token: string;
+}
+interface ConfirmSignupLinkResult {
+    email: string;
+    returnPath: string | null;
+    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
+    setupSecret: string;
+    setupExpiresAt: string;
+}
+/**
+ * Step 2 — exchange a link for a password-setup session.
+ *
+ * Nothing binds the row to a device or a browser, which is what lets someone
+ * request the link on a laptop and open it on a phone.
+ */
+declare function confirmSignupLinkService(params: ConfirmSignupLinkParams): Promise<ConfirmSignupLinkResult>;
+interface CompleteSignupParams {
+    setupSecret?: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    metadata?: Record<string, unknown>;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+}
+/**
+ * Step 3 — set the password, which is what creates the account.
+ *
+ * Run under `Transactional()`: the user row, the device key and the completion
+ * mark commit together. A device-key failure must not leave an account nobody
+ * can sign into, and a completion mark must not survive a rolled-back account.
+ *
+ * A refusal that is the user's to fix — a weak password, an app policy that
+ * rejects the registration — leaves the setup session usable, so the fix is
+ * retyping the password rather than requesting a fresh email.
+ */
+declare function completeSignupService(params: CompleteSignupParams): Promise<RegisterResult>;
+
+/**
+ * @spfn/auth - Password Reset Service
+ *
+ * Getting back into an account whose password is gone, using the address the
+ * account already proved:
+ *
+ *   request  -> a one-time link is emailed
+ *   confirm  -> the link is exchanged for a short-lived password-setup session
+ *   complete -> the new password is written, everything else is signed out,
+ *               and the browser that reset is signed in on a fresh device key
+ *
+ * Mirrors the verified-email signup slice deliberately — same credentials, same
+ * hashing, same supersede-on-resend, same interceptor moves — with two
+ * differences that matter.
+ *
+ * First, the request answers identically for *every* input and sends mail only
+ * to an account that can be reset. Signup can afford to tell an existing owner
+ * "you already have an account"; a reset cannot send anything to a stranger's
+ * mailbox, because the mail itself would be the answer to "does this address
+ * have an account here".
+ *
+ * Second, completing it is a credential change on a live account, so it carries
+ * the same blast radius as `changePasswordService`: pending device
+ * authorizations are denied and every active key is revoked. Whoever was signed
+ * in on the old password is signed out, including the attacker the reset was
+ * needed for.
+ */
+
+interface RequestPasswordResetParams {
+    email: string;
+    returnPath?: string;
+}
+interface RequestPasswordResetResult {
+    success: boolean;
+    expiresAt: string;
+}
+/**
+ * Step 1 — issue a reset link for an address.
+ *
+ * Answers identically for every input: the same status, the same two fields, and
+ * an `expiresAt` computed the same way whether or not a row was written. An
+ * address with no account, an account that cannot be reset, and an account that
+ * can are indistinguishable to the caller — only the first of the three gets
+ * mail, and it goes to the owner.
+ *
+ * Requesting again is how a resend works: every live link for the account is
+ * superseded first, so the newest link is the only one that opens, and any setup
+ * session already opened from an older link dies with it.
+ *
+ * The eligible branch does not send the mail either — it hands it to
+ * `auth.link-mail` — so the two branches differ by a few database writes and not
+ * by a mail provider's round trip. With no pg-boss initialised the mail still
+ * goes out on this request; see `lib/link-mail-delivery.ts`.
+ */
+declare function requestPasswordResetService(params: RequestPasswordResetParams): Promise<RequestPasswordResetResult>;
+interface ConfirmPasswordResetParams {
+    token: string;
+}
+interface ConfirmPasswordResetResult {
+    email: string;
+    returnPath: string | null;
+    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
+    setupSecret: string;
+    setupExpiresAt: string;
+}
+/**
+ * Step 2 — exchange a link for a password-setup session.
+ *
+ * Nothing binds the row to a device or a browser, which is what lets someone ask
+ * for the link on a laptop and open it on a phone.
+ */
+declare function confirmPasswordResetService(params: ConfirmPasswordResetParams): Promise<ConfirmPasswordResetResult>;
+interface CompletePasswordResetParams {
+    setupSecret?: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
+}
+/**
+ * Step 3 — set the new password, which is what completes the reset.
+ *
+ * Run under `Transactional()`: the password, the revocations, the new device key
+ * and the completion mark commit together. A key registration that failed after
+ * the revoke-all would otherwise leave an account with a new password and
+ * nothing signed in.
+ *
+ * A refusal that is the user's to fix — a password the policy rejects, a body
+ * with no device key — leaves the setup session usable, so the fix is retyping
+ * the password rather than asking for a fresh email.
+ *
+ * The answer carries the binding fields, like every other path that starts a
+ * session. A reset on an account that opted in registers a bound key — 24 hours,
+ * renewable only by a passkey — and this route is on the sealing interceptor's
+ * list, so a body that did not say so would have the proxy seal a cookie
+ * believing the session unbound: no user-agent check for the life of that key,
+ * and a sign-out a day later instead of the renewal prompt.
+ */
+declare function completePasswordResetService(params: CompletePasswordResetParams): Promise<RegisterResult & LoginBindingFields>;
+
+/**
+ * @spfn/auth - Device Auth Service
+ *
+ * Device-code login: a device with no key on file yet shows a short code, the
+ * account owner types that code on a device that is already signed in, and the
+ * waiting device's key is registered on approval.
+ *
+ * There is no token to hand over. Every request in this system is signed by the
+ * calling device's own key, so "logging a device in" means one thing — getting
+ * its public key into `user_public_keys` under the right account. That is what
+ * the poll does, and it is why the poll returns exactly what `loginService`
+ * returns: from the client's side the two ways in are indistinguishable.
+ *
+ * | state ↓ op → | info | approve | deny | poll |
+ * | --- | --- | --- | --- | --- |
+ * | pending | device details | → approved | → denied | pending |
+ * | approved | AlreadyHandled | AlreadyHandled | AlreadyHandled | key registered, → consumed |
+ * | denied | AlreadyHandled | AlreadyHandled | AlreadyHandled | Denied |
+ * | consumed | NotFound | NotFound | NotFound | NotFound |
+ * | expired | Expired | Expired | Expired | Expired |
+ * | unknown | NotFound | NotFound | NotFound | NotFound |
+ *
+ * A global revocation — revoke-all, a password change, a deletion request —
+ * refuses the account's live records too, as `denied`, so they land in that row
+ * of the table. See `denyAllActiveByUserId`; the three callers are the three
+ * places that revoke every key at once.
+ */
+
+interface StartDeviceAuthParams {
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    /** Device label shown to the approver. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+}
+interface StartDeviceAuthResult {
+    /** Returned once. The waiting device polls with it; the server stores only its hash. */
+    deviceCode: string;
+    /** `XXXX-XXXX`, for the waiting device's screen and nowhere else. */
+    userCode: string;
+    expiresAtMillis: number;
+    /** Milliseconds the waiting device should wait between polls. */
+    intervalMillis: number;
+}
+interface DeviceAuthInfoParams {
+    userCode: string;
+}
+/** What the approver is shown about the device asking to be let in. */
+interface DeviceAuthInfoResult {
+    deviceName?: string;
+    /** One of `KEY_PLATFORM`, which is what the route accepts and the column stores. */
+    platform?: KeyPlatformType;
+    /** First bytes of the pending key's fingerprint, as the device list truncates it. */
+    fingerprintPrefix: string;
+    requestedAtMillis: number;
+    expiresAtMillis: number;
+}
+interface ApproveDeviceAuthParams {
+    userCode: string;
+    /** The approver, read from their session. Never from a request body. */
+    userId: number;
+}
+interface DenyDeviceAuthParams {
+    userCode: string;
+}
+interface PollDeviceAuthParams {
+    deviceCode: string;
+    /** Client address of the request, from `deviceProvenance` at the route. */
+    ip?: string;
+    /** `user-agent` of the request, already truncated at the route. */
+    userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. A waiting device polls the backend itself, so this is false there
+     * and the key it collects is unbound — which is what a device with no browser
+     * to run a WebAuthn ceremony in needs.
+     */
+    webProxy?: boolean;
+}
+/** Nobody has answered yet. Not an error — the waiting device waits. */
+interface DeviceAuthPendingResult {
+    status: 'pending';
+    intervalMillis: number;
+}
+/** Approved and spent: the key is registered and this is the login it produced. */
+type DeviceAuthApprovedResult = {
+    status: 'approved';
+} & LoginResult;
+type PollDeviceAuthResult = DeviceAuthPendingResult | DeviceAuthApprovedResult;
+/**
+ * Park a new device's key and hand back the codes it needs.
+ *
+ * The caller is unauthenticated by definition — this is what a device does before
+ * it has any way to prove anything — so nothing here is attributed to an account.
+ * The record gains an owner only when someone approves it.
+ */
+declare function startDeviceAuthService(params: StartDeviceAuthParams): Promise<StartDeviceAuthResult>;
+/**
+ * What the approver sees before deciding.
+ *
+ * This is the whole defence against being talked into approving someone else's
+ * device: the answer names the device that is waiting, so the person holding the
+ * phone can see that it is not theirs. An approval screen that showed only the
+ * code would be asking them to confirm a number they were just told.
+ */
+declare function getDeviceAuthInfoService(params: DeviceAuthInfoParams): Promise<DeviceAuthInfoResult>;
+/**
+ * Bind the record to the approving account.
+ *
+ * The key is not registered here. The waiting device may never come back, and a
+ * key registered for a device that stopped listening is a signing credential
+ * nobody asked for — so approval records the decision and the poll acts on it.
+ *
+ * Answers with the same device description `info` returns, so a client that let
+ * a user approve without looking first can still show them what they just let
+ * in — which is the moment someone talked into approving an attacker's device
+ * has to notice and revoke it.
+ */
+declare function approveDeviceAuthService(params: ApproveDeviceAuthParams): Promise<DeviceAuthInfoResult>;
+/**
+ * Refuse the record, so the waiting device is told no instead of timing out.
+ *
+ * Denying binds no user: the point of refusing is that the account owner wants
+ * nothing to do with the request.
+ */
+declare function denyDeviceAuthService(params: DenyDeviceAuthParams): Promise<void>;
+/**
+ * The waiting device asking whether anyone has answered.
+ *
+ * Approved is the one branch with a side effect, and it is a one-shot: the record
+ * is spent by a conditional update that names `approved`, so of two polls that
+ * arrive together exactly one registers the key. The loser matches nothing and is
+ * answered as if the code were unknown — which by then it is.
+ */
+declare function pollDeviceAuthService(params: PollDeviceAuthParams): Promise<PollDeviceAuthResult>;
 
 /**
  * @spfn/auth - Passkey Service
@@ -1033,6 +1170,8 @@ interface FinishPasskeyLoginParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
 /**
  * Step 2 of sign-in — verify the assertion, then sign in exactly as a password
@@ -1153,7 +1292,7 @@ declare const mfaVerifications: drizzle_orm_pg_core.PgTableWithColumns<{
             name: string;
             tableName: "mfa_verifications";
             dataType: "string enum";
-            data: "totp" | "recovery" | "passkey";
+            data: "passkey" | "totp" | "recovery";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -1434,7 +1573,7 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
     email?: string | undefined;
     phone?: string | undefined;
     userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "passkey" | "device";
+    provider: "email" | "phone" | "passkey" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device";
     mfaEnrolled: boolean;
 }>;
 /**
@@ -1446,15 +1585,15 @@ declare const authLoginEvent: _spfn_core_event.EventDef<{
  * both arrive at `createVerifiedAccount`, so the two name themselves there;
  * `'invitation'` is the one path that stores a key without the key service.
  */
-declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">]>;
-/** The nine doors a device key is registered through. */
+declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"renewal">]>;
+/** The ten doors a device key is registered through. */
 type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
 /**
  * auth.device.registered — a new device key was added to an account
  *
  * 발행 시점:
  * - a key row was created for an account and the transaction that created it
- *   committed, on every one of the nine channels above
+ *   committed, on every one of the ten channels above
  *
  * This is the notice an account owner needs and could not get before: a stolen
  * password used to sign in on a new device was silent, because a login event
@@ -1492,7 +1631,7 @@ declare const authDeviceRegisteredEvent: _spfn_core_event.EventDef<{
     fingerprintPrefix: string;
     createdAtMillis: number;
     mfaEnrolled: boolean;
-    channel: "password" | "register" | "oauth-native" | "passkey" | "oauth" | "invitation" | "signup-link" | "password-reset" | "device-code";
+    channel: "password" | "register" | "passkey" | "oauth-native" | "renewal" | "oauth" | "invitation" | "signup-link" | "password-reset" | "device-code";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -1697,6 +1836,18 @@ interface RegisterPublicKeyParams {
     ip?: string;
     /** `user-agent` of the registering request, already truncated. */
     userAgent?: string;
+    /**
+     * Whether this key is bound to a passkey, as the registering path decided.
+     *
+     * Decided by the caller from two facts it is the only one holding: the
+     * owner's `session_binding` setting, and whether `proxy-guard` recognised the
+     * request as coming through the trusted Next.js proxy (`decideKeyBinding`).
+     * Never read off a request body, and `platform` is not consulted — that field
+     * is display-only, usually absent on a proxy-made key, and a native client
+     * may declare `'web'` freely. Omitted means `'none'`, which is what every
+     * path that has no opinion gets.
+     */
+    binding?: SessionBindingType;
     /**
      * The key this one replaces on the same device, when a revocation actually
      * happened. Its presence is what makes this a rotation rather than a new
@@ -1785,6 +1936,28 @@ interface KeySummary {
     registeredIp?: string;
     /** `user-agent` of the registering request, on the same terms as above. */
     registeredUserAgent?: string;
+    /**
+     * `'passkey'` when this key is bound to one, absent when it is not.
+     *
+     * Absent rather than `'none'`, so a deployment where nobody opted in answers
+     * exactly the list it always did, and so every consumer reads "unbound" the
+     * same way it reads it off a sign-in response.
+     */
+    binding?: SessionBindingType;
+    /**
+     * When this key was last seen from two client addresses inside the
+     * concurrent-use window, absent when that has never been observed.
+     *
+     * A signal for the owner, not a refusal: addresses change legitimately, so
+     * nothing is blocked by it and a device list that shows it is telling someone
+     * to look rather than telling them something happened. The addresses
+     * themselves are never returned.
+     *
+     * Only meaningful where proxy-guard is configured. Without it every web
+     * request carries the Next.js server's own address, so two browsers on two
+     * continents share one and this never fires.
+     */
+    concurrentUseAtMillis?: number;
 }
 interface ListKeysParams {
     userId: number;
@@ -1793,6 +1966,20 @@ interface ListKeysParams {
 }
 /** How much of the fingerprint the list returns. */
 declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
+/**
+ * What a registration settled on, for the caller that has to tell the browser.
+ *
+ * The sign-in paths put these two into their `LoginResult`, the Next.js proxy
+ * copies them into the sealed cookie, and that is the whole carrier by which the
+ * proxy learns a session is bound and when its key runs out. Returned rather than
+ * looked up again: the row was just written (or just read), so a second query
+ * would be a second answer to a question already settled.
+ */
+interface RegisteredKeyBinding {
+    binding: SessionBindingType;
+    /** null only for a key registered before expiry was stamped at all. */
+    expiresAt: Date | null;
+}
 /**
  * Register a new public key for a user
  *
@@ -1805,7 +1992,7 @@ declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
  * @throws InvalidKeyFingerprintError fingerprint가 publicKey와 맞지 않을 때
  * @throws KeyAlgorithmMismatchError 키의 SPKI 타입이 선언된 algorithm과 다를 때
  */
-declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<void>;
+declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<RegisteredKeyBinding>;
 /**
  * Rotate user's public key (revoke old, register new)
  *
@@ -2163,6 +2350,8 @@ interface OAuthCallbackParams {
     ip?: string;
     /** `user-agent` of the callback request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
 interface OAuthCallbackResult {
     redirectUrl: string;
@@ -2264,6 +2453,13 @@ interface OAuthNativeParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. Accepted because every registering route spreads the whole
+     * provenance, and read by nothing: a native sign-in never produces a bound
+     * key — see the note at the registration below.
+     */
+    webProxy?: boolean;
     /** Apple은 첫 로그인에만 이름을 별도로 주므로 클라이언트가 전달할 수 있다. */
     profile?: {
         name?: string;
@@ -2415,6 +2611,110 @@ declare function revokeOAuth2GrantService(id: number, userId: number): Promise<v
  */
 declare function revokeAllOAuth2GrantsForUser(userId: number): Promise<void>;
 
+/**
+ * @spfn/auth - Session Binding Service
+ *
+ * The opt-in from #97: an account says its web sessions should run on a key that
+ * expires in hours and can only be renewed by a fresh WebAuthn assertion. A
+ * session cookie copied off that machine — out of a browser profile, out of
+ * DevTools, by malware — still signs like the original until that key runs out,
+ * and then stops, because the copy cannot produce the assertion.
+ *
+ * Three rules shape this file.
+ *
+ * It can only be turned on where the backend can recognise the trusted Next.js
+ * proxy. `clientType` is that recognition and `proxy-guard` is what sets it;
+ * without it every key would be registered unbound and the setting would be a
+ * switch that reports success and protects nothing, so the request is refused as
+ * the configuration error it is.
+ *
+ * Turning it *off* is the privileged direction, which is the reverse of the
+ * usual posture. `assertRecentAuthentication` is satisfied by the age of the
+ * device key this request is signed with — and a cookie copied in the ten
+ * minutes after a sign-in carries exactly that. So leaving `'passkey'` asks for
+ * a credential the copy does not hold: a renewal-grade assertion, or the account
+ * password.
+ *
+ * Enabling twice is idempotent. Recomputing the expiry on a repeat call would
+ * make this route a way to extend a bound key without presenting anything, which
+ * is the thing the short life exists to prevent.
+ */
+
+/** What every one of the three reads and writes here answers with. */
+interface SessionBindingResult {
+    mode: SessionBindingType;
+    /**
+     * When the key this request is signed with expires, for a bound session.
+     *
+     * Absent when the account is unbound, and absent for a bound account asking
+     * from a key that is not itself bound — a native client, say, whose key was
+     * registered on a channel the proxy never touched. The response is the input
+     * the Next.js interceptor re-seals the cookie from, so it describes this
+     * session rather than the account.
+     */
+    keyExpiresAtMillis?: number;
+}
+interface SessionBindingParams {
+    userId: number;
+    /** The device key this request is signed with — the one binding is applied to. */
+    keyId: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy. */
+    webProxy?: boolean;
+}
+interface DisableSessionBindingParams extends SessionBindingParams {
+    /** A renewal-grade assertion, from `binding/disable/options`. */
+    response?: AuthenticationResponseJSON;
+    /** The account password, for a browser with no passkey to hand. */
+    currentPassword?: string;
+}
+/** What binding is on this account, and when this session's key runs out. */
+declare function getSessionBindingService(params: SessionBindingParams): Promise<SessionBindingResult>;
+/**
+ * The binding facts of one key, by key id alone.
+ *
+ * For `/_auth/oauth/finalize`, which is the one sealing path with no session and
+ * no `LoginResult` to read them off: the browser arrives at the callback page
+ * holding a key id the OAuth state minted, and the interceptor seals a session
+ * from the answer. Reflecting the caller's own claim about binding would let a
+ * caller ask for an unbound cookie over a bound key, so the row is read instead.
+ *
+ * Scoped by key id and nothing else. The id is a server-minted UUID that only
+ * ever travelled inside the sealed state, so a caller who holds one holds it
+ * because the flow gave it to them; adding the caller's own `userId` to the
+ * lookup would make the answer vary by a second guessable value without
+ * withholding anything from someone who already has the first.
+ */
+declare function keySessionBindingService(keyId: string): Promise<{
+    sessionBinding?: SessionBindingType;
+    keyExpiresAtMillis?: number;
+}>;
+/**
+ * Turn session binding on, and bind the key this request is signed with.
+ *
+ * The current key is bound here rather than only at the next sign-in, because
+ * otherwise the setting would not apply to the session that asked for it until
+ * the person signed in again — and the response is what tells the Next.js proxy
+ * to re-seal the cookie with the new expiry, so the browser and the key row
+ * agree from this moment on.
+ *
+ * @throws SessionBindingUnavailableError proxy-guard가 설정되지 않은 배포일 때
+ * @throws ValidationError 살아 있는 패스키가 하나도 없을 때
+ * @throws RecentAuthenticationRequiredError 최근 인증이 없을 때
+ */
+declare function enableSessionBindingService(params: SessionBindingParams): Promise<SessionBindingResult>;
+/**
+ * Turn session binding off, once the caller has proved they are still the owner.
+ *
+ * Every bound key returns to an ordinary ninety-day life in the same call. A row
+ * left marked `'passkey'` would keep expiring in hours with nothing left to
+ * renew it, which is the state the person just asked not to be in.
+ *
+ * @throws RecentAuthenticationRequiredError 새 자격증명 없이 껐을 때
+ */
+declare function disableSessionBindingService(params: DisableSessionBindingParams): Promise<SessionBindingResult>;
+/** The challenge the disabling ceremony signs. Same ceremony renewal uses. */
+declare function startSessionBindingDisableService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
+
 /**
  * @spfn/auth - Main Router
  *
@@ -2522,7 +2822,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
-    }, RegisterResult>;
+    }, RegisterResult & LoginBindingFields>;
     login: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -2560,6 +2860,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     } | {
         email?: string | undefined;
         phone?: string | undefined;
+        sessionBinding?: "none" | "passkey" | undefined;
+        keyExpiresAtMillis?: number | undefined;
         status: "approved";
         userId: string;
         publicId: string;
@@ -2736,6 +3038,32 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         phoneVerified: boolean;
         hasPassword: boolean;
     }>;
+    setSessionBinding: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            mode: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"none">]>;
+            response: _sinclair_typebox.TOptional<_sinclair_typebox.TUnknown>;
+            currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, SessionBindingResult>;
+    getSessionBinding: _spfn_core_route.RouteDef<{}, {}, SessionBindingResult>;
+    sessionBindingDisableOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewVerify: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            response: _sinclair_typebox.TUnknown;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>>;
+        }>;
+    }, SessionRenewResult>;
     issueOneTimeToken: _spfn_core_route.RouteDef<{}, {}, IssueOneTimeTokenResult>;
     requestAccountDeletion: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
@@ -2791,398 +3119,797 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         authUrl: string;
     }>;
-    oauthFinalize: _spfn_core_route.RouteDef<{
+    oauthFinalize: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userId: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        sessionBinding?: SessionBindingType;
+        keyExpiresAtMillis?: number;
+        success: boolean;
+        userId: string;
+        keyId: string;
+        returnUrl: string;
+    }>;
+    oauthProviderStart: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            state: _sinclair_typebox.TString;
+        }>;
+    }, {}, Response>;
+    oauthProviderCallback: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, Response>;
+    getProviderOAuthUrl: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        authUrl: string;
+    }>;
+    oauthNative: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
+            idToken: _sinclair_typebox.TString;
+            nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+            profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
+                name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            }>>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+        }>;
+    }, {}, OAuthNativeResult>;
+    oauthUnlinkNotify: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
+    oauthUnlinkNotifyGet: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
+    getInvitation: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        email: string;
+        role: string;
+        roleDisplayName: string;
+        invitedBy: string;
+        expiresAt: string;
+        metadata: Record<string, any> | undefined;
+    }>;
+    acceptInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+            password: _sinclair_typebox.TString;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+        }>;
+    }, {
+        userId: number;
+        email: string;
+        role: string;
+    }>;
+    createInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            email: _sinclair_typebox.TString;
+            roleId: _sinclair_typebox.TNumber;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            expiresAt: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TAny>;
+        }>;
+    }, {}, {
+        id: number;
+        email: string;
+        token: string;
+        roleId: number;
+        expiresAt: string;
+        invitationUrl: string;
+    }>;
+    listInvitations: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            status: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"pending" | "accepted" | "expired" | "cancelled">[]>>;
+            page: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            limit: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        }>;
+    }, {}, {
+        invitations: {
+            id: number;
+            email: string;
+            token: string;
+            roleId: number;
+            invitedBy: number;
+            status: "pending" | "accepted" | "expired" | "cancelled";
+            expiresAt: Date;
+            acceptedAt: Date | null;
+            cancelledAt: Date | null;
+            metadata: Record<string, any> | null;
+            createdAt: Date;
+            updatedAt: Date;
+            role: {
+                id: number;
+                name: string;
+                displayName: string;
+            };
+            inviter: {
+                id: number;
+                email: string | null;
+            };
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+        totalPages: number;
+    }>;
+    cancelInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+            reason: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        cancelledAt: string;
+    }>;
+    resendInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        }>;
+    }, {}, {
+        expiresAt: string;
+    }>;
+    deleteInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+        }>;
+    }, {}, void>;
+    getUserProfile: _spfn_core_route.RouteDef<{}, {}, UserProfile>;
+    updateUserProfile: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            firstName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            lastName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            avatarUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            bio: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            locale: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            timezone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            dateOfBirth: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            gender: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            website: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            location: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            company: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            jobTitle: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TAny>>;
+        }>;
+    }, {}, ProfileInfo>;
+    checkUsername: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            username: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        available: boolean;
+    }>;
+    updateUsername: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            username: _sinclair_typebox.TUnion<[_sinclair_typebox.TString, _sinclair_typebox.TNull]>;
+        }>;
+    }, {}, {
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    updateLocale: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            locale: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        locale: string;
+    }>;
+    listRoles: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            includeInactive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        roles: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        }[];
+    }>;
+    createAdminRole: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            userId: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            name: _sinclair_typebox.TString;
+            displayName: _sinclair_typebox.TString;
+            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            permissionIds: _sinclair_typebox.TOptional<_sinclair_typebox.TArray<_sinclair_typebox.TNumber>>;
         }>;
     }, {}, {
-        success: boolean;
-        userId: string;
-        keyId: string;
-        returnUrl: string;
+        role: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        };
     }>;
-    oauthProviderStart: _spfn_core_route.RouteDef<{
+    updateAdminRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            id: _sinclair_typebox.TNumber;
         }>;
-        query: _sinclair_typebox.TObject<{
-            state: _sinclair_typebox.TString;
+        body: _sinclair_typebox.TObject<{
+            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            isActive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
         }>;
-    }, {}, Response>;
-    oauthProviderCallback: _spfn_core_route.RouteDef<{
+    }, {}, {
+        role: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        };
+    }>;
+    deleteAdminRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
-        }>;
-        query: _sinclair_typebox.TObject<{
-            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            id: _sinclair_typebox.TNumber;
         }>;
-    }, {}, Response>;
-    getProviderOAuthUrl: _spfn_core_route.RouteDef<{
+    }, {}, void>;
+    updateUserRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            userId: _sinclair_typebox.TNumber;
         }>;
         body: _sinclair_typebox.TObject<{
-            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            roleId: _sinclair_typebox.TNumber;
         }>;
     }, {}, {
-        authUrl: string;
+        userId: number;
+        roleId: number;
     }>;
-    oauthNative: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
-        }>;
+    issueOpsToken: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            idToken: _sinclair_typebox.TString;
-            nonce: _sinclair_typebox.TString;
-            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            publicKey: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            fingerprint: _sinclair_typebox.TString;
-            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
-            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
-            profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
-                name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            }>>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+            name: _sinclair_typebox.TString;
+            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
         }>;
-    }, {}, OAuthNativeResult>;
-    oauthUnlinkNotify: _spfn_core_route.RouteDef<{
+    }, {}, {
+        token: string;
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
+    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
+        opsTokens: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        }[];
+    }>;
+    revokeOpsToken: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            id: _sinclair_typebox.TNumber;
         }>;
-    }, {}, void | Response>;
-    oauthUnlinkNotifyGet: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+    }, {}, {
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
+    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
+    getOAuth2Authorize: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
-    }, {}, void | Response>;
-    getInvitation: _spfn_core_route.RouteDef<{
+    }, {}, OAuth2ConsentView>;
+    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            approve: _sinclair_typebox.TBoolean;
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, OAuth2AuthorizationCodeIssued>;
+    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
+    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
+    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
+        grants: OAuth2GrantSummary[];
+    }>;
+    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            token: _sinclair_typebox.TString;
+            id: _sinclair_typebox.TNumber;
         }>;
     }, {}, {
-        email: string;
-        role: string;
-        roleDisplayName: string;
-        invitedBy: string;
-        expiresAt: string;
-        metadata: Record<string, any> | undefined;
+        revoked: boolean;
     }>;
-    acceptInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            token: _sinclair_typebox.TString;
-            password: _sinclair_typebox.TString;
+    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
+}>;
+
+/**
+ * @spfn/auth - User Public Keys Entity
+ *
+ * Stores client-generated public keys for JWT verification
+ * Supports key rotation and multi-key management per user
+ */
+/**
+ * User Public Keys Table
+ * Each user can have multiple public keys (for rotation)
+ */
+declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_public_keys";
+    schema: string;
+    columns: {
+        id: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {
-        body: _sinclair_typebox.TObject<{
-            publicKey: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            fingerprint: _sinclair_typebox.TString;
-            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {
-        userId: number;
-        email: string;
-        role: string;
-    }>;
-    createInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            email: _sinclair_typebox.TString;
-            roleId: _sinclair_typebox.TNumber;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            expiresAt: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TAny>;
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        publicKey: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        id: number;
-        email: string;
-        token: string;
-        roleId: number;
-        expiresAt: string;
-        invitationUrl: string;
-    }>;
-    listInvitations: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            status: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"pending" | "accepted" | "expired" | "cancelled">[]>>;
-            page: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            limit: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        algorithm: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ES256" | "RS256";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ES256", "RS256"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        invitations: {
-            id: number;
-            email: string;
-            token: string;
-            roleId: number;
-            invitedBy: number;
-            status: "pending" | "accepted" | "expired" | "cancelled";
-            expiresAt: Date;
-            acceptedAt: Date | null;
-            cancelledAt: Date | null;
-            metadata: Record<string, any> | null;
-            createdAt: Date;
-            updatedAt: Date;
-            role: {
-                id: number;
-                name: string;
-                displayName: string;
-            };
-            inviter: {
-                id: number;
-                email: string | null;
-            };
-        }[];
-        total: number;
-        page: number;
-        limit: number;
-        totalPages: number;
-    }>;
-    cancelInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
-            reason: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        cancelledAt: string;
-    }>;
-    resendInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        deviceName: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        expiresAt: string;
-    }>;
-    deleteInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+        platform: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ios" | "android" | "web" | "desktop";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, void>;
-    getUserProfile: _spfn_core_route.RouteDef<{}, {}, UserProfile>;
-    updateUserProfile: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            firstName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            lastName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            avatarUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            bio: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            locale: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            timezone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            dateOfBirth: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            gender: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            website: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            location: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            company: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            jobTitle: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TAny>>;
+        registeredIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, ProfileInfo>;
-    checkUsername: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            username: _sinclair_typebox.TString;
+        registeredUserAgent: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        available: boolean;
-    }>;
-    updateUsername: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            username: _sinclair_typebox.TUnion<[_sinclair_typebox.TString, _sinclair_typebox.TNull]>;
+        registeredUaFamily: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        deletedAt: Date | null;
-        deletedBy: string | null;
-        createdAt: Date;
-        updatedAt: Date;
-        id: number;
-        publicId: string;
-        email: string | null;
-        phone: string | null;
-        username: string | null;
-        passwordHash: string | null;
-        passwordChangeRequired: boolean;
-        roleId: number;
-        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
-        emailVerifiedAt: Date | null;
-        phoneVerifiedAt: Date | null;
-        keyEpoch: number;
-        lastLoginAt: Date | null;
-    }>;
-    updateLocale: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            locale: _sinclair_typebox.TString;
+        lastSeenIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        locale: string;
-    }>;
-    listRoles: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            includeInactive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        lastSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        roles: {
-            description: string | null;
+        concurrentUseAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        }[];
-    }>;
-    createAdminRole: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            name: _sinclair_typebox.TString;
-            displayName: _sinclair_typebox.TString;
-            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            permissionIds: _sinclair_typebox.TOptional<_sinclair_typebox.TArray<_sinclair_typebox.TNumber>>;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        role: {
-            description: string | null;
+        binding: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["none", "passkey"] & [string, ...string[]]>>>, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        };
-    }>;
-    updateAdminRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "none" | "passkey";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-        body: _sinclair_typebox.TObject<{
-            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            isActive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        clientKind: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["web", "ios", "android"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ios" | "android" | "web";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["web", "ios", "android"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        role: {
-            description: string | null;
+        clientVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        };
-    }>;
-    deleteAdminRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, void>;
-    updateUserRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            userId: _sinclair_typebox.TNumber;
+        clientContractVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-        body: _sinclair_typebox.TObject<{
-            roleId: _sinclair_typebox.TNumber;
+        clientSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        userId: number;
-        roleId: number;
-    }>;
-    issueOpsToken: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            name: _sinclair_typebox.TString;
-            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
+        isActive: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        token: string;
-        opsToken: {
-            id: number;
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        };
-    }>;
-    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
-        opsTokens: {
-            id: number;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        }[];
-    }>;
-    revokeOpsToken: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        opsToken: {
-            id: number;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        };
-    }>;
-    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
-    getOAuth2Authorize: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            client_id: _sinclair_typebox.TString;
-            redirect_uri: _sinclair_typebox.TString;
-            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, OAuth2ConsentView>;
-    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            approve: _sinclair_typebox.TBoolean;
-            client_id: _sinclair_typebox.TString;
-            redirect_uri: _sinclair_typebox.TString;
-            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, OAuth2AuthorizationCodeIssued>;
-    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
-    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
-    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
-        grants: OAuth2GrantSummary[];
-    }>;
-    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        revoked: boolean;
-    }>;
-    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
+    };
+    dialect: "pg";
 }>;
+type UserPublicKey = typeof userPublicKeys.$inferSelect;
+type NewUserPublicKey = typeof userPublicKeys.$inferInsert;
 
 /**
  * The auth-profile registry the authenticate middleware dispatches on.
@@ -3323,6 +4050,46 @@ declare module 'hono' {
         auth: AuthContext;
     }
 }
+/** Why a Bearer credential was not admitted, in the order the steps run. */
+type BearerRefusal = 'absent' | 'machine' | 'undecodable' | 'unknown' | 'expired' | 'token-expired' | 'bad-signature' | 'unverifiable';
+/** What a Bearer credential resolved to: the key row it named, or why not. */
+type BearerOutcome = {
+    key: UserPublicKey;
+} | {
+    refused: BearerRefusal;
+};
+/**
+ * Admit the Bearer credential on this request, or say what stopped it.
+ *
+ * The one lookup-and-verify path every Bearer middleware takes — header, machine
+ * discriminator, decode, key row, expiry, signature — kept in one place because
+ * the order is itself a rule: a machine credential never reaches a decode, and a
+ * key row is found before its signature is checked so that an unknown key and a
+ * forged one cost the same work.
+ *
+ * It answers rather than throws, which is what lets two middlewares share it.
+ * `authenticate` turns each refusal into the error that step has always
+ * answered with; `authenticateForRenewal` turns every one of them into a single
+ * refusal, so a caller holding no private key cannot tell a live key id from a
+ * dead one. A shared step that threw would have to be unwound to get there.
+ *
+ * @param c - the Hono context of the request being authenticated
+ * @param admitsExpired - whether a key past its `expiresAt` may still be
+ *   admitted. Renewal is the only caller that says yes, and only for a bound key
+ *   inside its grace.
+ */
+declare function admitBearerKey(c: Context, admitsExpired: (key: UserPublicKey) => boolean): Promise<BearerOutcome>;
+/**
+ * The principal a verified Bearer key resolves to.
+ *
+ * The one place the Bearer path builds an `AuthContext`, so that a middleware
+ * added beside `authenticate` cannot invent a second shape of it.
+ */
+declare function bearerAuthContext(keyId: string, resolved: {
+    user: User;
+    role: string | null;
+    locale: string;
+}): AuthContext;
 /**
  * Authentication middleware
  *
@@ -3476,4 +4243,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { type AuthRegisterPayload as $, type AuthInitOptions as A, type ApproveDeviceAuthParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type AssertStepUpParams as E, type FinishPasskeyEnrollmentResult as F, type AuthDeletionCancelledPayload as G, type AuthDeletionCompletedPayload as H, type IssueOneTimeTokenResult as I, type AuthDeletionRequestedPayload as J, type KeySummary as K, type LoginResult as L, type MfaStatus as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, type AuthDeviceRegisteredPayload as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type AuthLoginPayload as W, type AuthPasswordResetPayload as X, type AuthProfileOutcome as Y, type AuthProfileVerifier as Z, AuthProviderSchema as _, type RegisterResult as a, type UnlinkNotification as a$, type ChangePasswordParams as a0, type CompletePasswordResetParams as a1, type CompleteSignupParams as a2, type ConfirmPasswordResetParams as a3, type ConfirmSignupLinkParams as a4, type ConfirmTotpParams as a5, type DenyDeviceAuthParams as a6, type DeviceAuthApprovedResult as a7, type DeviceAuthInfoParams as a8, type DeviceAuthPendingResult as a9, type OAuthStartParams as aA, type OAuthTokens as aB, type OAuthUnlinkedPayload as aC, PASSKEY_DEVICE_TYPES as aD, PASSKEY_LABEL_MAX_LENGTH as aE, type PasskeyDeviceType as aF, PasswordSchema as aG, PhoneSchema as aH, PlatformSchema as aI, type PollDeviceAuthParams as aJ, type PollDeviceAuthResult as aK, PublicKeySchema as aL, type RecentAuthenticationParams as aM, type RegisterParams as aN, type RegisterPublicKeyParams as aO, type RenamePasskeyParams as aP, type RequestPasswordResetParams as aQ, type RequestSignupLinkParams as aR, type RevokeAllKeysParams as aS, type RevokeKeyParams as aT, type RevokePasskeyParams as aU, type RotateKeyParams as aV, type SendVerificationCodeParams as aW, type StartDeviceAuthParams as aX, type StartPasskeyEnrollmentParams as aY, type StepUpParams as aZ, TargetTypeSchema as a_, DeviceAuthPollResponseSchema as aa, DeviceNameSchema as ab, type DeviceRegistrationChannel as ac, EmailSchema as ad, FingerprintSchema as ae, type FinishPasskeyEnrollmentParams as af, type FinishPasskeyLoginParams as ag, type InvitationAcceptedPayload as ah, type InvitationCreatedPayload as ai, KEY_FINGERPRINT_PREFIX_LENGTH as aj, KeyIdSchema as ak, type LoginParams as al, type LogoutParams as am, MFA_VERIFICATION_METHODS as an, type MachinePrincipal as ao, type MachineVerifierRegistration as ap, type MarkPasskeyParams as aq, type NativeVerifyOptions as ar, type NewMfaVerification as as, type NormalizedIdentity as at, type OAuth2AuthorizeParams as au, type OAuth2ScopeDescription as av, type OAuthCallbackParams as aw, type OAuthCallbackResult as ax, type OAuthCodeExchangeOptions as ay, type OAuthNativeParams as az, type RequestSignupLinkResult as b, registerAuthProfile as b$, UnlinkNotifyRejection as b0, type UnlinkNotifyRequest as b1, type UnlinkNotifyResult as b2, UserCodeSchema as b3, VerificationPurposeSchema as b4, type VerifyCodeParams as b5, type VerifyCodeResult as b6, approveDeviceAuthService as b7, approveOAuth2AuthorizeService as b8, assertNotLastRecoveryCredential as b9, getGoogleAccessToken as bA, getMachinePrincipal as bB, getOAuthProvider as bC, getRegisteredProviders as bD, invitationAcceptedEvent as bE, invitationCreatedEvent as bF, isOAuthProviderEnabled as bG, issueOneTimeTokenService as bH, listKeysService as bI, listOAuth2GrantsService as bJ, listPasskeysService as bK, loginService as bL, logoutService as bM, machineAuth as bN, markPasskeySecondFactorService as bO, mfaEnrolledForUser as bP, mfaStatusService as bQ, mfaVerifications as bR, oauthCallbackService as bS, oauthNativeService as bT, oauthStartService as bU, oauthUnlinkNotifyService as bV, oauthUnlinkedEvent as bW, optionalAuth as bX, passkeys as bY, pollDeviceAuthService as bZ, regenerateRecoveryCodesService as b_, assertRecentAuthentication as ba, assertStepUp as bb, authDeletionCancelledEvent as bc, authDeletionCompletedEvent as bd, authDeletionRequestedEvent as be, authDeviceRegisteredEvent as bf, authLoginEvent as bg, authPasswordResetEvent as bh, authRegisterEvent as bi, authenticate as bj, buildOAuthErrorUrl as bk, carryStepUpVerification as bl, changePasswordService as bm, completePasswordResetService as bn, completeSignupService as bo, confirmPasswordResetService as bp, confirmSignupLinkService as bq, confirmTotpEnrolmentService as br, denyDeviceAuthService as bs, denyOAuth2AuthorizeService as bt, describeOAuth2AuthorizeRequestService as bu, disableMfaService as bv, finishPasskeyEnrollmentService as bw, finishPasskeyLoginService as bx, getDeviceAuthInfoService as by, getEnabledOAuthProviders as bz, type RequestPasswordResetResult as c, registerMachineVerifier as c0, registerOAuthProvider as c1, registerPublicKeyService as c2, registerService as c3, renamePasskeyService as c4, requestPasswordResetService as c5, requestSignupLinkService as c6, requireEnabledProvider as c7, requireMachineScope as c8, resolveAuthenticatedUser as c9, revokeAllKeysService as ca, revokeAllOAuth2GrantsForUser as cb, revokeKeyService as cc, revokeOAuth2GrantService as cd, revokePasskeyService as ce, rotateKeyService as cf, runAuthProfile as cg, selectAuthProfile as ch, sendVerificationCodeService as ci, startDeviceAuthService as cj, startPasskeyEnrollmentService as ck, startPasskeyLoginService as cl, startStepUpService as cm, startTotpEnrolmentService as cn, stepUpService as co, sweepUnconfirmedMfaService as cp, verifyCodeService as cq, verifyOneTimeTokenService as cr, verifySecondFactor as cs, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type ConfirmTotpResult as g, type RotateKeyResult as h, type RevokeAllKeysResult as i, type OAuthNativeResult as j, type ProfileInfo as k, type OAuth2ConsentView as l, mainAuthRouter as m, type OAuth2AuthorizationCodeIssued as n, type OAuth2GrantSummary as o, type AuthSession as p, PERMISSION_CATEGORIES as q, type PermissionCategory as r, VERIFICATION_TARGET_TYPES as s, type VerificationPurpose as t, type VerificationTargetType as u, type OAuthProvider as v, type Passkey as w, type MfaVerification as x, type MfaVerificationMethod as y, type AuthContext as z };
+export { type AuthLoginPayload as $, type AuthInitOptions as A, type Passkey as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type MfaVerification as E, type FinishPasskeyEnrollmentResult as F, type MfaVerificationMethod as G, type UserPublicKey as H, type IssueOneTimeTokenResult as I, type AuthContext as J, type KeySummary as K, type LoginBindingFields as L, type MfaStatus as M, type NewUserPublicKey as N, type OAuthStartResult as O, type PermissionConfig as P, type ApproveDeviceAuthParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type AssertStepUpParams as W, type AuthDeletionCancelledPayload as X, type AuthDeletionCompletedPayload as Y, type AuthDeletionRequestedPayload as Z, type AuthDeviceRegisteredPayload as _, type RegisterResult as a, type RevokeAllKeysParams as a$, type AuthPasswordResetPayload as a0, type AuthProfileOutcome as a1, type AuthProfileVerifier as a2, AuthProviderSchema as a3, type AuthRegisterPayload as a4, type BearerOutcome as a5, type BearerRefusal as a6, type ChangePasswordParams as a7, type CompletePasswordResetParams as a8, type CompleteSignupParams as a9, type NativeVerifyOptions as aA, type NewMfaVerification as aB, type NormalizedIdentity as aC, type OAuth2AuthorizeParams as aD, type OAuth2ScopeDescription as aE, type OAuthCallbackParams as aF, type OAuthCallbackResult as aG, type OAuthCodeExchangeOptions as aH, type OAuthNativeParams as aI, type OAuthStartParams as aJ, type OAuthTokens as aK, type OAuthUnlinkedPayload as aL, PASSKEY_DEVICE_TYPES as aM, PASSKEY_LABEL_MAX_LENGTH as aN, type PasskeyDeviceType as aO, PasswordSchema as aP, PhoneSchema as aQ, PlatformSchema as aR, type PollDeviceAuthParams as aS, type PollDeviceAuthResult as aT, PublicKeySchema as aU, type RecentAuthenticationParams as aV, type RegisterParams as aW, type RegisterPublicKeyParams as aX, type RenamePasskeyParams as aY, type RequestPasswordResetParams as aZ, type RequestSignupLinkParams as a_, type ConfirmPasswordResetParams as aa, type ConfirmSignupLinkParams as ab, type ConfirmTotpParams as ac, type DenyDeviceAuthParams as ad, type DeviceAuthApprovedResult as ae, type DeviceAuthInfoParams as af, type DeviceAuthPendingResult as ag, DeviceAuthPollResponseSchema as ah, DeviceNameSchema as ai, type DeviceRegistrationChannel as aj, type DisableSessionBindingParams as ak, EmailSchema as al, FingerprintSchema as am, type FinishPasskeyEnrollmentParams as an, type FinishPasskeyLoginParams as ao, type FinishSessionRenewParams as ap, type InvitationAcceptedPayload as aq, type InvitationCreatedPayload as ar, KEY_FINGERPRINT_PREFIX_LENGTH as as, KeyIdSchema as at, type LoginParams as au, type LogoutParams as av, MFA_VERIFICATION_METHODS as aw, type MachinePrincipal as ax, type MachineVerifierRegistration as ay, type MarkPasskeyParams as az, type RequestSignupLinkResult as b, listOAuth2GrantsService as b$, type RevokeKeyParams as b0, type RevokePasskeyParams as b1, type RotateKeyParams as b2, type SendVerificationCodeParams as b3, type SessionBindingParams as b4, type StartDeviceAuthParams as b5, type StartPasskeyEnrollmentParams as b6, type StartSessionRenewParams as b7, type StepUpParams as b8, TargetTypeSchema as b9, completePasswordResetService as bA, completeSignupService as bB, confirmPasswordResetService as bC, confirmSignupLinkService as bD, confirmTotpEnrolmentService as bE, denyDeviceAuthService as bF, denyOAuth2AuthorizeService as bG, describeOAuth2AuthorizeRequestService as bH, disableMfaService as bI, disableSessionBindingService as bJ, enableSessionBindingService as bK, finishPasskeyEnrollmentService as bL, finishPasskeyLoginService as bM, finishSessionRenewService as bN, getDeviceAuthInfoService as bO, getEnabledOAuthProviders as bP, getGoogleAccessToken as bQ, getMachinePrincipal as bR, getOAuthProvider as bS, getRegisteredProviders as bT, getSessionBindingService as bU, invitationAcceptedEvent as bV, invitationCreatedEvent as bW, isOAuthProviderEnabled as bX, issueOneTimeTokenService as bY, keySessionBindingService as bZ, listKeysService as b_, type UnlinkNotification as ba, UnlinkNotifyRejection as bb, type UnlinkNotifyRequest as bc, type UnlinkNotifyResult as bd, UserCodeSchema as be, VerificationPurposeSchema as bf, type VerifyCodeParams as bg, type VerifyCodeResult as bh, admitBearerKey as bi, approveDeviceAuthService as bj, approveOAuth2AuthorizeService as bk, assertNotLastRecoveryCredential as bl, assertRecentAuthentication as bm, assertStepUp as bn, authDeletionCancelledEvent as bo, authDeletionCompletedEvent as bp, authDeletionRequestedEvent as bq, authDeviceRegisteredEvent as br, authLoginEvent as bs, authPasswordResetEvent as bt, authRegisterEvent as bu, authenticate as bv, bearerAuthContext as bw, buildOAuthErrorUrl as bx, carryStepUpVerification as by, changePasswordService as bz, type RequestPasswordResetResult as c, listPasskeysService as c0, loginService as c1, logoutService as c2, machineAuth as c3, markPasskeySecondFactorService as c4, mfaEnrolledForUser as c5, mfaStatusService as c6, mfaVerifications as c7, oauthCallbackService as c8, oauthNativeService as c9, sendVerificationCodeService as cA, startDeviceAuthService as cB, startPasskeyEnrollmentService as cC, startPasskeyLoginService as cD, startSessionBindingDisableService as cE, startSessionRenewService as cF, startStepUpService as cG, startTotpEnrolmentService as cH, stepUpService as cI, sweepUnconfirmedMfaService as cJ, userPublicKeys as cK, verifyCodeService as cL, verifyOneTimeTokenService as cM, verifySecondFactor as cN, oauthStartService as ca, oauthUnlinkNotifyService as cb, oauthUnlinkedEvent as cc, optionalAuth as cd, passkeys as ce, pollDeviceAuthService as cf, regenerateRecoveryCodesService as cg, registerAuthProfile as ch, registerMachineVerifier as ci, registerOAuthProvider as cj, registerPublicKeyService as ck, registerService as cl, renamePasskeyService as cm, requestPasswordResetService as cn, requestSignupLinkService as co, requireEnabledProvider as cp, requireMachineScope as cq, resolveAuthenticatedUser as cr, revokeAllKeysService as cs, revokeAllOAuth2GrantsForUser as ct, revokeKeyService as cu, revokeOAuth2GrantService as cv, revokePasskeyService as cw, rotateKeyService as cx, runAuthProfile as cy, selectAuthProfile as cz, type ConfirmPasswordResetResult as d, type LoginResult as e, type StartDeviceAuthResult as f, type PasskeySummary as g, type ConfirmTotpResult as h, type RotateKeyResult as i, type RevokeAllKeysResult as j, type SessionBindingResult as k, type SessionRenewResult as l, mainAuthRouter as m, type OAuthNativeResult as n, type ProfileInfo as o, type OAuth2ConsentView as p, type OAuth2AuthorizationCodeIssued as q, type OAuth2GrantSummary as r, type AuthSession as s, PERMISSION_CATEGORIES as t, type PermissionCategory as u, VERIFICATION_TARGET_TYPES as v, type VerificationPurpose as w, type VerificationTargetType as x, type OAuthProvider as y, type NewPasskey as z };