@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.25

package/dist/server.d.ts

@@ -1,8 +1,8 @@
-import { A as AuthInitOptions, v as OAuthProvider, t as VerificationPurpose, N as NewPasskey, w as Passkey, x as MfaVerification, y as MfaVerificationMethod, r as PermissionCategory, z as AuthContext } from './machine-principals-CaEFq61K.js';
-export { B as ApproveDeviceAuthParams, E as AssertStepUpParams, G as AuthDeletionCancelledPayload, H as AuthDeletionCompletedPayload, J as AuthDeletionRequestedPayload, Q as AuthDeviceRegisteredPayload, W as AuthLoginPayload, X as AuthPasswordResetPayload, Y as AuthProfileOutcome, Z as AuthProfileVerifier, _ as AuthProviderSchema, $ as AuthRegisterPayload, a0 as ChangePasswordParams, a1 as CompletePasswordResetParams, a2 as CompleteSignupParams, a3 as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, a4 as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, a5 as ConfirmTotpParams, g as ConfirmTotpResult, a6 as DenyDeviceAuthParams, a7 as DeviceAuthApprovedResult, a8 as DeviceAuthInfoParams, D as DeviceAuthInfoResult, a9 as DeviceAuthPendingResult, aa as DeviceAuthPollResponseSchema, ab as DeviceNameSchema, ac as DeviceRegistrationChannel, ad as EmailSchema, ae as FingerprintSchema, af as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, ag as FinishPasskeyLoginParams, ah as InvitationAcceptedPayload, ai as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aj as KEY_FINGERPRINT_PREFIX_LENGTH, ak as KeyIdSchema, K as KeySummary, al as LoginParams, L as LoginResult, am as LogoutParams, an as MFA_VERIFICATION_METHODS, ao as MachinePrincipal, ap as MachineVerifierRegistration, aq as MarkPasskeyParams, M as MfaStatus, ar as NativeVerifyOptions, as as NewMfaVerification, at as NormalizedIdentity, n as OAuth2AuthorizationCodeIssued, au as OAuth2AuthorizeParams, l as OAuth2ConsentView, o as OAuth2GrantSummary, av as OAuth2ScopeDescription, aw as OAuthCallbackParams, ax as OAuthCallbackResult, ay as OAuthCodeExchangeOptions, az as OAuthNativeParams, j as OAuthNativeResult, aA as OAuthStartParams, O as OAuthStartResult, aB as OAuthTokens, aC as OAuthUnlinkedPayload, aD as PASSKEY_DEVICE_TYPES, aE as PASSKEY_LABEL_MAX_LENGTH, aF as PasskeyDeviceType, f as PasskeySummary, aG as PasswordSchema, aH as PhoneSchema, aI as PlatformSchema, aJ as PollDeviceAuthParams, aK as PollDeviceAuthResult, aL as PublicKeySchema, aM as RecentAuthenticationParams, aN as RegisterParams, aO as RegisterPublicKeyParams, a as RegisterResult, aP as RenamePasskeyParams, aQ as RequestPasswordResetParams, c as RequestPasswordResetResult, aR as RequestSignupLinkParams, b as RequestSignupLinkResult, aS as RevokeAllKeysParams, i as RevokeAllKeysResult, aT as RevokeKeyParams, aU as RevokePasskeyParams, aV as RotateKeyParams, h as RotateKeyResult, aW as SendVerificationCodeParams, S as SendVerificationCodeResult, aX as StartDeviceAuthParams, e as StartDeviceAuthResult, aY as StartPasskeyEnrollmentParams, aZ as StepUpParams, a_ as TargetTypeSchema, T as TotpEnrolmentResult, a$ as UnlinkNotification, b0 as UnlinkNotifyRejection, b1 as UnlinkNotifyRequest, b2 as UnlinkNotifyResult, b3 as UserCodeSchema, V as VERIFICATION_PURPOSES, s as VERIFICATION_TARGET_TYPES, b4 as VerificationPurposeSchema, u as VerificationTargetType, b5 as VerifyCodeParams, b6 as VerifyCodeResult, b7 as approveDeviceAuthService, b8 as approveOAuth2AuthorizeService, b9 as assertNotLastRecoveryCredential, ba as assertRecentAuthentication, bb as assertStepUp, bc as authDeletionCancelledEvent, bd as authDeletionCompletedEvent, be as authDeletionRequestedEvent, bf as authDeviceRegisteredEvent, bg as authLoginEvent, bh as authPasswordResetEvent, bi as authRegisterEvent, m as authRouter, bj as authenticate, bk as buildOAuthErrorUrl, bl as carryStepUpVerification, bm as changePasswordService, bn as completePasswordResetService, bo as completeSignupService, bp as confirmPasswordResetService, bq as confirmSignupLinkService, br as confirmTotpEnrolmentService, bs as denyDeviceAuthService, bt as denyOAuth2AuthorizeService, bu as describeOAuth2AuthorizeRequestService, bv as disableMfaService, bw as finishPasskeyEnrollmentService, bx as finishPasskeyLoginService, by as getDeviceAuthInfoService, bz as getEnabledOAuthProviders, bA as getGoogleAccessToken, bB as getMachinePrincipal, bC as getOAuthProvider, bD as getRegisteredProviders, bE as invitationAcceptedEvent, bF as invitationCreatedEvent, bG as isOAuthProviderEnabled, bH as issueOneTimeTokenService, bI as listKeysService, bJ as listOAuth2GrantsService, bK as listPasskeysService, bL as loginService, bM as logoutService, bN as machineAuth, bO as markPasskeySecondFactorService, bP as mfaEnrolledForUser, bQ as mfaStatusService, bR as mfaVerifications, bS as oauthCallbackService, bT as oauthNativeService, bU as oauthStartService, bV as oauthUnlinkNotifyService, bW as oauthUnlinkedEvent, bX as optionalAuth, bY as passkeys, bZ as pollDeviceAuthService, b_ as regenerateRecoveryCodesService, b$ as registerAuthProfile, c0 as registerMachineVerifier, c1 as registerOAuthProvider, c2 as registerPublicKeyService, c3 as registerService, c4 as renamePasskeyService, c5 as requestPasswordResetService, c6 as requestSignupLinkService, c7 as requireEnabledProvider, c8 as requireMachineScope, c9 as resolveAuthenticatedUser, ca as revokeAllKeysService, cb as revokeAllOAuth2GrantsForUser, cc as revokeKeyService, cd as revokeOAuth2GrantService, ce as revokePasskeyService, cf as rotateKeyService, cg as runAuthProfile, ch as selectAuthProfile, ci as sendVerificationCodeService, cj as startDeviceAuthService, ck as startPasskeyEnrollmentService, cl as startPasskeyLoginService, cm as startStepUpService, cn as startTotpEnrolmentService, co as stepUpService, cp as sweepUnconfirmedMfaService, cq as verifyCodeService, cr as verifyOneTimeTokenService, cs as verifySecondFactor } from './machine-principals-CaEFq61K.js';
+import { A as AuthInitOptions, z as OAuthProvider, N as NewUserPublicKey, x as VerificationPurpose, B as NewPasskey, E as Passkey, G as MfaVerification, H as MfaVerificationMethod, J as NewMfaChallenge, Q as MfaChallenge, u as PermissionCategory, W as UserPublicKey, X as AuthContext } from './machine-principals-CdEgxOB1.js';
+export { Y as ApproveDeviceAuthParams, Z as AssertStepUpParams, _ as AuthDeletionCancelledPayload, $ as AuthDeletionCompletedPayload, a0 as AuthDeletionRequestedPayload, a1 as AuthDeviceRegisteredPayload, a2 as AuthLoginPayload, a3 as AuthPasswordResetPayload, a4 as AuthProfileOutcome, a5 as AuthProfileVerifier, a6 as AuthProviderSchema, a7 as AuthRegisterPayload, a8 as BearerOutcome, a9 as BearerRefusal, aa as ChangePasswordParams, ab as CompletePasswordResetParams, ac as CompleteSignupParams, ad as ConfirmPasswordResetParams, d as ConfirmPasswordResetResult, ae as ConfirmSignupLinkParams, C as ConfirmSignupLinkResult, af as ConfirmTotpParams, g as ConfirmTotpResult, ag as DeferredLoginEvent, ah as DenyDeviceAuthParams, ai as DeviceAuthApprovedResult, aj as DeviceAuthInfoParams, D as DeviceAuthInfoResult, ak as DeviceAuthPendingResult, al as DeviceAuthPollResponseSchema, am as DeviceNameSchema, an as DeviceRegistrationChannel, ao as DisableSessionBindingParams, ap as EmailSchema, aq as FingerprintSchema, ar as FinishPasskeyEnrollmentParams, F as FinishPasskeyEnrollmentResult, as as FinishPasskeyLoginParams, at as FinishSessionRenewParams, au as InvitationAcceptedPayload, av as InvitationCreatedPayload, I as IssueOneTimeTokenResult, aw as KEY_FINGERPRINT_PREFIX_LENGTH, ax as KeyIdSchema, K as KeySummary, ay as LoginParams, L as LoginResult, az as LogoutParams, aA as MFA_CHALLENGE_ATTEMPT_LIMIT, aB as MFA_CHALLENGE_CHANNELS, aC as MFA_VERIFICATION_METHODS, aD as MachinePrincipal, aE as MachineVerifierRegistration, aF as MarkPasskeyParams, aG as MfaChallengeChannel, aH as MfaChallengeHandle, M as MfaStatus, aI as NativeVerifyOptions, aJ as NewMfaVerification, aK as NormalizedIdentity, q as OAuth2AuthorizationCodeIssued, aL as OAuth2AuthorizeParams, p as OAuth2ConsentView, r as OAuth2GrantSummary, aM as OAuth2ScopeDescription, aN as OAuthCallbackParams, aO as OAuthCallbackResult, aP as OAuthCodeExchangeOptions, aQ as OAuthNativeParams, n as OAuthNativeResult, aR as OAuthStartParams, O as OAuthStartResult, aS as OAuthTokens, aT as OAuthUnlinkedPayload, aU as OpenStepUpChallengeParams, aV as PASSKEY_DEVICE_TYPES, aW as PASSKEY_LABEL_MAX_LENGTH, aX as PasskeyDeviceType, f as PasskeySummary, aY as PasswordSchema, aZ as PhoneSchema, a_ as PlatformSchema, a$ as PollDeviceAuthParams, b0 as PollDeviceAuthResult, b1 as PublicKeySchema, b2 as RecentAuthenticationParams, b3 as RegisterParams, b4 as RegisterPublicKeyParams, b5 as RegisterPublicKeyResult, a as RegisterResult, b6 as RenamePasskeyParams, b7 as RequestPasswordResetParams, c as RequestPasswordResetResult, b8 as RequestSignupLinkParams, b as RequestSignupLinkResult, b9 as RevokeAllKeysParams, i as RevokeAllKeysResult, ba as RevokeKeyParams, bb as RevokePasskeyParams, bc as RotateKeyParams, h as RotateKeyResult, bd as SendVerificationCodeParams, S as SendVerificationCodeResult, be as SessionBindingParams, j as SessionBindingResult, bf as StartDeviceAuthParams, e as StartDeviceAuthResult, bg as StartPasskeyEnrollmentParams, bh as StartSessionRenewParams, bi as StepUpParams, bj as TargetTypeSchema, T as TotpEnrolmentResult, bk as UnlinkNotification, bl as UnlinkNotifyRejection, bm as UnlinkNotifyRequest, bn as UnlinkNotifyResult, bo as UserCodeSchema, v as VERIFICATION_PURPOSES, w as VERIFICATION_TARGET_TYPES, bp as VerificationPurposeSchema, y as VerificationTargetType, bq as VerifyCodeParams, br as VerifyCodeResult, bs as VerifyMfaChallengeParams, V as VerifyMfaChallengeResult, bt as admitBearerKey, bu as approveDeviceAuthService, bv as approveOAuth2AuthorizeService, bw as assertNotLastRecoveryCredential, bx as assertRecentAuthentication, by as assertStepUp, bz as attemptSecondFactor, bA as authDeletionCancelledEvent, bB as authDeletionCompletedEvent, bC as authDeletionRequestedEvent, bD as authDeviceRegisteredEvent, bE as authLoginEvent, bF as authPasswordResetEvent, bG as authRegisterEvent, m as authRouter, bH as authenticate, bI as bearerAuthContext, bJ as buildOAuthErrorUrl, bK as carryStepUpVerification, bL as changePasswordService, bM as completePasswordResetService, bN as completeSignupService, bO as confirmPasswordResetService, bP as confirmSignupLinkService, bQ as confirmTotpEnrolmentService, bR as denyDeviceAuthService, bS as denyOAuth2AuthorizeService, bT as describeOAuth2AuthorizeRequestService, bU as disableMfaService, bV as disableSessionBindingService, bW as enableSessionBindingService, bX as finishPasskeyEnrollmentService, bY as finishPasskeyLoginService, bZ as finishSessionRenewService, b_ as getDeviceAuthInfoService, b$ as getEnabledOAuthProviders, c0 as getGoogleAccessToken, c1 as getMachinePrincipal, c2 as getOAuthProvider, c3 as getRegisteredProviders, c4 as getSessionBindingService, c5 as invitationAcceptedEvent, c6 as invitationCreatedEvent, c7 as isOAuthProviderEnabled, c8 as issueOneTimeTokenService, c9 as keySessionBindingService, ca as listKeysService, cb as listOAuth2GrantsService, cc as listPasskeysService, cd as loginService, ce as logoutService, cf as machineAuth, cg as markPasskeySecondFactorService, ch as mfaChallenges, ci as mfaEnrolledForUser, cj as mfaStatusService, ck as mfaVerifications, cl as oauthCallbackService, cm as oauthNativeService, cn as oauthStartService, co as oauthUnlinkNotifyService, cp as oauthUnlinkedEvent, cq as openStepUpChallengeService, cr as optionalAuth, cs as passkeys, ct as pollDeviceAuthService, cu as regenerateRecoveryCodesService, cv as registerAuthProfile, cw as registerMachineVerifier, cx as registerOAuthProvider, cy as registerPublicKeyService, cz as registerService, cA as registeredBinding, cB as renamePasskeyService, cC as requestPasswordResetService, cD as requestSignupLinkService, cE as requireEnabledProvider, cF as requireMachineScope, cG as resolveAuthenticatedUser, cH as resumeStepUpChallengeService, cI as revokeAllKeysService, cJ as revokeAllOAuth2GrantsForUser, cK as revokeKeyService, cL as revokeOAuth2GrantService, cM as revokePasskeyService, cN as rotateKeyService, cO as runAuthProfile, cP as selectAuthProfile, cQ as sendVerificationCodeService, cR as startDeviceAuthService, cS as startMfaChallengeAssertionService, cT as startPasskeyEnrollmentService, cU as startPasskeyLoginService, cV as startSessionBindingDisableService, cW as startSessionRenewService, cX as startStepUpService, cY as startTotpEnrolmentService, cZ as stepUpService, c_ as sweepMfaChallengesService, c$ as sweepUnconfirmedMfaService, d0 as userPublicKeys, d1 as verifyCodeService, d2 as verifyMfaChallengeService, d3 as verifyOneTimeTokenService, d4 as verifySecondFactor } from './machine-principals-CdEgxOB1.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
-import { j as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-DYyhze28.js';
-export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, S as SOCIAL_PROVIDERS, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
+import { l as SocialProvider, K as KeyAlgorithmType, d as InvitationStatus, c as AccountDeletionRequestedBy, i as PurgeStrategy } from './types-CTdoTOxM.js';
+export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, I as INVITATION_STATUSES, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, h as KeyPlatformType, P as PURGE_STRATEGIES, j as SESSION_BINDINGS, k as SOCIAL_PROVIDERS, S as SessionBindingType, U as USER_STATUSES, m as UserStatus } from './types-CTdoTOxM.js';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';
 import { c as ClientIdentity } from './wire-version-CtzMKvBB.js';
@@ -10,7 +10,7 @@ import { Context } from 'hono';
 import * as _spfn_core_route from '@spfn/core/route';
 import { NamedMiddleware } from '@spfn/core/route';
 export { KeyPair, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, getKeySize, shouldRotateKey } from './crypto.js';
-export { S as SessionData, g as getSessionInfo, i as isSafeReturnPath, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-Dfwu5g2W.js';
+export { S as SessionData, g as getSessionInfo, i as isSafeReturnPath, s as sealSession, a as shouldRefreshSession, u as unsealSession } from './session-BbhAGZtA.js';
 import { JWTPayload } from 'jose';
 import { SSETokenManager, SSETokenStore } from '@spfn/core/event/sse';
 import * as _spfn_core_logger from '@spfn/core/logger';
@@ -129,6 +129,16 @@ declare const COOKIE_NAMES: {
     readonly SESSION_KEY_ID: string;
     /** Pending OAuth session (privateKey, keyId, algorithm) - temporary during OAuth flow */
     readonly OAUTH_PENDING: string;
+    /**
+     * Pending second-factor session (privateKey, keyId, challengeHash) (#95)
+     *
+     * Its own name and its own audience, separate from OAUTH_PENDING. The two
+     * coexist: a person who starts a social login in one tab while a password
+     * step-up is outstanding in another has both flows live, and one name would
+     * mean the second overwrote the first — sealing a session with a private key
+     * that does not match the key being activated.
+     */
+    readonly MFA_PENDING: string;
     /** OAuth CSRF nonce — double-submit against the (encrypted) state.nonce at callback */
     readonly OAUTH_CSRF: string;
     /** Password-setup session for verified-email signup — temporary, single-purpose */
@@ -341,6 +351,27 @@ declare function getCsrfMode(): CsrfMode;
  * Get the paths exempted from the CSRF check (exact match, backend route paths)
  */
 declare function getCsrfExemptPaths(): string[];
+/**
+ * How long a key bound to a passkey lives, in milliseconds.
+ *
+ * A positive override is honoured; anything else falls back to the policy
+ * constant. Nothing refuses boot over it — unlike the passkey relying party, a
+ * nonsensical value here does not make every ceremony fail, it just means the
+ * default applies.
+ */
+declare function getBoundKeyTtlMs(): number;
+/** How long past expiry a bound key may still be renewed, in milliseconds. */
+declare function getBoundKeyRenewGraceMs(): number;
+/** How close two sightings from two addresses must be to count as concurrent. */
+declare function getConcurrentUseWindowMs(): number;
+/**
+ * The page a bound session whose key expired is sent to.
+ *
+ * `RequireAuth` redirects here instead of to the sign-in page; the app renders a
+ * client component there that calls `renewSession(api)` and returns the person to
+ * where they were.
+ */
+declare function getSessionRenewPath(): string;
 /**
  * The relying party this deployment presents to authenticators, resolved.
  *
@@ -405,6 +436,15 @@ interface MfaConfig {
     issuer: string;
     /** How long a device's step-up stays good for a sensitive change. */
     stepUpWindowMs: number;
+    /**
+     * How long a new-device step-up challenge stays spendable.
+     *
+     * The window a person has to reach for their authenticator, and the window
+     * an attacker who has the password has to get past the second factor. Ten
+     * minutes is the same number the OAuth pending cookie and the link flows
+     * use, and the proxy's pending cookie is sealed for exactly this long.
+     */
+    challengeTtlMs: number;
 }
 /**
  * Resolve the second-factor configuration.
@@ -678,6 +718,36 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
+        sessionBinding: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["none", "passkey"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "users";
+            dataType: "string enum";
+            data: "none" | "passkey";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        sessionBindingChangedAt: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "users";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         lastLoginAt: drizzle_orm_pg_core.PgBuildColumn<"users", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
             tableName: "users";
@@ -725,6 +795,8 @@ declare function getUserByIdService(userId: number): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -747,6 +819,8 @@ declare function getUserByEmailService(email: string): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -769,6 +843,8 @@ declare function getUserByPhoneService(phone: string): Promise<{
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 /**
@@ -810,6 +886,8 @@ declare function updateUsernameService(userId: string | number | bigint, usernam
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBinding: "none" | "passkey";
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
 }>;
 
@@ -3158,326 +3236,6 @@ declare const userProfiles: drizzle_orm_pg_core.PgTableWithColumns<{
 type UserProfile = typeof userProfiles.$inferSelect;
 type NewUserProfile = typeof userProfiles.$inferInsert;
 
-/**
- * @spfn/auth - User Public Keys Entity
- *
- * Stores client-generated public keys for JWT verification
- * Supports key rotation and multi-key management per user
- */
-/**
- * User Public Keys Table
- * Each user can have multiple public keys (for rotation)
- */
-declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "user_public_keys";
-    schema: string;
-    columns: {
-        id: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "number int53";
-            data: number;
-            driverParam: number;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        keyId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        publicKey: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        algorithm: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ES256" | "RS256";
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["ES256", "RS256"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        deviceName: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        platform: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ios" | "android" | "web" | "desktop";
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        registeredIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        registeredUserAgent: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        clientKind: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["web", "ios", "android"] & [string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string enum";
-            data: "ios" | "android" | "web";
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["web", "ios", "android"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        clientVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        clientContractVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        clientSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        isActive: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "user_public_keys";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-    };
-    dialect: "pg";
-}>;
-type UserPublicKey = typeof userPublicKeys.$inferSelect;
-type NewUserPublicKey = typeof userPublicKeys.$inferInsert;
-
 /**
  * @spfn/auth - User Social Accounts Entity
  *
@@ -4429,8 +4187,15 @@ type NewKeyRevokeAllToken = typeof keyRevokeAllTokens.$inferInsert;
  * direction that matters most — an assertion collected as a second factor is
  * not a sign-in, and `passkeys/login/verify` refuses it for exactly the reason
  * the column exists.
+ *
+ * `'renewal'` is the fourth: the assertion that renews a bound session key, and
+ * the one that lets an account leave `session_binding: 'passkey'`. It is its own
+ * kind rather than a reused `'authentication'` because that kind's challenge is
+ * minted for nobody in particular — a discoverable sign-in names no account —
+ * while a renewal challenge is bound to the account it was issued for, and
+ * spending one where the other was expected would cross those two rules.
  */
-declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication", "mfa"];
+declare const WEBAUTHN_CHALLENGE_KINDS: readonly ["registration", "authentication", "mfa", "renewal"];
 type WebAuthnChallengeKind = typeof WEBAUTHN_CHALLENGE_KINDS[number];
 declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "webauthn_challenges";
@@ -4466,18 +4231,18 @@ declare const webauthnChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }>;
-        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication", "mfa"] & [string, ...string[]]>>, {
+        kind: drizzle_orm_pg_core.PgBuildColumn<"webauthn_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["registration", "authentication", "mfa", "renewal"] & [string, ...string[]]>>, {
             name: string;
             tableName: "webauthn_challenges";
             dataType: "string enum";
-            data: "registration" | "authentication" | "mfa";
+            data: "registration" | "authentication" | "mfa" | "renewal";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["registration", "authentication", "mfa"] & [string, ...string[]];
+            enumValues: ["registration", "authentication", "mfa", "renewal"] & [string, ...string[]];
             identity: undefined;
             generated: undefined;
         }>;
@@ -6273,6 +6038,17 @@ type NewAuthMetadataEntity = typeof authMetadata.$inferInsert;
  * - 타입 안전성
  */
 declare class UsersRepository extends BaseRepository {
+    /**
+     * The account's current key generation.
+     *
+     * Read from the primary, and this is the one place that matters: the value
+     * is stamped onto a second-factor challenge that must die with the
+     * generation it was minted in, and a replica lagging behind a revoke-all
+     * would stamp the generation that has just ended.
+     *
+     * Write primary 사용
+     */
+    currentKeyEpoch(id: number): Promise<number>;
     /**
      * ID로 사용자 조회
      * Read replica 사용
@@ -6294,6 +6070,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6320,6 +6098,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6357,6 +6137,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6390,6 +6172,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6413,6 +6197,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6436,6 +6222,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6459,6 +6247,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6482,6 +6272,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     } | null>;
     /**
@@ -6508,6 +6300,8 @@ declare class UsersRepository extends BaseRepository {
             emailVerifiedAt: Date | null;
             phoneVerifiedAt: Date | null;
             keyEpoch: number;
+            sessionBinding: "none" | "passkey";
+            sessionBindingChangedAt: Date | null;
             lastLoginAt: Date | null;
         };
         role: {
@@ -6526,6 +6320,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
+        sessionBinding: "none" | "passkey";
         id: number;
         username: string | null;
         passwordHash: string | null;
@@ -6535,6 +6330,7 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -6605,6 +6401,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6633,6 +6431,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6656,6 +6456,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6679,6 +6481,8 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     /**
@@ -6691,6 +6495,7 @@ declare class UsersRepository extends BaseRepository {
         status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
         publicId: string;
         passwordChangeRequired: boolean;
+        sessionBinding: "none" | "passkey";
         id: number;
         username: string | null;
         passwordHash: string | null;
@@ -6700,6 +6505,7 @@ declare class UsersRepository extends BaseRepository {
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
         deletedAt: Date | null;
         deletedBy: string | null;
@@ -6803,11 +6609,17 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6829,11 +6641,17 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6855,11 +6673,17 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6874,6 +6698,16 @@ declare class KeysRepository extends BaseRepository {
      *
      * `includeRevoked`는 이미 끊은 기기까지 보여준다 — "내가 언제 무엇을 끊었나"를
      * 확인하는 용도라, 폐기 시각과 사유를 함께 고른다.
+     *
+     * `lastSeenIp` is not selected, deliberately. The concurrent-use moment is
+     * what the owner acts on; the trail of addresses behind it is stored PII the
+     * account surface has no use for.
+     *
+     * A key still waiting on a second factor is excluded in **both** modes
+     * (#95). It is not a device that can sign, so it does not belong in the
+     * default list; and it is not a device the owner signed out either, so it
+     * does not belong in the revoked one — where it would read exactly like a
+     * revoked key with no revocation time, which is a different thing entirely.
      * Read replica 사용
      */
     listForUser(userId: number, includeRevoked?: boolean): Promise<{
@@ -6889,6 +6723,8 @@ declare class KeysRepository extends BaseRepository {
         revokedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        binding: "none" | "passkey";
+        concurrentUseAt: Date | null;
     }[]>;
     /**
      * 공개키 생성
@@ -6910,10 +6746,16 @@ declare class KeysRepository extends BaseRepository {
         lastUsedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
+        pendingMfaChallengeId: number | null;
         revokedReason: string | null;
     }>;
     /**
@@ -6937,11 +6779,17 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -6977,6 +6825,17 @@ declare class KeysRepository extends BaseRepository {
      * active keys still had its generation ended, and an outstanding
      * sign-out-everywhere link must die with it.
      *
+     * The two second-factor CTEs are here for the same "no caller can forget"
+     * reason (#95). A pending key is `is_active = false`, so the UPDATE below
+     * does not touch it and neither would anything else: the owner who sees an
+     * unexpected second-factor prompt and does exactly what the notice says —
+     * change the password, sign out everywhere, open the revoke-all link, run a
+     * reset — would otherwise leave the attacker's pending key and its live
+     * challenge untouched. Deleting the key cascades onto its challenge; the
+     * expiry beside it catches a challenge whose key is already gone. A pending
+     * row and an active row are disjoint sets, so the two statements never
+     * contend for the same row.
+     *
      * Write primary 사용
      */
     private revokeActive;
@@ -7000,10 +6859,16 @@ declare class KeysRepository extends BaseRepository {
         lastUsedAt: Date | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
+        pendingMfaChallengeId: number | null;
         revokedReason: string | null;
     }>;
     /**
@@ -7029,11 +6894,17 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -7055,17 +6926,68 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
+        clientKind: "ios" | "android" | "web" | null;
+        clientVersion: string | null;
+        clientContractVersion: string | null;
+        clientSeenAt: Date | null;
+        isActive: boolean;
+        pendingMfaChallengeId: number | null;
+        createdAt: Date;
+        lastUsedAt: Date | null;
+        expiresAt: Date | null;
+        revokedAt: Date | null;
+        revokedReason: string | null;
+    }>;
+    /**
+     * Bind one live key to the account's passkey, and give it the short life
+     * that goes with it.
+     *
+     * Scoped by user and by `isActive`, like every other targeted update here, so
+     * the answer is "this call bound something" rather than "a row exists".
+     * Write primary 사용
+     */
+    bindByKeyIdAndUserId(keyId: string, userId: number, expiresAt: Date): Promise<{
+        id: number;
+        userId: number;
+        keyId: string;
+        publicKey: string;
+        algorithm: "ES256" | "RS256";
+        fingerprint: string;
+        deviceName: string | null;
+        platform: "ios" | "android" | "web" | "desktop" | null;
+        registeredIp: string | null;
+        registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
         revokedAt: Date | null;
         revokedReason: string | null;
     }>;
+    /**
+     * Return every one of a user's bound keys to an ordinary long-lived key.
+     *
+     * One statement, because turning the setting off has to leave no key behind:
+     * a row still marked `'passkey'` would keep expiring in hours with nothing
+     * left to renew it, and its owner has just said they do not want that.
+     * Write primary 사용
+     */
+    unbindActiveByUserId(userId: number, expiresAt: Date): Promise<number>;
     /**
      * Key ID로 공개키 조회 — 활성 여부 무관 (clientProofV1 admission의 revocation 판정용)
      *
@@ -7084,11 +7006,17 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -7110,11 +7038,17 @@ declare class KeysRepository extends BaseRepository {
         platform: "ios" | "android" | "web" | "desktop" | null;
         registeredIp: string | null;
         registeredUserAgent: string | null;
+        registeredUaFamily: string | null;
+        lastSeenIp: string | null;
+        lastSeenAt: Date | null;
+        concurrentUseAt: Date | null;
+        binding: "none" | "passkey";
         clientKind: "ios" | "android" | "web" | null;
         clientVersion: string | null;
         clientContractVersion: string | null;
         clientSeenAt: Date | null;
         isActive: boolean;
+        pendingMfaChallengeId: number | null;
         createdAt: Date;
         lastUsedAt: Date | null;
         expiresAt: Date | null;
@@ -7140,8 +7074,28 @@ declare class KeysRepository extends BaseRepository {
      * `clientSeenAt` moves only when one of the three values differs from what is
      * stored, so it answers "since when has this device been on this release"
      * rather than "when was it last seen", which lastUsedAt already answers.
+     *
+     * `ip` is the client address this request resolved to, or null when none did.
+     * It joins this statement rather than getting one of its own: the rule the
+     * concurrent-use signal needs — write the address, and move
+     * `concurrentUseAt` when it differs from the stored one inside the window —
+     * is the rule already implemented here, and a second fire-and-forget write
+     * beside it would double the per-request write on the authenticated path. It
+     * is also why the comparison is a `CASE` over the stored value rather than a
+     * read followed by a write: the row comes off the read replica, and a
+     * replica-lagged address compared in application code both misses real
+     * switches and invents ones that did not happen.
+     */
+    updateLastUsedById(id: number, identity?: ClientIdentity | null, ip?: string | null): Promise<void>;
+    /**
+     * The boundary a previous sighting has to be newer than to count as concurrent.
+     *
+     * Computed here rather than written as `now() - interval` so that the moment
+     * the row is stamped with and the moment the window is measured from are the
+     * same one — a statement that used the database clock for the boundary and
+     * ours for the value would disagree with itself by the round trip.
      */
-    updateLastUsedById(id: number, identity?: ClientIdentity | null): Promise<void>;
+    private concurrentUseSince;
 }
 declare const keysRepository: KeysRepository;
 
@@ -7791,6 +7745,108 @@ declare class MfaVerificationsRepository extends BaseRepository {
 }
 declare const mfaVerificationsRepository: MfaVerificationsRepository;
 
+/**
+ * MFA Challenges Repository
+ *
+ * Data access for the row that stands between a registered-but-inactive key and
+ * a session. Extends BaseRepository for transaction-context detection and
+ * read/write splitting.
+ *
+ * Every lookup here is by `challenge_hash` and never by id. The secret is what
+ * the caller holds; the hash is what this table has, so a row can only be found
+ * by someone who already had the secret — a guess reaches no row at all, which
+ * is what keeps a guess from touching another challenge's `attempts`.
+ */
+
+declare class MfaChallengesRepository extends BaseRepository {
+    /** Park a fresh challenge. The caller has already written the pending key. */
+    create(data: NewMfaChallenge): Promise<MfaChallenge>;
+    /**
+     * The challenge this secret names, whatever state it is in.
+     *
+     * Reads the primary rather than the replica: `verify` decides whether a key
+     * becomes usable, and a replica lagging behind the 202 that created the row
+     * would refuse a challenge the caller was handed a moment ago.
+     */
+    findByHash(challengeHash: string): Promise<MfaChallenge | null>;
+    /**
+     * The live challenge already outstanding for this key, if there is one.
+     *
+     * What makes a retried registration resume rather than collide: a native
+     * client reusing its keyId, or an OAuth state replayed from the back button,
+     * gets the challenge it was already given instead of a 409 about a key it
+     * does own.
+     */
+    findLiveByKeyId(userId: number, keyId: string): Promise<MfaChallenge | null>;
+    /**
+     * Spend the challenge, or answer false because somebody else already did.
+     *
+     * A conditional UPDATE and not a read followed by a write: two verifies
+     * arriving together would both pass a read, and a challenge is single use.
+     * Every condition the caller checked is restated here, so the row that is
+     * marked is a row that was still spendable at the moment it was marked.
+     */
+    markVerified(id: number, keyEpoch: number): Promise<boolean>;
+    /**
+     * Count a wrong proof, and say whether that was the last one allowed.
+     *
+     * The increment is on the row the presented secret actually hashed to, which
+     * is the whole reason lookup is by hash: there is no id for a caller to name,
+     * so no counter but their own can be moved.
+     */
+    countFailure(id: number): Promise<boolean>;
+    /**
+     * Point an inactive key at the challenge that gates it.
+     *
+     * A second statement rather than a column on the insert, because the
+     * challenge references the key: the key row has to exist before the
+     * challenge can, so the back-reference is written once both do. Both run
+     * inside the registering route's transaction.
+     */
+    markKeyPending(keyId: string, challengeId: number): Promise<void>;
+    /**
+     * Give a live challenge a fresh secret, leaving everything else alone.
+     *
+     * What a retried registration gets. The row keeps its id, its expiry and its
+     * spent attempts, so retrying is not a way to reset the counter or buy
+     * another ten minutes; only the secret is new, because the old one was never
+     * stored and cannot be handed out twice.
+     */
+    resecret(id: number, challengeHash: string): Promise<boolean>;
+    /**
+     * Delete the pending key a challenge was gating, which takes the challenge
+     * with it through the cascade.
+     *
+     * Scoped to `pending_mfa_challenge_id`, so a key that has since been
+     * activated is never deleted by a late failure or a sweep.
+     */
+    dropPendingKey(keyId: string, challengeId: number): Promise<void>;
+    /**
+     * Mark a key active and no longer pending — what a verified challenge buys.
+     *
+     * Conditioned on the challenge id, so this can only activate the key that
+     * challenge was minted for.
+     */
+    activateKey(keyId: string, challengeId: number): Promise<void>;
+    /**
+     * Clear out challenges nobody finished, and the keys they were gating.
+     *
+     * Counted from the read rather than from either delete, because the two
+     * overlap: deleting a pending key cascades onto its challenge, so the second
+     * statement finds only the challenges whose key had already gone some other
+     * way — and a count taken there would report a sweep that did nothing.
+     *
+     * A spent challenge is kept for the same span as an expired one, so a replay
+     * inside the window meets "already verified" from a row rather than
+     * "unknown" from an absence. The 401 is the same either way; the record is
+     * not.
+     *
+     * @returns how many challenge rows are gone
+     */
+    sweepFinished(cutoff: Date): Promise<number>;
+}
+declare const mfaChallengesRepository: MfaChallengesRepository;
+
 /**
  * MFA Enrolment Repository
  *
@@ -9088,9 +9144,9 @@ declare class AccountDeletionRequestsRepository extends BaseRepository {
         cancelledAt: Date | null;
         completedAt: Date | null;
         userPublicId: string;
-        requestedAt: Date;
         requestedBy: "admin" | "self";
         purgeStrategy: "anonymize" | "hard-delete" | null;
+        requestedAt: Date;
     }>;
     /**
      * 요청 취소 (복구)
@@ -9661,6 +9717,31 @@ declare function verifyKeyFingerprint(publicKeyB64: string, expectedFingerprint:
  */
 declare function assertKeyMatchesAlgorithm(publicKeyB64: string, algorithm: KeyAlgorithmType): void;
 
+/**
+ * Whether a key may sign a renewal — the one clause that differs from `authenticate`.
+ *
+ * Bound, and within its grace. Early renewal is allowed, because a browser that
+ * asks a minute before its key runs out should not have to wait for the failure
+ * first; late renewal is allowed for the grace window, so a laptop closed over a
+ * long weekend comes back to one prompt instead of a sign-in. Past it there is
+ * nothing to continue, and an unbound key was never in this ceremony at all.
+ */
+declare function admitsForRenewal(key: UserPublicKey): boolean;
+/**
+ * Renewal authentication middleware
+ *
+ * Auto-skips the global `auth` middleware, the way `optionalAuth` does: a route
+ * that carries this one must not also be asked for a live key.
+ *
+ * @example
+ * ```typescript
+ * export const sessionRenewOptions = route.post('/_auth/session/renew/options')
+ *   .use([authenticateForRenewal])
+ *   .handler(async (c) => startSessionRenewService({ expiredKeyId: getAuth(c).keyId }));
+ * ```
+ */
+declare const authenticateForRenewal: _spfn_core_route.NamedMiddleware<"authForRenewal">;
+
 /**
  * @spfn/auth - Permission Middleware
  *
@@ -10008,6 +10089,7 @@ declare function getUser(c: Context | {
     status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
     publicId: string;
     passwordChangeRequired: boolean;
+    sessionBinding: "none" | "passkey";
     id: number;
     username: string | null;
     passwordHash: string | null;
@@ -10017,6 +10099,7 @@ declare function getUser(c: Context | {
     emailVerifiedAt: Date | null;
     phoneVerifiedAt: Date | null;
     keyEpoch: number;
+    sessionBindingChangedAt: Date | null;
     lastLoginAt: Date | null;
     deletedAt: Date | null;
     deletedBy: string | null;
@@ -11011,4 +11094,4 @@ declare const authJobRouter: _spfn_core_job.JobRouter<{
  */
 declare const createAuthDeletionJobRouter: typeof createAuthJobRouter;
 
-export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, type NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, type UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userPublicKeys, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };
+export { AUTHORIZE_PATH, type AccountDeletionPurgeUser, type AccountDeletionRequest, AccountDeletionRequestedBy, AccountDeletionRequestsRepository, type AuthConfig, AuthContext, type AuthCsrfConfig, type AuthDeletionConfig, type AuthDeviceAuthConfig, type AuthLifecycleConfig, type AuthLifecycleOptions, type AuthMetadataEntity, AuthMetadataRepository, type AuthorizationServerConfig, type AuthorizationServerOptions, type BeforeRegisterContext, COOKIE_NAMES, CSRF_HEADER, type CancelAccountDeletionParams, type CancelAccountDeletionResult, type CreateOAuthStateParams, type CreateRevokeAllLinkOptions, type CsrfMode, DEFAULT_ACCESS_TOKEN_TTL_MS, DEFAULT_CODE_TTL_MS, DEFAULT_DELETION_ALLOW_SELF_IMMEDIATE, DEFAULT_DELETION_GRACE_PERIOD_DAYS, DEFAULT_DELETION_PURGE_CRON, DEFAULT_DELETION_PURGE_STRATEGY, DEFAULT_DELETION_SEND_NOTIFICATIONS, DEFAULT_DEVICE_AUTH_INTERVAL_MS, DEFAULT_DEVICE_AUTH_TTL_MS, DEFAULT_REFRESH_TOKEN_TTL_MS, DEFAULT_REVOKE_ALL_TOKEN_PURGE_CRON, DEVICE_AUTH_STATUSES, type DecryptedOAuthToken, type DeviceAuthStatus, type DeviceAuthorization, DeviceAuthorizationsRepository, type EmailNormalizationResult, EnvironmentKeyringTokenCipher, type GoogleTokenResponse, type GoogleUserInfo, type Invitation, InvitationStatus, InvitationsRepository, type IssuedOpsToken, KeyAlgorithmType, type KeyRevokeAllToken, KeyRevokeAllTokensRepository, KeysRepository, type LiveRevokeAllLink, MAX_UNGRANTED_CLIENTS_PER_IP, MFA_CONFIRM_ATTEMPT_LIMIT, MfaChallenge, MfaChallengesRepository, type MfaConfig, MfaEnrolmentRepository, type MfaRecoveryCode, MfaRecoveryCodesRepository, type MfaTotp, MfaTotpRepository, MfaVerification, MfaVerificationMethod, MfaVerificationsRepository, type NewAccountDeletionRequest, type NewAuthMetadataEntity, type NewDeviceAuthorization, type NewInvitation, type NewKeyRevokeAllToken, NewMfaChallenge, type NewMfaRecoveryCode, type NewMfaTotp, type NewOAuth2AuthorizationCode, type NewOAuth2Client, type NewOAuth2Grant, type NewOAuth2Token, type NewOpsToken, NewPasskey, type NewPasswordResetToken, type NewPermission, type NewPermissionEntity, type NewRole, type NewRoleEntity, type NewRolePermission, type NewSignupLinkToken, type NewUser, type NewUserPermission, type NewUserProfile, NewUserPublicKey, type NewUserSocialAccount, type NewVerificationCode, type NewWebAuthnChallenge, OAUTH2_ACCESS_TOKEN_PREFIX, OAUTH2_REFRESH_TOKEN_PREFIX, OAUTH2_TOKEN_KINDS, type OAuth2AuthorizationCode, OAuth2AuthorizationCodesRepository, type OAuth2Client, OAuth2ClientsRepository, type OAuth2Grant, type OAuth2GrantWithClient, OAuth2GrantsRepository, type OAuth2RegisterRefusal, type OAuth2RegisterRequest, type OAuth2RegisterResult, type OAuth2RegisteredClient, type OAuth2Token, type OAuth2TokenKind, type OAuth2TokenRefusal, type OAuth2TokenRequest, type OAuth2TokenResponse, type OAuth2TokenResult, OAuth2TokensRepository, OAuthProvider, type OAuthState, type OAuthTokenCipher, type OAuthTokenContext, type OAuthTokenType, OPS_TOKEN_PREFIX, type OpsOrUserConfig, type OpsToken, OpsTokensRepository, Passkey, type PasskeyConfig, type PasskeyUserVerification, PasskeysRepository, type PasswordResetToken, PasswordResetTokensRepository, type PendingDeletionInfo, type Permission, type PermissionEntity, PermissionsRepository, PurgeStrategy, type PurgeUserResult, type RedirectUriRefusal, type RegisterChannel, type RequestAccountDeletionParams, type RequestAccountDeletionResult, type RevokeAllLink, type RevokeAllLinkDescription, type RevokedKey, type Role, type RoleEntity, type RoleGuardOptions, type RolePermission, RolePermissionsRepository, RolesRepository, STALE_CLIENT_MAX_AGE_MS, SUPPORTED_GRANT_TYPES, SUPPORTED_RESPONSE_TYPES, type SessionPayload, type SignupLinkToken, SignupLinkTokensRepository, SocialAccountsRepository, SocialProvider, type SweepDuePurgesResult, type TokenEncryptionKey, type TokenPayload, USER_CODE_ALPHABET, USER_CODE_LENGTH, type UpdateProfileParams, type User, type UserPermission, UserPermissionsRepository, type UserProfile, UserProfilesRepository, UserPublicKey, type UserSocialAccount, UsersRepository, V2_PREFIX, type VerificationCode, VerificationCodesRepository, VerificationPurpose, type VerifiedOAuth2AccessToken, type VerifiedOpsToken, type VerifyIdTokenParams, WEBAUTHN_CHALLENGE_KINDS, type WebAuthnChallenge, type WebAuthnChallengeKind, WebAuthnChallengesRepository, acceptInvitation, accountDeletionRequests, accountDeletionRequestsRepository, addPermissionToRole, admitsForRenewal, appleProvider, assertAuthorizationServerIssuer, assertCanAssignRole, assertKeyMatchesAlgorithm, assertPasskeyConfig, authJobRouter, authLogger, authMetadata, authMetadataRepository, authSchema, authenticateForRenewal, cancelAccountDeletionService, cancelInvitation, checkUsernameAvailableService, configureAuth, configureAuthorizationServer, configureDeletion, configureDeviceAuth, configureOAuthTokenCipher, consumeRevokeAllLink, createAuthDeletionJobRouter, createAuthDeletionPurgeJob, createAuthJobRouter, createAuthLifecycle, createInvitation, createOAuthState, createRevokeAllLink, createRevokeAllTokenPurgeJob, createRole, decodeToken, decryptToken, deleteInvitation, deleteRole, deriveCsrfToken, describeRevokeAllLink, deviceAuthorizations, deviceAuthorizationsRepository, encryptToken, exchangeCodeForTokens, expireOldInvitations, formatUserCode, generateAccessToken, generateAuthorizationCode, generateDeviceCode, generateOAuthNonce, generateRefreshToken, generateToken, generateUserCode, getAllRoles, getAuth, getAuthConfig, getAuthSessionService, getAuthorizationServerConfig, getBoundKeyRenewGraceMs, getBoundKeyTtlMs, getConcurrentUseWindowMs, getCsrfExemptPaths, getCsrfMode, getDeletionConfig, getDeviceAuthConfig, getDummyPasswordHash, getEncryptionKeyring, getGoogleAuthUrl, getGoogleOAuthConfig, getGoogleUserInfo, getInvitationByToken, getInvitationWithDetails, getKeyId, getLocale, getMfaConfig, getOneTimeTokenManager, getOpsToken, getOptionalAuth, getPasskeyConfig, getPendingDeletionInfo, getRole, getRoleByName, getRolePermissions, getSessionRenewPath, getSessionTtl, getUser, getUserByEmailService, getUserByIdService, getUserByPhoneService, getUserId, getUserPermissions, getUserProfileService, getUserRole, githubProvider, googleProvider, hasAllPermissions, hasAnyPermission, hasAnyRole, hasPermission, hasRole, hashDeviceCode, hashOAuth2Secret, hashPassword, initOneTimeTokenManager, initializeAuth, invitationsRepository, isAccessTokenShaped, isEncrypted, isGoogleOAuthEnabled, isLoopbackHostname, isOpsToken, isPkceS256ChallengeShaped, isPkceVerifierShaped, issueOpsTokenService, kakaoProvider, keyRevokeAllTokens, keyRevokeAllTokensRepository, keysRepository, linkMailJob, listInvitations, listOpsTokensService, matchOAuthCsrfCookies, matchesCsrfToken, matchesRegisteredRedirectUri, mfaChallengesRepository, mfaEnrolmentRepository, mfaRecoveryCodes, mfaRecoveryCodesRepository, mfaTotp, mfaTotpRepository, mfaVerificationsRepository, naverProvider, normalizeEmail, normalizeOptionalEmail, normalizeResource, normalizeStoredEmails, normalizeUserCode, oauth2AuthorizationCodes, oauth2AuthorizationCodesRepository, oauth2Clients, oauth2ClientsRepository, oauth2Grants, oauth2GrantsRepository, oauth2TokenService, oauth2Tokens, oauth2TokensRepository, oneTimeTokenAuth, opsOrUser, opsTokenAuth, opsTokens, opsTokensRepository, parseDuration, passkeysRepository, passwordResetTokens, passwordResetTokensRepository, permissions, permissionsRepository, pkceChallengeFor, purgeRevokeAllTokensService, purgeStaleOAuth2ClientsService, purgeUserService, redirectHostOf, refreshAccessToken, refuseRedirectUriRegistration, registerOAuth2ClientService, removePermissionFromRole, requestAccountDeletionService, requireAnyPermission, requireOpsScope, requirePermissions, requireRole, resendInvitation, resolveIssuerSource, revokeOAuth2TokenService, revokeOpsTokenService, roleGuard, rolePermissions, rolePermissionsRepository, roles, rolesRepository, runBeforeRegister, sameOAuth2Hash, sameResource, secondsUntil, setRolePermissions, signupLinkTokens, signupLinkTokensRepository, socialAccountsRepository, sweepDuePurges, toEpochSeconds, updateLastLoginService, updateLocaleService, updateRole, updateUserProfileService, updateUserService, updateUsernameService, userInvitations, userPermissions, userPermissionsRepository, userProfiles, userProfilesRepository, userSocialAccounts, users, usersRepository, validateInvitation, validatePasswordStrength, verificationCodes, verificationCodesRepository, verifyAccessToken, verifyClientToken, verifyIdToken, verifyKeyFingerprint, verifyOAuthState, verifyOpsTokenService, verifyPassword, verifyToken, webauthnChallenges, webauthnChallengesRepository };