@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.25

package/dist/{machine-principals-CaEFq61K.d.ts → machine-principals-CdEgxOB1.d.ts}

@@ -1,7 +1,7 @@
+import { S as SessionBindingType, K as KeyAlgorithmType, h as KeyPlatformType, l as SocialProvider } from './types-CTdoTOxM.js';
 import * as _simplewebauthn_server from '@simplewebauthn/server';
 import { RegistrationResponseJSON, AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 import * as _spfn_core_route from '@spfn/core/route';
-import { K as KeyAlgorithmType, h as KeyPlatformType, j as SocialProvider } from './types-DYyhze28.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
@@ -90,6 +90,66 @@ interface UserProfile {
     profile: ProfileInfo | null;
 }
 
+/**
+ * @spfn/auth - What a sign-in answers with
+ *
+ * One module for the shape every path that starts a session returns, and for the
+ * helper that fills in its binding half. It is here rather than in
+ * `auth.service.ts` because three of its readers are upstream of that file —
+ * `key.service` decides the second-factor step-up, `mfa.service` resolves it —
+ * and a type living with one of its producers would put those services in a
+ * cycle with each other.
+ */
+
+/**
+ * The second-factor challenge a stepped-up sign-in hands back (#95).
+ *
+ * `secret` is the 32 random bytes the challenge was minted from, and it is the
+ * only form of it that ever leaves the server — the row is addressed by its
+ * hash. It authorizes exactly one thing, `POST /_auth/mfa/verify` for this one
+ * registration, and it is not a bearer credential for anything else.
+ */
+interface MfaChallengeHandle {
+    secret: string;
+    /** Epoch milliseconds the challenge stops verifying at. */
+    expiresAtMillis: number;
+}
+/**
+ * What a sign-in answers with, on every path that starts a session.
+ *
+ * **One type with a required discriminant, not a union.** A sign-in on an
+ * account with a second factor and a device it has never seen answers 202 with
+ * `mfaRequired: true` and a challenge instead of a session (#95), and the two
+ * answers have to be one declared type: `authApi.login` infers its result from
+ * this declaration, so a union would make every existing `result.userId` in
+ * every consuming app stop compiling, and the mobile contract's grammar has no
+ * union type either — `DeviceAuthPollResponse` was flattened the same way and
+ * for the same reason. Narrow on `mfaRequired` before reading `userId`.
+ *
+ * `sessionBinding` and `keyExpiresAtMillis` are the carrier #97 needed. The
+ * Next.js proxy generated the device key and sealed the cookie, but only the
+ * backend knows whether the account asked for a bound session and when the key
+ * it just registered runs out — so the sign-in says it here and the interceptor
+ * copies both into `SessionData`. A response without them seals an unbound
+ * session, which is what every account that did not opt in gets and what every
+ * path predating that change keeps getting.
+ */
+interface LoginResult {
+    /** true means no session was started: verify the challenge below first. */
+    mfaRequired: boolean;
+    /** Present exactly when `mfaRequired` is true. */
+    challenge?: MfaChallengeHandle;
+    userId?: string;
+    publicId?: string;
+    email?: string;
+    phone?: string;
+    passwordChangeRequired?: boolean;
+    /** `'passkey'` when the key registered by this sign-in is bound. Absent otherwise. */
+    sessionBinding?: SessionBindingType;
+    /** Epoch milliseconds that key expires at. Only sent alongside `sessionBinding`. */
+    keyExpiresAtMillis?: number;
+}
+
 /**
  * @spfn/auth - Auth Service
  *
@@ -112,6 +172,12 @@ interface RegisterParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. Carried for shape rather than effect: a brand-new account is on the
+     * default `session_binding: 'none'`, so its first key is never bound.
+     */
+    webProxy?: boolean;
 }
 interface RegisterResult {
     userId: string;
@@ -134,14 +200,10 @@ interface LoginParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
-interface LoginResult {
-    userId: string;
-    publicId: string;
-    email?: string;
-    phone?: string;
-    passwordChangeRequired: boolean;
-}
+
 interface LogoutParams {
     userId: number;
     keyId: string;
@@ -254,11 +316,14 @@ declare const DeviceAuthPollResponseSchema: _sinclair_typebox.TUnion<[_sinclair_
     intervalMillis: _sinclair_typebox.TInteger;
 }>, _sinclair_typebox.TObject<{
     status: _sinclair_typebox.TLiteral<"approved">;
+    mfaRequired: _sinclair_typebox.TBoolean;
     userId: _sinclair_typebox.TString;
     publicId: _sinclair_typebox.TString;
     email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
     phone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
     passwordChangeRequired: _sinclair_typebox.TBoolean;
+    sessionBinding: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"none" | "passkey">[]>>;
+    keyExpiresAtMillis: _sinclair_typebox.TOptional<_sinclair_typebox.TInteger>;
 }>]>;
 declare const PasswordSchema: _sinclair_typebox.TString;
 declare const TargetTypeSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">]>;
@@ -476,6 +541,8 @@ interface CompletePasswordResetParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
 /**
  * Step 3 — set the new password, which is what completes the reset.
@@ -488,8 +555,15 @@ interface CompletePasswordResetParams {
  * A refusal that is the user's to fix — a password the policy rejects, a body
  * with no device key — leaves the setup session usable, so the fix is retyping
  * the password rather than asking for a fresh email.
+ *
+ * The answer carries the binding fields, like every other path that starts a
+ * session. A reset on an account that opted in registers a bound key — 24 hours,
+ * renewable only by a passkey — and this route is on the sealing interceptor's
+ * list, so a body that did not say so would have the proxy seal a cookie
+ * believing the session unbound: no user-agent check for the life of that key,
+ * and a sign-out a day later instead of the renewal prompt.
  */
-declare function completePasswordResetService(params: CompletePasswordResetParams): Promise<RegisterResult>;
+declare function completePasswordResetService(params: CompletePasswordResetParams): Promise<LoginResult>;
 
 /**
  * @spfn/auth - Device Auth Service
@@ -564,16 +638,35 @@ interface PollDeviceAuthParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. A waiting device polls the backend itself, so this is false there
+     * and the key it collects is unbound — which is what a device with no browser
+     * to run a WebAuthn ceremony in needs.
+     */
+    webProxy?: boolean;
 }
 /** Nobody has answered yet. Not an error — the waiting device waits. */
 interface DeviceAuthPendingResult {
     status: 'pending';
     intervalMillis: number;
 }
-/** Approved and spent: the key is registered and this is the login it produced. */
+/**
+ * Approved and spent: the key is registered and this is the login it produced.
+ *
+ * `LoginResult`'s login fields are optional because a sign-in may answer a
+ * second-factor challenge instead of a session (#95). This branch never can —
+ * the owner already said yes on a device that is signed in, which is itself the
+ * second factor — so the three it always carries are narrowed back to required
+ * and a consumer of the approved branch reads exactly what it always read.
+ */
 type DeviceAuthApprovedResult = {
     status: 'approved';
-} & LoginResult;
+} & LoginResult & {
+    userId: string;
+    publicId: string;
+    passwordChangeRequired: boolean;
+};
 type PollDeviceAuthResult = DeviceAuthPendingResult | DeviceAuthApprovedResult;
 /**
  * Park a new device's key and hand back the codes it needs.
@@ -1033,6 +1126,8 @@ interface FinishPasskeyLoginParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
 /**
  * Step 2 of sign-in — verify the assertion, then sign in exactly as a password
@@ -1092,394 +1187,101 @@ declare function revokePasskeyService(params: RevokePasskeyParams): Promise<{
 }>;
 
 /**
- * @spfn/auth - Second-Factor Verification Entity
- *
- * When each device last proved the account's second factor. One row per device
- * key, which is what makes the step-up window mean "this device, recently"
- * rather than "somebody, somewhere, recently".
+ * Auth provider type
  *
- * `key_id` is the primary key and a foreign key onto `user_public_keys.key_id`,
- * so the row dies with the device it belongs to — a revoked key cannot leave a
- * verification behind for the next key that reuses its id, and deleting an
- * account takes these with it. A rotation is the one moment the row moves
- * rather than dying: rotating is already proof of the same device, so
- * `rotateKeyService` and the login rotation carry the verification across, or
- * the window would silently expire every time the proxy rotated a key.
+ * 직접 인증(email/phone) + 등록 가능한 모든 소셜 provider(SOCIAL_PROVIDERS).
  */
+declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">, ..._sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]]>;
+/** The doors `auth.login` can name, as a type. */
+type AuthLoginProvider = Static<typeof AuthLoginProviderSchema>;
 /**
- * Which credential satisfied the step-up.
+ * Login provider type
  *
- * Recorded for the owner-facing audit an app may build on it, and for support:
- * "recovery" is the one that should be rare, and an account stepping up with
- * recovery codes repeatedly has lost its authenticator.
+ * AuthProviderSchema + `'device'` and `'passkey'`.
+ *
+ * `'device'` is how a device-code login names itself: the account was proven on
+ * another device that was already signed in, so no credential was presented here
+ * and none of the values above describes it. `'passkey'` is a WebAuthn assertion
+ * — a credential of the account, but not one of the sign-up channels.
+ *
+ * A separate union rather than a widened AuthProviderSchema. Neither is a way to
+ * register — a device-code request can only ever be approved by an existing
+ * account, and a passkey has to be enrolled from a session that already exists —
+ * and neither is something a provider can unlink, so the two events that mean
+ * those things must not start accepting them.
  */
-declare const MFA_VERIFICATION_METHODS: readonly ["totp", "recovery", "passkey"];
-type MfaVerificationMethod = typeof MFA_VERIFICATION_METHODS[number];
-declare const mfaVerifications: drizzle_orm_pg_core.PgTableWithColumns<{
-    name: "mfa_verifications";
-    schema: string;
-    columns: {
-        keyId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "mfa_verifications";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
-            name: string;
-            tableName: "mfa_verifications";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        method: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["totp", "recovery", "passkey"] & [string, ...string[]]>>, {
-            name: string;
-            tableName: "mfa_verifications";
-            dataType: "string enum";
-            data: "totp" | "recovery" | "passkey";
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["totp", "recovery", "passkey"] & [string, ...string[]];
-            identity: undefined;
-            generated: undefined;
-        }>;
-        verifiedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
-            name: string;
-            tableName: "mfa_verifications";
-            dataType: "object date";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-    };
-    dialect: "pg";
-}>;
-type MfaVerification = typeof mfaVerifications.$inferSelect;
-type NewMfaVerification = typeof mfaVerifications.$inferInsert;
-
+declare const AuthLoginProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">, _sinclair_typebox.TLiteral<"device">, _sinclair_typebox.TLiteral<"passkey">, ..._sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]]>;
 /**
- * @spfn/auth - Second Factor Service
- *
- * An optional second step the owner enrols, that the package then asks for at
- * the moments a stolen first credential would be used. Two forms: a TOTP
- * authenticator app, or a passkey the owner already enrolled and has marked as
- * satisfying a step-up. Ten single-use recovery codes come with either.
+ * auth.login - 로그인 성공 이벤트
  *
- * The rule the whole feature hangs on is the one in `assertStepUp`: an account
- * that never enrolled is answered exactly as it is today, on every route. That
- * is why the enrolment check comes first and returns, before any passkey
- * configuration is read and before any second query is made — an app with no
- * passkeys configured must still be able to change a password.
+ * 발행 시점:
+ * - 이메일/전화 로그인 성공 시
+ * - OAuth 기존 사용자 로그인 시
+ * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
  *
- * The step-up window is per **device key**, not per account: "this device
- * proved the second factor recently" is the claim a sensitive change needs, and
- * a verification made on a phone must not authorize a change from a laptop. A
- * key rotation carries the row across, because rotating is already proof of the
- * same device.
+ * `mfaEnrolled` is computed as the event is emitted (#95) and is the whole of
+ * the package's opinion about the second factor: it never blocks an account
+ * that has none, and this is the hook an app uses to offer enrolment at a first
+ * login. It says nothing about *which* factor and carries no secret.
  *
- * A secret and a recovery code appear in exactly three response bodies —
- * `totp/enroll`, `totp/confirm` and `recovery/regenerate` — and nowhere else:
- * not in `status`, not in an event, and not in a log line.
+ * @example
+ * ```typescript
+ * authLoginEvent.subscribe(async (payload) => {
+ *     await analytics.trackLogin(payload.userId, payload.provider);
+ *     if (!payload.mfaEnrolled) await suggestSecondFactor(payload.userId);
+ * });
+ * ```
  */
-
+declare const authLoginEvent: _spfn_core_event.EventDef<{
+    email?: string | undefined;
+    phone?: string | undefined;
+    userId: string;
+    provider: "email" | "phone" | "passkey" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "device";
+    mfaEnrolled: boolean;
+}>;
 /**
- * Does this account have a second factor at all?
+ * Where a device key was registered — the door the new device came through.
  *
- * One statement (`repositories/mfa-enrolment.repository.ts`), because every
- * sensitive route and every device registration asks it, including the
- * overwhelming majority that will answer false.
+ * Required on `RegisterPublicKeyParams` rather than optional with a default: a
+ * new *call site* for key registration must choose one, and a default would let
+ * it inherit somebody else's answer silently. `'register'` and `'signup-link'`
+ * both arrive at `createVerifiedAccount`, so the two name themselves there;
+ * `'invitation'` is the one path that stores a key without the key service.
  */
-declare function mfaEnrolledForUser(userId: number): Promise<boolean>;
-interface AssertStepUpParams {
-    userId: number;
-    /** The device key this request is signed with — the window is its window. */
-    keyId: string;
-    /** Override the configured window. Callers needing a tighter one pass it. */
-    maxAgeMs?: number;
-}
+declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"renewal">]>;
+/** The ten doors a device key is registered through. */
+type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
 /**
- * Refuse a sensitive change unless this device proved the second factor recently.
+ * auth.device.registered — a new device key was added to an account
  *
- * **No-op for an account with no second factor.** That is the contract of the
- * whole feature: `changePassword` and `revokeAllKeys` have no recency gate
- * today, and adding one for people who never opted in would be a new refusal on
- * routes that never had one. Two of the callers do have a gate of their own —
- * the passkey routes' `assertRecentAuthentication` — and they still run it
- * afterwards; this adds a rule for enrolled accounts rather than replacing one.
+ * 발행 시점:
+ * - a key row was created for an account and the transaction that created it
+ *   committed, on every one of the ten channels above
  *
- * The unenrolled path therefore costs one indexed lookup and touches no passkey
- * configuration, which is what lets an app with no passkeys at all call it.
+ * This is the notice an account owner needs and could not get before: a stolen
+ * password used to sign in on a new device was silent, because a login event
+ * says a session began and not what it began on. Rotation is deliberately not
+ * announced — replacing the key of a device that is already signed in is not a
+ * new device, and a notice for it would train the owner to ignore the ones that
+ * matter.
  *
- * @throws StepUpRequiredError when the account is enrolled and the window has passed
- */
-declare function assertStepUp(params: AssertStepUpParams): Promise<void>;
-/**
- * Carry a device's verification onto the key that replaces it.
+ * `ip` and `userAgent` are what the registering request said about itself. Both
+ * are unauthenticated display material: nothing is decided by them, and a field
+ * is absent rather than carrying a placeholder when the request resolved none.
  *
- * Called from the two rotation seams — `rotateKeyService`, and the `oldKeyId`
- * rotation every login path runs through `registerPublicKeyService`. Without
- * it the window would expire silently on every rotation, which the web proxy
- * does at each login: a user who stepped up a minute ago would be asked again
- * with nothing to connect it to.
- */
-declare function carryStepUpVerification(userId: number, fromKeyId: string, toKeyId: string): Promise<void>;
-interface TotpEnrolmentResult {
-    /** The base32 secret, shown once. Never logged, never returned again. */
-    secret: string;
-    /** The same secret as the URI an authenticator app scans. */
-    otpauthUri: string;
-}
-/**
- * Mint a secret and park it unconfirmed.
+ * Neither the full fingerprint nor the public key is carried. The prefix is
+ * enough to point at one entry of `listKeys`, which is what a notice needs.
  *
- * Calling this twice replaces the unconfirmed row and its failure counter — a
- * user who closed the app before scanning starts over, which is also the
- * documented remedy for a row that spent its five confirm attempts. A
- * **confirmed** enrolment is refused instead: replacing a working second factor
- * is `disable` followed by a fresh enrolment, both step-up gated, so nobody
- * holding only a stolen session can swap an authenticator for their own.
+ * `mfaEnrolled` is computed as the event is emitted (#95), so a notice about a
+ * new device can also be the moment an app offers a second factor to the
+ * accounts that have none.
  *
- * @throws MfaAlreadyEnrolledError when a confirmed enrolment already exists
- */
-declare function startTotpEnrolmentService(userId: number): Promise<TotpEnrolmentResult>;
-interface ConfirmTotpParams {
-    userId: number;
-    /** The device this enrolment is being confirmed from — it gets the first verification. */
-    keyId: string;
-    code: string;
-}
-interface ConfirmTotpResult {
-    /** The ten plaintext codes, shown once. */
-    recoveryCodes: string[];
-}
-/**
- * Spend the first code, which is what turns an enrolment into a second factor.
- *
- * Five wrong codes delete the unconfirmed row: at that point the person is
- * reading the wrong entry in their app, and a fresh `enroll` is both the remedy
- * and what resets the counter. A confirmed row is never deleted this way.
- *
- * The route deliberately runs this outside a transaction, so the counter
- * survives the refusal that raised it; the success path opens its own, because
- * the confirmation, the first verification and the recovery codes have to
- * commit together or not at all.
- *
- * @throws MfaNotEnrolledError | MfaVerificationFailedError
- */
-declare function confirmTotpEnrolmentService(params: ConfirmTotpParams): Promise<ConfirmTotpResult>;
-/**
- * Replace the account's recovery codes, retiring every earlier one.
- *
- * The old generation's rows stay, unspent and unreachable: a code written down
- * last year is refused with the same body as one that never existed, and the
- * record of which generation a spent code came from survives.
- *
- * @throws MfaNotEnrolledError on an account with no second factor
- */
-declare function regenerateRecoveryCodesService(userId: number): Promise<{
-    recoveryCodes: string[];
-}>;
-/**
- * Take the second factor off the account entirely.
- *
- * Idempotent: an account with nothing enrolled is a success, because "make sure
- * MFA is off" has already happened. The passkeys themselves are untouched —
- * only their second-factor marks go, since a credential that signs the owner in
- * is not something this route may remove.
- */
-declare function disableMfaService(userId: number): Promise<void>;
-interface MarkPasskeyParams {
-    userId: number;
-    passkeyId: string;
-    secondFactor: boolean;
-}
-/**
- * Mark or unmark one of the caller's passkeys as their second factor.
- *
- * Unmarking the last one is allowed, and leaves the account unenrolled. It is
- * deliberately independent of `assertNotLastRecoveryCredential`, which guards
- * `passkeys/revoke`: that rule protects a way *into* the account, and a
- * second-factor mark is not one — the credential still signs the owner in
- * afterwards, unchanged.
- *
- * @throws PasskeyNotFoundError for a credential that is not theirs, or revoked
- */
-declare function markPasskeySecondFactorService(params: MarkPasskeyParams): Promise<MfaStatus>;
-/** What the account surface shows about the second factor. No secret is in it. */
-interface MfaStatus {
-    enrolled: boolean;
-    /** Which second factors are live: `'totp'`, `'passkey'`, or both. */
-    methods: ('totp' | 'passkey')[];
-    /** Unspent codes of the current generation, for the "2 left" warning. */
-    recoveryCodesRemaining: number;
-}
-/**
- * The account's second-factor state.
- *
- * Carries no secret, no otpauth URI and no recovery code — only the counts and
- * names an account screen needs. An unconfirmed enrolment is not a method: it
- * gates nothing, so reporting it would tell the owner they are protected when
- * they are not.
- */
-declare function mfaStatusService(userId: number): Promise<MfaStatus>;
-/**
- * Options for a step-up by passkey assertion.
- *
- * `allowCredentials` is empty, as it is for a sign-in and for the same reason
- * (D3): the discoverable credential on the device names itself, and the owner
- * and the second-factor mark are checked when the assertion comes back. The
- * challenge is minted with kind `'mfa'` and this account's id, so it cannot be
- * presented to `passkeys/login/verify` and a sign-in challenge cannot be
- * presented here.
- */
-declare function startStepUpService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
-interface StepUpParams {
-    userId: number;
-    /** The device the verification is recorded against. */
-    keyId: string;
-    code?: string;
-    recoveryCode?: string;
-    response?: AuthenticationResponseJSON;
-}
-/**
- * Re-prove the second factor on this device, refreshing its window.
- *
- * The escape hatch the exempt registration channels need: a device-code
- * approval and a passkey sign-in register a key with no verification against
- * it, by design, so the session they create would otherwise fail every
- * sensitive change with no way forward.
- *
- * @throws ValidationError when the body names none or more than one input
- * @throws MfaNotEnrolledError | MfaVerificationFailedError
- */
-declare function stepUpService(params: StepUpParams): Promise<void>;
-/**
- * Check exactly one of the three proofs, and say which one it was.
- *
- * Exactly one: two inputs in a body is a caller trying combinations, and none
- * is a malformed request. Neither is a failed verification, so both are a 400
- * rather than the uniform 401 a wrong proof gets.
- *
- * @throws ValidationError | MfaVerificationFailedError
- */
-declare function verifySecondFactor(params: StepUpParams): Promise<MfaVerificationMethod>;
-/**
- * Drop enrolments nobody ever confirmed.
- *
- * A secret handed out and abandoned is a credential sitting in a table doing
- * nothing; a day is long enough for anyone who meant to finish.
- *
- * @returns number of rows deleted
- */
-declare function sweepUnconfirmedMfaService(): Promise<{
-    deleted: number;
-}>;
-
-/**
- * Auth provider type
- *
- * 직접 인증(email/phone) + 등록 가능한 모든 소셜 provider(SOCIAL_PROVIDERS).
- */
-declare const AuthProviderSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"email">, _sinclair_typebox.TLiteral<"phone">, ..._sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]]>;
-/**
- * auth.login - 로그인 성공 이벤트
- *
- * 발행 시점:
- * - 이메일/전화 로그인 성공 시
- * - OAuth 기존 사용자 로그인 시
- * - 기기 코드 승인이 소비되어 새 기기 키가 등록될 때 (provider: 'device')
- *
- * `mfaEnrolled` is computed as the event is emitted (#95) and is the whole of
- * the package's opinion about the second factor: it never blocks an account
- * that has none, and this is the hook an app uses to offer enrolment at a first
- * login. It says nothing about *which* factor and carries no secret.
- *
- * @example
- * ```typescript
- * authLoginEvent.subscribe(async (payload) => {
- *     await analytics.trackLogin(payload.userId, payload.provider);
- *     if (!payload.mfaEnrolled) await suggestSecondFactor(payload.userId);
- * });
- * ```
- */
-declare const authLoginEvent: _spfn_core_event.EventDef<{
-    email?: string | undefined;
-    phone?: string | undefined;
-    userId: string;
-    provider: "email" | "phone" | "google" | "apple" | "github" | "kakao" | "naver" | "superself" | "passkey" | "device";
-    mfaEnrolled: boolean;
-}>;
-/**
- * Where a device key was registered — the door the new device came through.
- *
- * Required on `RegisterPublicKeyParams` rather than optional with a default: a
- * new *call site* for key registration must choose one, and a default would let
- * it inherit somebody else's answer silently. `'register'` and `'signup-link'`
- * both arrive at `createVerifiedAccount`, so the two name themselves there;
- * `'invitation'` is the one path that stores a key without the key service.
- */
-declare const DeviceRegistrationChannelSchema: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"register">, _sinclair_typebox.TLiteral<"signup-link">, _sinclair_typebox.TLiteral<"invitation">, _sinclair_typebox.TLiteral<"password">, _sinclair_typebox.TLiteral<"oauth">, _sinclair_typebox.TLiteral<"oauth-native">, _sinclair_typebox.TLiteral<"device-code">, _sinclair_typebox.TLiteral<"password-reset">, _sinclair_typebox.TLiteral<"passkey">]>;
-/** The nine doors a device key is registered through. */
-type DeviceRegistrationChannel = Static<typeof DeviceRegistrationChannelSchema>;
-/**
- * auth.device.registered — a new device key was added to an account
- *
- * 발행 시점:
- * - a key row was created for an account and the transaction that created it
- *   committed, on every one of the nine channels above
- *
- * This is the notice an account owner needs and could not get before: a stolen
- * password used to sign in on a new device was silent, because a login event
- * says a session began and not what it began on. Rotation is deliberately not
- * announced — replacing the key of a device that is already signed in is not a
- * new device, and a notice for it would train the owner to ignore the ones that
- * matter.
- *
- * `ip` and `userAgent` are what the registering request said about itself. Both
- * are unauthenticated display material: nothing is decided by them, and a field
- * is absent rather than carrying a placeholder when the request resolved none.
- *
- * Neither the full fingerprint nor the public key is carried. The prefix is
- * enough to point at one entry of `listKeys`, which is what a notice needs.
- *
- * `mfaEnrolled` is computed as the event is emitted (#95), so a notice about a
- * new device can also be the moment an app offers a second factor to the
- * accounts that have none.
- *
- * @example
- * ```typescript
- * authDeviceRegisteredEvent.subscribe(async ({ userId, deviceName, ip, channel }) => {
- *     await notifyOwner(userId, `A new device signed in (${deviceName ?? channel})`);
- * });
- * ```
+ * @example
+ * ```typescript
+ * authDeviceRegisteredEvent.subscribe(async ({ userId, deviceName, ip, channel }) => {
+ *     await notifyOwner(userId, `A new device signed in (${deviceName ?? channel})`);
+ * });
+ * ```
  */
 declare const authDeviceRegisteredEvent: _spfn_core_event.EventDef<{
     deviceName?: string | undefined;
@@ -1489,10 +1291,10 @@ declare const authDeviceRegisteredEvent: _spfn_core_event.EventDef<{
     keyId: string;
     algorithm: string;
     userId: string;
+    mfaEnrolled: boolean;
     fingerprintPrefix: string;
     createdAtMillis: number;
-    mfaEnrolled: boolean;
-    channel: "password" | "register" | "oauth-native" | "passkey" | "oauth" | "invitation" | "signup-link" | "password-reset" | "device-code";
+    channel: "password" | "register" | "passkey" | "oauth-native" | "renewal" | "signup-link" | "invitation" | "oauth" | "device-code" | "password-reset";
 }>;
 /**
  * auth.register - 회원가입 성공 이벤트
@@ -1674,58 +1476,760 @@ type AuthDeletionCompletedPayload = typeof authDeletionCompletedEvent._payload;
 type OAuthUnlinkedPayload = typeof oauthUnlinkedEvent._payload;
 
 /**
- * @spfn/auth - Key Service
+ * The four doors a second factor is asked for at.
+ *
+ * A subset of `DeviceRegistrationChannel`, and the subset is the decision: these
+ * are the four where a stolen first credential — a password, a social account, a
+ * mailbox — is enough to reach a new device on its own. `device-code` and
+ * `passkey` are exempt because each already carried a second proof, and
+ * `register`, `signup-link`, `invitation` and `renewal` cannot apply (a
+ * brand-new account has nothing enrolled, and a renewal replaces a key on a
+ * device that is already signed in).
+ */
+declare const MFA_CHALLENGE_CHANNELS: readonly ["password", "oauth", "oauth-native", "password-reset"];
+type MfaChallengeChannel = typeof MFA_CHALLENGE_CHANNELS[number];
+/** How many wrong proofs a challenge survives before it is spent for good. */
+declare const MFA_CHALLENGE_ATTEMPT_LIMIT = 5;
+/**
+ * The `authLoginEvent` payload this registration would have emitted.
  *
- * Handles public key registration, rotation, and revocation
+ * Carried rather than recomputed because it cannot be recomputed: the app's own
+ * `metadata` reached the sign-in in a sealed OAuth state or a request body that
+ * is gone by the time `verify` runs, and the provider is the social provider on
+ * the OAuth channels rather than anything the user row says. Null on
+ * `password-reset`, which announces a reset and never a login.
+ *
+ * `mfaEnrolled` is not stored: the account is enrolled by construction — that is
+ * why there is a challenge — and re-reading it at verify keeps the payload
+ * honest if the second factor went away in between.
  */
-
-interface RegisterPublicKeyParams {
-    userId: number;
-    keyId: string;
-    publicKey: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    /** Device label for the key list. Display only — nothing is authorized by it. */
-    deviceName?: string;
-    platform?: KeyPlatformType;
-    /**
-     * Which door this device came through. Required, so that a registration path
-     * added later has to say what it is rather than inherit an answer.
-     */
-    channel: DeviceRegistrationChannel;
-    /** Client address of the registering request, absent when none resolved. */
-    ip?: string;
-    /** `user-agent` of the registering request, already truncated. */
-    userAgent?: string;
-    /**
-     * The key this one replaces on the same device, when a revocation actually
-     * happened. Its presence is what makes this a rotation rather than a new
-     * device, so no event is announced for it.
-     *
-     * Only ever set from a `revokeKeyService` that returned true: an `oldKeyId`
-     * naming somebody else's key, an already-revoked key or nothing at all
-     * revokes nothing, and treating that as a rotation would be a way to
-     * register a device with the owner's notice switched off.
-     */
-    replacesKeyId?: string;
-}
-interface RotateKeyParams {
-    userId: number;
-    oldKeyId: string;
-    newKeyId: string;
-    newPublicKey: string;
-    fingerprint: string;
-    algorithm?: KeyAlgorithmType;
-    /** Omitted: the replaced key's label carries over, so rotation keeps its name. */
-    deviceName?: string;
-    platform?: KeyPlatformType;
-}
-interface RotateKeyResult {
-    success: boolean;
-    keyId: string;
+interface DeferredLoginEvent {
+    provider: AuthLoginProvider;
+    email?: string;
+    phone?: string;
+    metadata?: Record<string, unknown>;
 }
-interface RevokeKeyParams {
-    userId: number;
+declare const mfaChallenges: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_challenges";
+    schema: string;
+    columns: {
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        updatedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.PgTimestampBuilder>>>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        id: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        challengeHash: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        channel: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["password", "oauth", "oauth-native", "password-reset"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "string enum";
+            data: "password" | "oauth-native" | "oauth" | "password-reset";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["password", "oauth", "oauth-native", "password-reset"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        keyEpoch: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        attempts: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgIntegerBuilder>>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "number int32";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        verifiedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        loginEvent: drizzle_orm_pg_core.PgBuildColumn<"mfa_challenges", drizzle_orm_pg_core.Set$Type<drizzle_orm_pg_core.PgJsonbBuilder, DeferredLoginEvent>, {
+            name: string;
+            tableName: "mfa_challenges";
+            dataType: "object json";
+            data: DeferredLoginEvent;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type MfaChallenge = typeof mfaChallenges.$inferSelect;
+type NewMfaChallenge = typeof mfaChallenges.$inferInsert;
+
+/**
+ * @spfn/auth - Second-Factor Verification Entity
+ *
+ * When each device last proved the account's second factor. One row per device
+ * key, which is what makes the step-up window mean "this device, recently"
+ * rather than "somebody, somewhere, recently".
+ *
+ * `key_id` is the primary key and a foreign key onto `user_public_keys.key_id`,
+ * so the row dies with the device it belongs to — a revoked key cannot leave a
+ * verification behind for the next key that reuses its id, and deleting an
+ * account takes these with it. A rotation is the one moment the row moves
+ * rather than dying: rotating is already proof of the same device, so
+ * `rotateKeyService` and the login rotation carry the verification across, or
+ * the window would silently expire every time the proxy rotated a key.
+ */
+/**
+ * Which credential satisfied the step-up.
+ *
+ * Recorded for the owner-facing audit an app may build on it, and for support:
+ * "recovery" is the one that should be rare, and an account stepping up with
+ * recovery codes repeatedly has lost its authenticator.
+ */
+declare const MFA_VERIFICATION_METHODS: readonly ["totp", "recovery", "passkey"];
+type MfaVerificationMethod = typeof MFA_VERIFICATION_METHODS[number];
+declare const mfaVerifications: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "mfa_verifications";
+    schema: string;
+    columns: {
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        method: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["totp", "recovery", "passkey"] & [string, ...string[]]>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "string enum";
+            data: "passkey" | "totp" | "recovery";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["totp", "recovery", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        verifiedAt: drizzle_orm_pg_core.PgBuildColumn<"mfa_verifications", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
+            name: string;
+            tableName: "mfa_verifications";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+    };
+    dialect: "pg";
+}>;
+type MfaVerification = typeof mfaVerifications.$inferSelect;
+type NewMfaVerification = typeof mfaVerifications.$inferInsert;
+
+/**
+ * @spfn/auth - Second Factor Service
+ *
+ * An optional second step the owner enrols, that the package then asks for at
+ * the moments a stolen first credential would be used. Two forms: a TOTP
+ * authenticator app, or a passkey the owner already enrolled and has marked as
+ * satisfying a step-up. Ten single-use recovery codes come with either.
+ *
+ * The rule the whole feature hangs on is the one in `assertStepUp`: an account
+ * that never enrolled is answered exactly as it is today, on every route. That
+ * is why the enrolment check comes first and returns, before any passkey
+ * configuration is read and before any second query is made — an app with no
+ * passkeys configured must still be able to change a password.
+ *
+ * The step-up window is per **device key**, not per account: "this device
+ * proved the second factor recently" is the claim a sensitive change needs, and
+ * a verification made on a phone must not authorize a change from a laptop. A
+ * key rotation carries the row across, because rotating is already proof of the
+ * same device.
+ *
+ * A secret and a recovery code appear in exactly three response bodies —
+ * `totp/enroll`, `totp/confirm` and `recovery/regenerate` — and nowhere else:
+ * not in `status`, not in an event, and not in a log line.
+ */
+
+/**
+ * Does this account have a second factor at all?
+ *
+ * One statement (`repositories/mfa-enrolment.repository.ts`), because every
+ * sensitive route and every device registration asks it, including the
+ * overwhelming majority that will answer false.
+ */
+declare function mfaEnrolledForUser(userId: number): Promise<boolean>;
+interface AssertStepUpParams {
+    userId: number;
+    /** The device key this request is signed with — the window is its window. */
+    keyId: string;
+    /** Override the configured window. Callers needing a tighter one pass it. */
+    maxAgeMs?: number;
+}
+/**
+ * Refuse a sensitive change unless this device proved the second factor recently.
+ *
+ * **No-op for an account with no second factor.** That is the contract of the
+ * whole feature: `changePassword` and `revokeAllKeys` have no recency gate
+ * today, and adding one for people who never opted in would be a new refusal on
+ * routes that never had one. Two of the callers do have a gate of their own —
+ * the passkey routes' `assertRecentAuthentication` — and they still run it
+ * afterwards; this adds a rule for enrolled accounts rather than replacing one.
+ *
+ * The unenrolled path therefore costs one indexed lookup and touches no passkey
+ * configuration, which is what lets an app with no passkeys at all call it.
+ *
+ * @throws StepUpRequiredError when the account is enrolled and the window has passed
+ */
+declare function assertStepUp(params: AssertStepUpParams): Promise<void>;
+/**
+ * Carry a device's verification onto the key that replaces it.
+ *
+ * Called from the two rotation seams — `rotateKeyService`, and the `oldKeyId`
+ * rotation every login path runs through `registerPublicKeyService`. Without
+ * it the window would expire silently on every rotation, which the web proxy
+ * does at each login: a user who stepped up a minute ago would be asked again
+ * with nothing to connect it to.
+ */
+declare function carryStepUpVerification(userId: number, fromKeyId: string, toKeyId: string): Promise<void>;
+interface OpenStepUpChallengeParams {
+    userId: number;
+    /** The inactive key this challenge would activate. */
+    keyId: string;
+    channel: MfaChallengeChannel;
+    /** The account's key generation right now — the challenge dies with it. */
+    keyEpoch: number;
+    /** The login announcement the 202 is holding back, when the channel has one. */
+    loginEvent?: DeferredLoginEvent;
+}
+/**
+ * Mint the challenge a stopped registration hands back.
+ *
+ * The secret is returned once and never stored: only its hash reaches the row,
+ * so a database dump does not yield a spendable challenge, and `verify` finds a
+ * row only for a caller who already had the secret. The row id is not in the
+ * answer at all — it is a sequence, and a sequence on an unauthenticated route
+ * is a thing an attacker walks.
+ */
+declare function openStepUpChallengeService(params: OpenStepUpChallengeParams): Promise<MfaChallengeHandle>;
+/**
+ * The challenge already outstanding for this key, re-secreted, or null.
+ *
+ * Registering the same keyId twice is an ordinary path, not a collision: a
+ * native client reuses its keyId, and an OAuth state replayed from the back
+ * button carries the one it was sealed with. Answering 409 there would refuse a
+ * caller for holding a key that is their own and is waiting on them.
+ *
+ * The row is reused rather than replaced, so the retry inherits the attempts
+ * already spent and the expiry already ticking — retrying is not a way around
+ * either. Only the secret is new, because the first one exists nowhere: the row
+ * holds its hash, and that is the property that keeps a database dump from
+ * yielding a spendable challenge.
+ */
+declare function resumeStepUpChallengeService(userId: number, keyId: string): Promise<MfaChallengeHandle | null>;
+interface VerifyMfaChallengeParams {
+    /** The secret from the 202 body, the callback query, or the pending page. */
+    challenge: string;
+    code?: string;
+    recoveryCode?: string;
+    response?: AuthenticationResponseJSON;
+}
+/**
+ * The sign-in the challenge was standing in for, plus what the proxy needs.
+ *
+ * `keyId` and `challengeHash` are for the Next.js interceptor and nothing else:
+ * it seals a session only when both match the pending cookie it baked at the
+ * 202, which is what stops a cookie minted for one flow from sealing a session
+ * around another flow's key. Neither is a credential — the hash is what the
+ * server already stores, and the key is inactive to anyone without the private
+ * half the proxy is holding.
+ */
+interface VerifyMfaChallengeResult extends LoginResult {
+    keyId: string;
+    challengeHash: string;
+}
+/**
+ * Spend a new-device challenge, which activates the key and starts the session.
+ *
+ * Unauthenticated by construction: the key this would activate is the only one
+ * the caller has and it cannot sign anything yet. The challenge secret is the
+ * whole credential, and it authorizes exactly this — no other route reads it.
+ *
+ * The verified mark is a conditional UPDATE, so two requests carrying the same
+ * secret produce one session and one 401. The key is activated only after that
+ * mark is won, which is what makes "a pending challenge never yields a usable
+ * key" true even under a race.
+ *
+ * The binding the answer carries was decided at **registration**, not here, and
+ * is read back off the key row. It has to be: the decision reads the owner's
+ * `session_binding` setting together with whether the request came through the
+ * trusted Next.js proxy, and this route is unauthenticated and may be called
+ * from anywhere — deciding it here would let a direct caller ask for a cookie
+ * that believes a bound key is an ordinary one. A bound account that steps up
+ * therefore gets exactly the binding and the expiry its sign-in registered, and
+ * the ten minutes a challenge may sit for come out of that key's short life.
+ *
+ * @throws ValidationError when the body names none or more than one proof
+ * @throws MfaVerificationFailedError for every other refusal, in one body
+ */
+declare function verifyMfaChallengeService(params: VerifyMfaChallengeParams): Promise<VerifyMfaChallengeResult>;
+/**
+ * Options for finishing a new-device step-up with a passkey.
+ *
+ * The step-up challenge stands in for the session this caller does not have yet:
+ * it is what names the account, so the WebAuthn challenge can be minted for the
+ * right owner without the request having to say who that is. `allowCredentials`
+ * is empty for the reason it is everywhere else here (D3), and the ceremony kind
+ * is `'mfa'`, so what comes back cannot be spent as a sign-in.
+ *
+ * @throws MfaVerificationFailedError when the challenge cannot be spent
+ */
+declare function startMfaChallengeAssertionService(challenge: string): Promise<PublicKeyCredentialRequestOptionsJSON>;
+/**
+ * Drop expired and spent challenges, and the keys they were holding.
+ *
+ * A pending key is unusable by construction, but it is still a key row on an
+ * account nobody is watching, and its challenge is what the owner would be shown
+ * if anything ever listed it. Both go once the challenge can no longer do
+ * anything. A spent one is kept for the same span as an expired one, so a replay
+ * inside the window is answered "already verified" from a row rather than
+ * "unknown" from an absence — the same 401 either way, but the record survives
+ * long enough to be read in a log.
+ *
+ * @returns number of challenge rows deleted
+ */
+declare function sweepMfaChallengesService(): Promise<{
+    deleted: number;
+}>;
+interface TotpEnrolmentResult {
+    /** The base32 secret, shown once. Never logged, never returned again. */
+    secret: string;
+    /** The same secret as the URI an authenticator app scans. */
+    otpauthUri: string;
+}
+/**
+ * Mint a secret and park it unconfirmed.
+ *
+ * Calling this twice replaces the unconfirmed row and its failure counter — a
+ * user who closed the app before scanning starts over, which is also the
+ * documented remedy for a row that spent its five confirm attempts. A
+ * **confirmed** enrolment is refused instead: replacing a working second factor
+ * is `disable` followed by a fresh enrolment, both step-up gated, so nobody
+ * holding only a stolen session can swap an authenticator for their own.
+ *
+ * @throws MfaAlreadyEnrolledError when a confirmed enrolment already exists
+ */
+declare function startTotpEnrolmentService(userId: number): Promise<TotpEnrolmentResult>;
+interface ConfirmTotpParams {
+    userId: number;
+    /** The device this enrolment is being confirmed from — it gets the first verification. */
+    keyId: string;
+    code: string;
+}
+interface ConfirmTotpResult {
+    /** The ten plaintext codes, shown once. */
+    recoveryCodes: string[];
+}
+/**
+ * Spend the first code, which is what turns an enrolment into a second factor.
+ *
+ * Five wrong codes delete the unconfirmed row: at that point the person is
+ * reading the wrong entry in their app, and a fresh `enroll` is both the remedy
+ * and what resets the counter. A confirmed row is never deleted this way.
+ *
+ * The route deliberately runs this outside a transaction, so the counter
+ * survives the refusal that raised it; the success path opens its own, because
+ * the confirmation, the first verification and the recovery codes have to
+ * commit together or not at all.
+ *
+ * @throws MfaNotEnrolledError | MfaVerificationFailedError
+ */
+declare function confirmTotpEnrolmentService(params: ConfirmTotpParams): Promise<ConfirmTotpResult>;
+/**
+ * Replace the account's recovery codes, retiring every earlier one.
+ *
+ * The old generation's rows stay, unspent and unreachable: a code written down
+ * last year is refused with the same body as one that never existed, and the
+ * record of which generation a spent code came from survives.
+ *
+ * @throws MfaNotEnrolledError on an account with no second factor
+ */
+declare function regenerateRecoveryCodesService(userId: number): Promise<{
+    recoveryCodes: string[];
+}>;
+/**
+ * Take the second factor off the account entirely.
+ *
+ * Idempotent: an account with nothing enrolled is a success, because "make sure
+ * MFA is off" has already happened. The passkeys themselves are untouched —
+ * only their second-factor marks go, since a credential that signs the owner in
+ * is not something this route may remove.
+ */
+declare function disableMfaService(userId: number): Promise<void>;
+interface MarkPasskeyParams {
+    userId: number;
+    passkeyId: string;
+    secondFactor: boolean;
+}
+/**
+ * Mark or unmark one of the caller's passkeys as their second factor.
+ *
+ * Unmarking the last one is allowed, and leaves the account unenrolled. It is
+ * deliberately independent of `assertNotLastRecoveryCredential`, which guards
+ * `passkeys/revoke`: that rule protects a way *into* the account, and a
+ * second-factor mark is not one — the credential still signs the owner in
+ * afterwards, unchanged.
+ *
+ * @throws PasskeyNotFoundError for a credential that is not theirs, or revoked
+ */
+declare function markPasskeySecondFactorService(params: MarkPasskeyParams): Promise<MfaStatus>;
+/** What the account surface shows about the second factor. No secret is in it. */
+interface MfaStatus {
+    enrolled: boolean;
+    /** Which second factors are live: `'totp'`, `'passkey'`, or both. */
+    methods: ('totp' | 'passkey')[];
+    /** Unspent codes of the current generation, for the "2 left" warning. */
+    recoveryCodesRemaining: number;
+}
+/**
+ * The account's second-factor state.
+ *
+ * Carries no secret, no otpauth URI and no recovery code — only the counts and
+ * names an account screen needs. An unconfirmed enrolment is not a method: it
+ * gates nothing, so reporting it would tell the owner they are protected when
+ * they are not.
+ */
+declare function mfaStatusService(userId: number): Promise<MfaStatus>;
+/**
+ * Options for a step-up by passkey assertion.
+ *
+ * `allowCredentials` is empty, as it is for a sign-in and for the same reason
+ * (D3): the discoverable credential on the device names itself, and the owner
+ * and the second-factor mark are checked when the assertion comes back. The
+ * challenge is minted with kind `'mfa'` and this account's id, so it cannot be
+ * presented to `passkeys/login/verify` and a sign-in challenge cannot be
+ * presented here.
+ */
+declare function startStepUpService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
+interface StepUpParams {
+    userId: number;
+    /** The device the verification is recorded against. */
+    keyId: string;
+    code?: string;
+    recoveryCode?: string;
+    response?: AuthenticationResponseJSON;
+}
+/**
+ * Re-prove the second factor on this device, refreshing its window.
+ *
+ * The escape hatch the exempt registration channels need: a device-code
+ * approval and a passkey sign-in register a key with no verification against
+ * it, by design, so the session they create would otherwise fail every
+ * sensitive change with no way forward.
+ *
+ * @throws ValidationError when the body names none or more than one input
+ * @throws MfaNotEnrolledError | MfaVerificationFailedError
+ */
+declare function stepUpService(params: StepUpParams): Promise<void>;
+/**
+ * Check exactly one of the three proofs, and say which one it was — or null.
+ *
+ * Exactly one: two inputs in a body is a caller trying combinations, and none
+ * is a malformed request. Neither is a failed verification, so both are a 400
+ * rather than the uniform 401 a wrong proof gets.
+ *
+ * Null rather than a throw for the failure itself, because one caller has
+ * bookkeeping to do before it refuses: the new-device challenge counts the
+ * attempt, and counting it inside a `catch` around the thing that threw would be
+ * two control flows for one answer.
+ *
+ * @throws ValidationError when the body names none or more than one input
+ */
+declare function attemptSecondFactor(params: StepUpParams): Promise<MfaVerificationMethod | null>;
+/**
+ * `attemptSecondFactor`, for the callers whose only answer to a wrong proof is
+ * the uniform 401.
+ *
+ * @throws ValidationError | MfaVerificationFailedError
+ */
+declare function verifySecondFactor(params: StepUpParams): Promise<MfaVerificationMethod>;
+/**
+ * Drop enrolments nobody ever confirmed.
+ *
+ * A secret handed out and abandoned is a credential sitting in a table doing
+ * nothing; a day is long enough for anyone who meant to finish.
+ *
+ * @returns number of rows deleted
+ */
+declare function sweepUnconfirmedMfaService(): Promise<{
+    deleted: number;
+}>;
+
+/**
+ * @spfn/auth - Key Service
+ *
+ * Handles public key registration, rotation, and revocation
+ */
+
+interface RegisterPublicKeyParams {
+    userId: number;
+    keyId: string;
+    publicKey: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    /** Device label for the key list. Display only — nothing is authorized by it. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    /**
+     * Which door this device came through. Required, so that a registration path
+     * added later has to say what it is rather than inherit an answer.
+     */
+    channel: DeviceRegistrationChannel;
+    /** Client address of the registering request, absent when none resolved. */
+    ip?: string;
+    /** `user-agent` of the registering request, already truncated. */
+    userAgent?: string;
+    /**
+     * Whether this key is bound to a passkey, as the registering path decided.
+     *
+     * Decided by the caller from two facts it is the only one holding: the
+     * owner's `session_binding` setting, and whether `proxy-guard` recognised the
+     * request as coming through the trusted Next.js proxy (`decideKeyBinding`).
+     * Never read off a request body, and `platform` is not consulted — that field
+     * is display-only, usually absent on a proxy-made key, and a native client
+     * may declare `'web'` freely. Omitted means `'none'`, which is what every
+     * path that has no opinion gets.
+     */
+    binding?: SessionBindingType;
+    /**
+     * The key this one replaces on the same device, when a revocation actually
+     * happened. Its presence is what makes this a rotation rather than a new
+     * device, so no event is announced for it.
+     *
+     * Only ever set from a `revokeKeyService` that returned true: an `oldKeyId`
+     * naming somebody else's key, an already-revoked key or nothing at all
+     * revokes nothing, and treating that as a rotation would be a way to
+     * register a device with the owner's notice switched off.
+     */
+    replacesKeyId?: string;
+    /**
+     * What to announce if this registration is stopped and later verified (#95).
+     *
+     * Read only on a channel that can step up, and only when it does. The login
+     * event has to fire once and with the original channel's payload, and the
+     * app's own `metadata` and the social provider that carried it are gone by
+     * the time `POST /_auth/mfa/verify` runs — so the announcement rides the
+     * challenge row rather than being guessed at from the user row.
+     */
+    loginEvent?: DeferredLoginEvent;
+}
+/**
+ * What a registration settled on: a key, or a second factor still to prove.
+ *
+ * The `pending` branch is the 202 (#95). Its callers answer it to the client and
+ * stop — no session, no event, no `lastLoginAt` — and everything they would have
+ * done happens at `verify` instead.
+ */
+type RegisterPublicKeyResult = ({
+    pending: false;
+} & RegisteredKeyBinding) | {
+    pending: true;
+    challenge: MfaChallengeHandle;
+};
+/**
+ * The binding half of a registration that could not have been stepped up.
+ *
+ * Only four channels can answer `pending`, so a caller on any other one is
+ * reading a case its channel cannot reach. Throwing rather than defaulting is
+ * the honest answer if that ever stops being true: a silent `{}` would seal an
+ * unbound session for a key nobody had proved, which is the one outcome this
+ * whole feature exists to prevent.
+ */
+declare function registeredBinding(result: RegisterPublicKeyResult): RegisteredKeyBinding;
+interface RotateKeyParams {
+    userId: number;
+    oldKeyId: string;
+    newKeyId: string;
+    newPublicKey: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    /** Omitted: the replaced key's label carries over, so rotation keeps its name. */
+    deviceName?: string;
+    platform?: KeyPlatformType;
+}
+interface RotateKeyResult {
+    success: boolean;
+    keyId: string;
+}
+interface RevokeKeyParams {
+    userId: number;
     keyId: string;
     reason: string;
 }
@@ -1785,6 +2289,28 @@ interface KeySummary {
     registeredIp?: string;
     /** `user-agent` of the registering request, on the same terms as above. */
     registeredUserAgent?: string;
+    /**
+     * `'passkey'` when this key is bound to one, absent when it is not.
+     *
+     * Absent rather than `'none'`, so a deployment where nobody opted in answers
+     * exactly the list it always did, and so every consumer reads "unbound" the
+     * same way it reads it off a sign-in response.
+     */
+    binding?: SessionBindingType;
+    /**
+     * When this key was last seen from two client addresses inside the
+     * concurrent-use window, absent when that has never been observed.
+     *
+     * A signal for the owner, not a refusal: addresses change legitimately, so
+     * nothing is blocked by it and a device list that shows it is telling someone
+     * to look rather than telling them something happened. The addresses
+     * themselves are never returned.
+     *
+     * Only meaningful where proxy-guard is configured. Without it every web
+     * request carries the Next.js server's own address, so two browsers on two
+     * continents share one and this never fires.
+     */
+    concurrentUseAtMillis?: number;
 }
 interface ListKeysParams {
     userId: number;
@@ -1793,6 +2319,20 @@ interface ListKeysParams {
 }
 /** How much of the fingerprint the list returns. */
 declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
+/**
+ * What a registration settled on, for the caller that has to tell the browser.
+ *
+ * The sign-in paths put these two into their `LoginResult`, the Next.js proxy
+ * copies them into the sealed cookie, and that is the whole carrier by which the
+ * proxy learns a session is bound and when its key runs out. Returned rather than
+ * looked up again: the row was just written (or just read), so a second query
+ * would be a second answer to a question already settled.
+ */
+interface RegisteredKeyBinding {
+    binding: SessionBindingType;
+    /** null only for a key registered before expiry was stamped at all. */
+    expiresAt: Date | null;
+}
 /**
  * Register a new public key for a user
  *
@@ -1801,11 +2341,16 @@ declare const KEY_FINGERPRINT_PREFIX_LENGTH = 8;
  * index, rolling the whole login transaction back into a 500. Reuse is refused
  * with a domain error instead, telling the client to generate a fresh keyId.
  *
+ * An enrolled account arriving on a new device gets the key written **inactive**
+ * and a challenge back (#95). Nothing else happens: no device event, no login
+ * event, no `lastLoginAt` — those are what the challenge is holding, and they
+ * fire at `POST /_auth/mfa/verify` or not at all.
+ *
  * @throws KeyIdAlreadyRegisteredError keyId가 이미 쓰인 값일 때 (자기 폐기 키 재사용 · 남의 키)
  * @throws InvalidKeyFingerprintError fingerprint가 publicKey와 맞지 않을 때
  * @throws KeyAlgorithmMismatchError 키의 SPKI 타입이 선언된 algorithm과 다를 때
  */
-declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<void>;
+declare function registerPublicKeyService(params: RegisterPublicKeyParams): Promise<RegisterPublicKeyResult>;
 /**
  * Rotate user's public key (revoke old, register new)
  *
@@ -2163,12 +2708,23 @@ interface OAuthCallbackParams {
     ip?: string;
     /** `user-agent` of the callback request, already truncated at the route. */
     userAgent?: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy, from the same helper. */
+    webProxy?: boolean;
 }
 interface OAuthCallbackResult {
     redirectUrl: string;
     userId: string;
     keyId: string;
     isNewUser: boolean;
+    /**
+     * The step-up challenge this callback is carrying, when it is carrying one.
+     *
+     * Present exactly when the redirect names `mfaChallenge` instead of
+     * `userId`/`keyId` (#95). Returned beside the URL so a caller that does not
+     * parse the query — a test, or an app mounting its own handler — can tell
+     * the two redirects apart.
+     */
+    mfaChallenge?: string;
 }
 /**
  * registry에서 provider를 찾아 사용 가능한지 검증 후 반환
@@ -2264,16 +2820,35 @@ interface OAuthNativeParams {
     ip?: string;
     /** `user-agent` of the request, already truncated at the route. */
     userAgent?: string;
+    /**
+     * Whether proxy-guard recognised the trusted Next.js proxy, from the same
+     * helper. Accepted because every registering route spreads the whole
+     * provenance, and read by nothing: a native sign-in never produces a bound
+     * key — see the note at the registration below.
+     */
+    webProxy?: boolean;
     /** Apple은 첫 로그인에만 이름을 별도로 주므로 클라이언트가 전달할 수 있다. */
     profile?: {
         name?: string;
     };
     metadata?: Record<string, unknown>;
 }
+/**
+ * What a native social sign-in answers with.
+ *
+ * Shaped like `LoginResult` and for the same reason (#95): this channel steps up
+ * too, so the answer is one type carrying a required discriminant and optional
+ * fields rather than a union the typed client and the mobile contract could not
+ * both express. Narrow on `mfaRequired` before reading `userId`.
+ */
 interface OAuthNativeResult {
-    userId: string;
-    keyId: string;
-    isNewUser: boolean;
+    /** true means no key was activated: verify the challenge below first. */
+    mfaRequired: boolean;
+    /** Present exactly when `mfaRequired` is true. */
+    challenge?: MfaChallengeHandle;
+    userId?: string;
+    keyId?: string;
+    isNewUser?: boolean;
 }
 /**
  * native id_token 로그인 처리
@@ -2415,6 +2990,219 @@ declare function revokeOAuth2GrantService(id: number, userId: number): Promise<v
  */
 declare function revokeAllOAuth2GrantsForUser(userId: number): Promise<void>;
 
+/**
+ * @spfn/auth - Session Binding Service
+ *
+ * The opt-in from #97: an account says its web sessions should run on a key that
+ * expires in hours and can only be renewed by a fresh WebAuthn assertion. A
+ * session cookie copied off that machine — out of a browser profile, out of
+ * DevTools, by malware — still signs like the original until that key runs out,
+ * and then stops, because the copy cannot produce the assertion.
+ *
+ * Three rules shape this file.
+ *
+ * It can only be turned on where the backend can recognise the trusted Next.js
+ * proxy. `clientType` is that recognition and `proxy-guard` is what sets it;
+ * without it every key would be registered unbound and the setting would be a
+ * switch that reports success and protects nothing, so the request is refused as
+ * the configuration error it is.
+ *
+ * Turning it *off* is the privileged direction, which is the reverse of the
+ * usual posture. `assertRecentAuthentication` is satisfied by the age of the
+ * device key this request is signed with — and a cookie copied in the ten
+ * minutes after a sign-in carries exactly that. So leaving `'passkey'` asks for
+ * a credential the copy does not hold: a renewal-grade assertion, or the account
+ * password.
+ *
+ * Enabling twice is idempotent. Recomputing the expiry on a repeat call would
+ * make this route a way to extend a bound key without presenting anything, which
+ * is the thing the short life exists to prevent.
+ */
+
+/** What every one of the three reads and writes here answers with. */
+interface SessionBindingResult {
+    mode: SessionBindingType;
+    /**
+     * When the key this request is signed with expires, for a bound session.
+     *
+     * Absent when the account is unbound, and absent for a bound account asking
+     * from a key that is not itself bound — a native client, say, whose key was
+     * registered on a channel the proxy never touched. The response is the input
+     * the Next.js interceptor re-seals the cookie from, so it describes this
+     * session rather than the account.
+     */
+    keyExpiresAtMillis?: number;
+}
+interface SessionBindingParams {
+    userId: number;
+    /** The device key this request is signed with — the one binding is applied to. */
+    keyId: string;
+    /** Whether proxy-guard recognised the trusted Next.js proxy. */
+    webProxy?: boolean;
+}
+interface DisableSessionBindingParams extends SessionBindingParams {
+    /** A renewal-grade assertion, from `binding/disable/options`. */
+    response?: AuthenticationResponseJSON;
+    /** The account password, for a browser with no passkey to hand. */
+    currentPassword?: string;
+}
+/** What binding is on this account, and when this session's key runs out. */
+declare function getSessionBindingService(params: SessionBindingParams): Promise<SessionBindingResult>;
+/**
+ * The binding facts of one key, by key id alone.
+ *
+ * For `/_auth/oauth/finalize`, which is the one sealing path with no session and
+ * no `LoginResult` to read them off: the browser arrives at the callback page
+ * holding a key id the OAuth state minted, and the interceptor seals a session
+ * from the answer. Reflecting the caller's own claim about binding would let a
+ * caller ask for an unbound cookie over a bound key, so the row is read instead.
+ *
+ * Scoped by key id and nothing else. The id is a server-minted UUID that only
+ * ever travelled inside the sealed state, so a caller who holds one holds it
+ * because the flow gave it to them; adding the caller's own `userId` to the
+ * lookup would make the answer vary by a second guessable value without
+ * withholding anything from someone who already has the first.
+ */
+declare function keySessionBindingService(keyId: string): Promise<{
+    sessionBinding?: SessionBindingType;
+    keyExpiresAtMillis?: number;
+}>;
+/**
+ * Turn session binding on, and bind the key this request is signed with.
+ *
+ * The current key is bound here rather than only at the next sign-in, because
+ * otherwise the setting would not apply to the session that asked for it until
+ * the person signed in again — and the response is what tells the Next.js proxy
+ * to re-seal the cookie with the new expiry, so the browser and the key row
+ * agree from this moment on.
+ *
+ * @throws SessionBindingUnavailableError proxy-guard가 설정되지 않은 배포일 때
+ * @throws ValidationError 살아 있는 패스키가 하나도 없을 때
+ * @throws RecentAuthenticationRequiredError 최근 인증이 없을 때
+ */
+declare function enableSessionBindingService(params: SessionBindingParams): Promise<SessionBindingResult>;
+/**
+ * Turn session binding off, once the caller has proved they are still the owner.
+ *
+ * Every bound key returns to an ordinary ninety-day life in the same call. A row
+ * left marked `'passkey'` would keep expiring in hours with nothing left to
+ * renew it, which is the state the person just asked not to be in.
+ *
+ * @throws RecentAuthenticationRequiredError 새 자격증명 없이 껐을 때
+ */
+declare function disableSessionBindingService(params: DisableSessionBindingParams): Promise<SessionBindingResult>;
+/** The challenge the disabling ceremony signs. Same ceremony renewal uses. */
+declare function startSessionBindingDisableService(userId: number): Promise<PublicKeyCredentialRequestOptionsJSON>;
+
+/**
+ * @spfn/auth - Session Renewal Service
+ *
+ * What a bound session does when its key runs out: prove, with a fresh WebAuthn
+ * assertion, that the person who enrolled the passkey is still at the machine,
+ * and get a new short-lived key sealed into the cookie.
+ *
+ * Neither step is public. The expiring key is named by `expiredKeyId`, and that
+ * value reaches the service from `authenticateForRenewal` — the `keyId` of a
+ * bearer JWT this very key signed — rather than from the request body, so a
+ * caller who does not hold the private half cannot name a key at all. The
+ * assertion still has to be signed by a passkey that key's owner enrolled: the
+ * signature proves the cookie, and the cookie is the thing that may have been
+ * copied.
+ *
+ * The admission below is run again here all the same. The middleware and the
+ * service ask the same four questions of the row, and a service that trusted its
+ * caller to have asked them would be one refactor away from not being asked at
+ * all.
+ *
+ * Every refusal is the same refusal. A key that never existed, a stranger's key,
+ * an unbound key, a revoked one, one past its grace, an inactive account, a spent
+ * challenge, an assertion that did not verify — all `SessionRenewalRefusedError`,
+ * with the same body, because anything finer would answer "is this key id live"
+ * to whoever asked.
+ *
+ * Renewal announces nothing. No `auth.login`, no `auth.device.registered`, and
+ * `lastLoginAt` does not move: this is the same person on the same device
+ * continuing the session they already had, and a subscriber mailing "new sign-in"
+ * once a day per device would train its reader to ignore the notice that matters.
+ * A `lastLoginAt` that moved every day would make dormant-account detection
+ * meaningless for exactly the accounts that turned this protection on.
+ */
+
+interface StartSessionRenewParams {
+    /** The key that ran out, read off the JWT the request was signed with. */
+    expiredKeyId: string;
+}
+interface FinishSessionRenewParams extends StartSessionRenewParams {
+    /** The assertion, from `navigator.credentials.get()`. */
+    response: AuthenticationResponseJSON;
+    /**
+     * The new key pair, in the vocabulary the Next.js login interceptor already
+     * writes: `renew/verify` is on that interceptor's path list, so these arrive
+     * exactly as they do on a login.
+     */
+    keyId: string;
+    publicKey: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+}
+/**
+ * What a completed renewal answers: a sign-in result, plus the new key's id.
+ *
+ * The id is the one thing a renewal has that a sign-in does not need to say —
+ * `renewSession()` promises it to the app, which has no other way to learn it
+ * (the key pair is minted in the proxy and the private half never leaves the
+ * cookie). It is not a contract operation, so nothing generated reads it.
+ */
+interface SessionRenewResult extends LoginResult {
+    /** The key this renewal registered, the one the session now signs with. */
+    keyId: string;
+}
+/**
+ * Step 1 — the challenge the authenticator signs.
+ *
+ * `allowCredentials` is empty and the account lives only on the challenge row.
+ * See `startRenewalCeremonyService`.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없는 키·계정일 때 (모든 사유 동일)
+ */
+declare function startSessionRenewService(params: StartSessionRenewParams): Promise<PublicKeyCredentialRequestOptionsJSON>;
+/**
+ * Step 2 — verify the assertion, put a new bound key in place of the old one.
+ *
+ * The revocation runs first and its answer is the race winner: two verifies that
+ * both got past their own challenges meet at the same conditional UPDATE, and
+ * only the one that actually revoked the key goes on to register a replacement.
+ *
+ * The new key inherits the old row's provenance, so the device list keeps saying
+ * where this device first appeared rather than re-stamping itself every day. Its
+ * expiry is a fresh window from now — renewal is a renewal, not an extension of
+ * what the old key had.
+ *
+ * @throws SessionRenewalRefusedError 갱신할 수 없을 때 (증명 실패 포함, 모든 사유 동일)
+ */
+declare function finishSessionRenewService(params: FinishSessionRenewParams): Promise<SessionRenewResult>;
+
+/**
+ * What `POST /_auth/oauth/finalize` answers with, in both of its branches.
+ *
+ * One type with a required discriminant rather than a union, on the same
+ * reasoning as `LoginResult` (#95): `authApi.oauthFinalize` infers its result
+ * from this, and a union would make every `result.userId` in every callback page
+ * stop compiling. `mfaRequired` false is the 200 and carries `userId`/`keyId`;
+ * true is the 202 and carries `challenge`.
+ */
+interface OAuthFinalizeResponse {
+    success: boolean;
+    mfaRequired: boolean;
+    /** The second-factor challenge, echoed back. Present exactly on the 202. */
+    challenge?: string;
+    userId?: string;
+    keyId?: string;
+    returnUrl: string;
+    sessionBinding?: SessionBindingType;
+    keyExpiresAtMillis?: number;
+}
+
 /**
  * @spfn/auth - Main Router
  *
@@ -2522,7 +3310,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
-    }, RegisterResult>;
+    }, LoginResult>;
     login: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -2560,7 +3348,10 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     } | {
         email?: string | undefined;
         phone?: string | undefined;
+        sessionBinding?: "none" | "passkey" | undefined;
+        keyExpiresAtMillis?: number | undefined;
         status: "approved";
+        mfaRequired: boolean;
         userId: string;
         publicId: string;
         passwordChangeRequired: boolean;
@@ -2664,6 +3455,19 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     mfaStepUpOptions: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{}>;
     }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    mfaVerify: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            challenge: _sinclair_typebox.TString;
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            recoveryCode: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            response: _sinclair_typebox.TOptional<_sinclair_typebox.TUnknown>;
+        }>;
+    }, {}, VerifyMfaChallengeResult>;
+    mfaVerifyOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            challenge: _sinclair_typebox.TString;
+        }>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
     logout: _spfn_core_route.RouteDef<{}, {}, void>;
     rotateKey: _spfn_core_route.RouteDef<{}, {
         body: _sinclair_typebox.TObject<{
@@ -2736,6 +3540,32 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         phoneVerified: boolean;
         hasPassword: boolean;
     }>;
+    setSessionBinding: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            mode: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"none">]>;
+            response: _sinclair_typebox.TOptional<_sinclair_typebox.TUnknown>;
+            currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, SessionBindingResult>;
+    getSessionBinding: _spfn_core_route.RouteDef<{}, {}, SessionBindingResult>;
+    sessionBindingDisableOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewVerify: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            response: _sinclair_typebox.TUnknown;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>>;
+        }>;
+    }, SessionRenewResult>;
     issueOneTimeToken: _spfn_core_route.RouteDef<{}, {}, IssueOneTimeTokenResult>;
     requestAccountDeletion: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
@@ -2793,396 +3623,804 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }>;
     oauthFinalize: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            userId: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
+            userId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            keyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            mfaChallenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, OAuthFinalizeResponse>;
+    oauthProviderStart: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            state: _sinclair_typebox.TString;
+        }>;
+    }, {}, Response>;
+    oauthProviderCallback: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        query: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, Response>;
+    getProviderOAuthUrl: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
             returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        authUrl: string;
+    }>;
+    oauthNative: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+        body: _sinclair_typebox.TObject<{
+            idToken: _sinclair_typebox.TString;
+            nonce: _sinclair_typebox.TString;
+            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+            profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
+                name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            }>>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+        }>;
+    }, {}, OAuthNativeResult>;
+    oauthUnlinkNotify: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
+    oauthUnlinkNotifyGet: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+        }>;
+    }, {}, void | Response>;
+    getInvitation: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        email: string;
+        role: string;
+        roleDisplayName: string;
+        invitedBy: string;
+        expiresAt: string;
+        metadata: Record<string, any> | undefined;
+    }>;
+    acceptInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+            password: _sinclair_typebox.TString;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+        }>;
+    }, {
+        userId: number;
+        email: string;
+        role: string;
+    }>;
+    createInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            email: _sinclair_typebox.TString;
+            roleId: _sinclair_typebox.TNumber;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            expiresAt: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TAny>;
+        }>;
+    }, {}, {
+        id: number;
+        email: string;
+        token: string;
+        roleId: number;
+        expiresAt: string;
+        invitationUrl: string;
+    }>;
+    listInvitations: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            status: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"pending" | "accepted" | "expired" | "cancelled">[]>>;
+            page: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            limit: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        }>;
+    }, {}, {
+        invitations: {
+            id: number;
+            email: string;
+            token: string;
+            roleId: number;
+            invitedBy: number;
+            status: "pending" | "accepted" | "expired" | "cancelled";
+            expiresAt: Date;
+            acceptedAt: Date | null;
+            cancelledAt: Date | null;
+            metadata: Record<string, any> | null;
+            createdAt: Date;
+            updatedAt: Date;
+            role: {
+                id: number;
+                name: string;
+                displayName: string;
+            };
+            inviter: {
+                id: number;
+                email: string | null;
+            };
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+        totalPages: number;
+    }>;
+    cancelInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+            reason: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        cancelledAt: string;
+    }>;
+    resendInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        }>;
+    }, {}, {
+        expiresAt: string;
+    }>;
+    deleteInvitation: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+        }>;
+    }, {}, void>;
+    getUserProfile: _spfn_core_route.RouteDef<{}, {}, UserProfile>;
+    updateUserProfile: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            firstName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            lastName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            avatarUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            bio: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            locale: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            timezone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            dateOfBirth: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            gender: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            website: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            location: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            company: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            jobTitle: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TAny>>;
+        }>;
+    }, {}, ProfileInfo>;
+    checkUsername: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            username: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        available: boolean;
+    }>;
+    updateUsername: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            username: _sinclair_typebox.TUnion<[_sinclair_typebox.TString, _sinclair_typebox.TNull]>;
+        }>;
+    }, {}, {
+        deletedAt: Date | null;
+        deletedBy: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+        id: number;
+        publicId: string;
+        email: string | null;
+        phone: string | null;
+        username: string | null;
+        passwordHash: string | null;
+        passwordChangeRequired: boolean;
+        roleId: number;
+        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
+        emailVerifiedAt: Date | null;
+        phoneVerifiedAt: Date | null;
+        keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
+        lastLoginAt: Date | null;
+    }>;
+    updateLocale: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            locale: _sinclair_typebox.TString;
+        }>;
+    }, {}, {
+        locale: string;
+    }>;
+    listRoles: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            includeInactive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        }>;
+    }, {}, {
+        roles: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        }[];
+    }>;
+    createAdminRole: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            name: _sinclair_typebox.TString;
+            displayName: _sinclair_typebox.TString;
+            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            permissionIds: _sinclair_typebox.TOptional<_sinclair_typebox.TArray<_sinclair_typebox.TNumber>>;
         }>;
     }, {}, {
-        success: boolean;
-        userId: string;
-        keyId: string;
-        returnUrl: string;
+        role: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        };
     }>;
-    oauthProviderStart: _spfn_core_route.RouteDef<{
+    updateAdminRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            id: _sinclair_typebox.TNumber;
         }>;
-        query: _sinclair_typebox.TObject<{
-            state: _sinclair_typebox.TString;
+        body: _sinclair_typebox.TObject<{
+            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+            isActive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
         }>;
-    }, {}, Response>;
-    oauthProviderCallback: _spfn_core_route.RouteDef<{
+    }, {}, {
+        role: {
+            description: string | null;
+            name: string;
+            id: number;
+            displayName: string;
+            isBuiltin: boolean;
+            isSystem: boolean;
+            isActive: boolean;
+            priority: number;
+            createdAt: Date;
+            updatedAt: Date;
+        };
+    }>;
+    deleteAdminRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
-        }>;
-        query: _sinclair_typebox.TObject<{
-            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            id: _sinclair_typebox.TNumber;
         }>;
-    }, {}, Response>;
-    getProviderOAuthUrl: _spfn_core_route.RouteDef<{
+    }, {}, void>;
+    updateUserRole: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            userId: _sinclair_typebox.TNumber;
         }>;
         body: _sinclair_typebox.TObject<{
-            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            roleId: _sinclair_typebox.TNumber;
         }>;
     }, {}, {
-        authUrl: string;
+        userId: number;
+        roleId: number;
     }>;
-    oauthNative: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
-        }>;
+    issueOpsToken: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            idToken: _sinclair_typebox.TString;
-            nonce: _sinclair_typebox.TString;
-            accessToken: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            publicKey: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            fingerprint: _sinclair_typebox.TString;
-            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
-            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
-            profile: _sinclair_typebox.TOptional<_sinclair_typebox.TObject<{
-                name: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            }>>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
-        }>;
-    }, {}, OAuthNativeResult>;
-    oauthUnlinkNotify: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
-        }>;
-    }, {}, void | Response>;
-    oauthUnlinkNotifyGet: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "apple" | "github" | "kakao" | "naver" | "superself">[]>;
+            name: _sinclair_typebox.TString;
+            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
         }>;
-    }, {}, void | Response>;
-    getInvitation: _spfn_core_route.RouteDef<{
+    }, {}, {
+        token: string;
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
+    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
+        opsTokens: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        }[];
+    }>;
+    revokeOpsToken: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
-            token: _sinclair_typebox.TString;
+            id: _sinclair_typebox.TNumber;
         }>;
     }, {}, {
-        email: string;
-        role: string;
-        roleDisplayName: string;
-        invitedBy: string;
-        expiresAt: string;
-        metadata: Record<string, any> | undefined;
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
     }>;
-    acceptInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            token: _sinclair_typebox.TString;
-            password: _sinclair_typebox.TString;
+    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
+    getOAuth2Authorize: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
-    }, {
+    }, {}, OAuth2ConsentView>;
+    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
-            publicKey: _sinclair_typebox.TString;
-            keyId: _sinclair_typebox.TString;
-            fingerprint: _sinclair_typebox.TString;
-            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            approve: _sinclair_typebox.TBoolean;
+            client_id: _sinclair_typebox.TString;
+            redirect_uri: _sinclair_typebox.TString;
+            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
-    }, {
-        userId: number;
-        email: string;
-        role: string;
+    }, {}, OAuth2AuthorizationCodeIssued>;
+    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
+    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
+    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
+        grants: OAuth2GrantSummary[];
     }>;
-    createInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            email: _sinclair_typebox.TString;
-            roleId: _sinclair_typebox.TNumber;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            expiresAt: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TAny>;
+    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
         }>;
     }, {}, {
-        id: number;
-        email: string;
-        token: string;
-        roleId: number;
-        expiresAt: string;
-        invitationUrl: string;
+        revoked: boolean;
     }>;
-    listInvitations: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            status: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"pending" | "accepted" | "expired" | "cancelled">[]>>;
-            page: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            limit: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
+}>;
+
+/**
+ * @spfn/auth - User Public Keys Entity
+ *
+ * Stores client-generated public keys for JWT verification
+ * Supports key rotation and multi-key management per user
+ */
+/**
+ * User Public Keys Table
+ * Each user can have multiple public keys (for rotation)
+ */
+declare const userPublicKeys: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "user_public_keys";
+    schema: string;
+    columns: {
+        id: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetIsPrimaryKey<drizzle_orm_pg_core.PgBigSerial53Builder>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        userId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBigInt53Builder>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        keyId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        publicKey: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        invitations: {
-            id: number;
-            email: string;
-            token: string;
-            roleId: number;
-            invitedBy: number;
-            status: "pending" | "accepted" | "expired" | "cancelled";
-            expiresAt: Date;
-            acceptedAt: Date | null;
-            cancelledAt: Date | null;
-            metadata: Record<string, any> | null;
-            createdAt: Date;
-            updatedAt: Date;
-            role: {
-                id: number;
-                name: string;
-                displayName: string;
-            };
-            inviter: {
-                id: number;
-                email: string | null;
-            };
-        }[];
-        total: number;
-        page: number;
-        limit: number;
-        totalPages: number;
-    }>;
-    cancelInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
-            reason: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        algorithm: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["ES256", "RS256"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ES256" | "RS256";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ES256", "RS256"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        cancelledAt: string;
-    }>;
-    resendInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
+        fingerprint: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        expiresAt: string;
-    }>;
-    deleteInvitation: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+        deviceName: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, void>;
-    getUserProfile: _spfn_core_route.RouteDef<{}, {}, UserProfile>;
-    updateUserProfile: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            firstName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            lastName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            avatarUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            bio: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            locale: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            timezone: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            dateOfBirth: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            gender: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            website: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            location: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            company: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            jobTitle: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TAny>>;
+        platform: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["ios", "android", "web", "desktop"] & [string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ios" | "android" | "web" | "desktop";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ios", "android", "web", "desktop"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, ProfileInfo>;
-    checkUsername: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            username: _sinclair_typebox.TString;
+        registeredIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        available: boolean;
-    }>;
-    updateUsername: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            username: _sinclair_typebox.TUnion<[_sinclair_typebox.TString, _sinclair_typebox.TNull]>;
+        registeredUserAgent: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        deletedAt: Date | null;
-        deletedBy: string | null;
-        createdAt: Date;
-        updatedAt: Date;
-        id: number;
-        publicId: string;
-        email: string | null;
-        phone: string | null;
-        username: string | null;
-        passwordHash: string | null;
-        passwordChangeRequired: boolean;
-        roleId: number;
-        status: "active" | "inactive" | "suspended" | "pending_deletion" | "deleted";
-        emailVerifiedAt: Date | null;
-        phoneVerifiedAt: Date | null;
-        keyEpoch: number;
-        lastLoginAt: Date | null;
-    }>;
-    updateLocale: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            locale: _sinclair_typebox.TString;
+        registeredUaFamily: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        locale: string;
-    }>;
-    listRoles: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            includeInactive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        lastSeenIp: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        roles: {
-            description: string | null;
+        lastSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        }[];
-    }>;
-    createAdminRole: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            name: _sinclair_typebox.TString;
-            displayName: _sinclair_typebox.TString;
-            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            permissionIds: _sinclair_typebox.TOptional<_sinclair_typebox.TArray<_sinclair_typebox.TNumber>>;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        role: {
-            description: string | null;
+        concurrentUseAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        binding: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTextBuilder<["none", "passkey"] & [string, ...string[]]>>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "none" | "passkey";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "passkey"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
+        }>;
+        clientKind: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<["web", "ios", "android"] & [string, ...string[]]>, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        };
-    }>;
-    updateAdminRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "string enum";
+            data: "ios" | "android" | "web";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["web", "ios", "android"] & [string, ...string[]];
+            identity: undefined;
+            generated: undefined;
         }>;
-        body: _sinclair_typebox.TObject<{
-            displayName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            priority: _sinclair_typebox.TOptional<_sinclair_typebox.TNumber>;
-            isActive: _sinclair_typebox.TOptional<_sinclair_typebox.TBoolean>;
+        clientVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        role: {
-            description: string | null;
+        clientContractVersion: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
             name: string;
-            id: number;
-            displayName: string;
-            isBuiltin: boolean;
-            isSystem: boolean;
-            isActive: boolean;
-            priority: number;
-            createdAt: Date;
-            updatedAt: Date;
-        };
-    }>;
-    deleteAdminRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, void>;
-    updateUserRole: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            userId: _sinclair_typebox.TNumber;
+        clientSeenAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-        body: _sinclair_typebox.TObject<{
-            roleId: _sinclair_typebox.TNumber;
+        isActive: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgBooleanBuilder>>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        userId: number;
-        roleId: number;
-    }>;
-    issueOpsToken: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            name: _sinclair_typebox.TString;
-            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
-            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
+        pendingMfaChallengeId: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgBigInt53Builder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "number int53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        token: string;
-        opsToken: {
-            id: number;
+        createdAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.SetHasDefault<drizzle_orm_pg_core.SetNotNull<drizzle_orm_pg_core.PgTimestampBuilder>>, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        };
-    }>;
-    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
-        opsTokens: {
-            id: number;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
+        lastUsedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        }[];
-    }>;
-    revokeOpsToken: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        opsToken: {
-            id: number;
+        expiresAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
             name: string;
-            scopes: string[];
-            expiresAt: string | null;
-            revokedAt: string | null;
-            lastUsedAt: string | null;
-            createdAt: string | null;
-        };
-    }>;
-    registerOAuth2Client: _spfn_core_route.RouteDef<{}, {}, Response>;
-    getOAuth2Authorize: _spfn_core_route.RouteDef<{
-        query: _sinclair_typebox.TObject<{
-            client_id: _sinclair_typebox.TString;
-            redirect_uri: _sinclair_typebox.TString;
-            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, OAuth2ConsentView>;
-    createOAuth2AuthorizationCode: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{
-            approve: _sinclair_typebox.TBoolean;
-            client_id: _sinclair_typebox.TString;
-            redirect_uri: _sinclair_typebox.TString;
-            code_challenge: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            code_challenge_method: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            resource: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            scope: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
-            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        revokedAt: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTimestampBuilder, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "object date";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, OAuth2AuthorizationCodeIssued>;
-    oauth2Token: _spfn_core_route.RouteDef<{}, {}, Response>;
-    oauth2Revoke: _spfn_core_route.RouteDef<{}, {}, Response>;
-    listOAuth2Grants: _spfn_core_route.RouteDef<{}, {}, {
-        grants: OAuth2GrantSummary[];
-    }>;
-    revokeOAuth2Grant: _spfn_core_route.RouteDef<{
-        params: _sinclair_typebox.TObject<{
-            id: _sinclair_typebox.TNumber;
+        revokedReason: drizzle_orm_pg_core.PgBuildColumn<"user_public_keys", drizzle_orm_pg_core.PgTextBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "user_public_keys";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
         }>;
-    }, {}, {
-        revoked: boolean;
-    }>;
-    oauth2AuthorizationServerMetadata: _spfn_core_route.RouteDef<{}, {}, Response>;
+    };
+    dialect: "pg";
 }>;
+type UserPublicKey = typeof userPublicKeys.$inferSelect;
+type NewUserPublicKey = typeof userPublicKeys.$inferInsert;
 
 /**
  * The auth-profile registry the authenticate middleware dispatches on.
@@ -3323,6 +4561,46 @@ declare module 'hono' {
         auth: AuthContext;
     }
 }
+/** Why a Bearer credential was not admitted, in the order the steps run. */
+type BearerRefusal = 'absent' | 'machine' | 'undecodable' | 'unknown' | 'expired' | 'token-expired' | 'bad-signature' | 'unverifiable';
+/** What a Bearer credential resolved to: the key row it named, or why not. */
+type BearerOutcome = {
+    key: UserPublicKey;
+} | {
+    refused: BearerRefusal;
+};
+/**
+ * Admit the Bearer credential on this request, or say what stopped it.
+ *
+ * The one lookup-and-verify path every Bearer middleware takes — header, machine
+ * discriminator, decode, key row, expiry, signature — kept in one place because
+ * the order is itself a rule: a machine credential never reaches a decode, and a
+ * key row is found before its signature is checked so that an unknown key and a
+ * forged one cost the same work.
+ *
+ * It answers rather than throws, which is what lets two middlewares share it.
+ * `authenticate` turns each refusal into the error that step has always
+ * answered with; `authenticateForRenewal` turns every one of them into a single
+ * refusal, so a caller holding no private key cannot tell a live key id from a
+ * dead one. A shared step that threw would have to be unwound to get there.
+ *
+ * @param c - the Hono context of the request being authenticated
+ * @param admitsExpired - whether a key past its `expiresAt` may still be
+ *   admitted. Renewal is the only caller that says yes, and only for a bound key
+ *   inside its grace.
+ */
+declare function admitBearerKey(c: Context, admitsExpired: (key: UserPublicKey) => boolean): Promise<BearerOutcome>;
+/**
+ * The principal a verified Bearer key resolves to.
+ *
+ * The one place the Bearer path builds an `AuthContext`, so that a middleware
+ * added beside `authenticate` cannot invent a second shape of it.
+ */
+declare function bearerAuthContext(keyId: string, resolved: {
+    user: User;
+    role: string | null;
+    locale: string;
+}): AuthContext;
 /**
  * Authentication middleware
  *
@@ -3476,4 +4754,4 @@ declare const machineAuth: _spfn_core_route.NamedMiddleware<"machineAuth">;
  */
 declare const requireMachineScope: _spfn_core_route.NamedMiddlewareFactory<"machineScope", string[]>;
 
-export { type AuthRegisterPayload as $, type AuthInitOptions as A, type ApproveDeviceAuthParams as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type AssertStepUpParams as E, type FinishPasskeyEnrollmentResult as F, type AuthDeletionCancelledPayload as G, type AuthDeletionCompletedPayload as H, type IssueOneTimeTokenResult as I, type AuthDeletionRequestedPayload as J, type KeySummary as K, type LoginResult as L, type MfaStatus as M, type NewPasskey as N, type OAuthStartResult as O, type PermissionConfig as P, type AuthDeviceRegisteredPayload as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type AuthLoginPayload as W, type AuthPasswordResetPayload as X, type AuthProfileOutcome as Y, type AuthProfileVerifier as Z, AuthProviderSchema as _, type RegisterResult as a, type UnlinkNotification as a$, type ChangePasswordParams as a0, type CompletePasswordResetParams as a1, type CompleteSignupParams as a2, type ConfirmPasswordResetParams as a3, type ConfirmSignupLinkParams as a4, type ConfirmTotpParams as a5, type DenyDeviceAuthParams as a6, type DeviceAuthApprovedResult as a7, type DeviceAuthInfoParams as a8, type DeviceAuthPendingResult as a9, type OAuthStartParams as aA, type OAuthTokens as aB, type OAuthUnlinkedPayload as aC, PASSKEY_DEVICE_TYPES as aD, PASSKEY_LABEL_MAX_LENGTH as aE, type PasskeyDeviceType as aF, PasswordSchema as aG, PhoneSchema as aH, PlatformSchema as aI, type PollDeviceAuthParams as aJ, type PollDeviceAuthResult as aK, PublicKeySchema as aL, type RecentAuthenticationParams as aM, type RegisterParams as aN, type RegisterPublicKeyParams as aO, type RenamePasskeyParams as aP, type RequestPasswordResetParams as aQ, type RequestSignupLinkParams as aR, type RevokeAllKeysParams as aS, type RevokeKeyParams as aT, type RevokePasskeyParams as aU, type RotateKeyParams as aV, type SendVerificationCodeParams as aW, type StartDeviceAuthParams as aX, type StartPasskeyEnrollmentParams as aY, type StepUpParams as aZ, TargetTypeSchema as a_, DeviceAuthPollResponseSchema as aa, DeviceNameSchema as ab, type DeviceRegistrationChannel as ac, EmailSchema as ad, FingerprintSchema as ae, type FinishPasskeyEnrollmentParams as af, type FinishPasskeyLoginParams as ag, type InvitationAcceptedPayload as ah, type InvitationCreatedPayload as ai, KEY_FINGERPRINT_PREFIX_LENGTH as aj, KeyIdSchema as ak, type LoginParams as al, type LogoutParams as am, MFA_VERIFICATION_METHODS as an, type MachinePrincipal as ao, type MachineVerifierRegistration as ap, type MarkPasskeyParams as aq, type NativeVerifyOptions as ar, type NewMfaVerification as as, type NormalizedIdentity as at, type OAuth2AuthorizeParams as au, type OAuth2ScopeDescription as av, type OAuthCallbackParams as aw, type OAuthCallbackResult as ax, type OAuthCodeExchangeOptions as ay, type OAuthNativeParams as az, type RequestSignupLinkResult as b, registerAuthProfile as b$, UnlinkNotifyRejection as b0, type UnlinkNotifyRequest as b1, type UnlinkNotifyResult as b2, UserCodeSchema as b3, VerificationPurposeSchema as b4, type VerifyCodeParams as b5, type VerifyCodeResult as b6, approveDeviceAuthService as b7, approveOAuth2AuthorizeService as b8, assertNotLastRecoveryCredential as b9, getGoogleAccessToken as bA, getMachinePrincipal as bB, getOAuthProvider as bC, getRegisteredProviders as bD, invitationAcceptedEvent as bE, invitationCreatedEvent as bF, isOAuthProviderEnabled as bG, issueOneTimeTokenService as bH, listKeysService as bI, listOAuth2GrantsService as bJ, listPasskeysService as bK, loginService as bL, logoutService as bM, machineAuth as bN, markPasskeySecondFactorService as bO, mfaEnrolledForUser as bP, mfaStatusService as bQ, mfaVerifications as bR, oauthCallbackService as bS, oauthNativeService as bT, oauthStartService as bU, oauthUnlinkNotifyService as bV, oauthUnlinkedEvent as bW, optionalAuth as bX, passkeys as bY, pollDeviceAuthService as bZ, regenerateRecoveryCodesService as b_, assertRecentAuthentication as ba, assertStepUp as bb, authDeletionCancelledEvent as bc, authDeletionCompletedEvent as bd, authDeletionRequestedEvent as be, authDeviceRegisteredEvent as bf, authLoginEvent as bg, authPasswordResetEvent as bh, authRegisterEvent as bi, authenticate as bj, buildOAuthErrorUrl as bk, carryStepUpVerification as bl, changePasswordService as bm, completePasswordResetService as bn, completeSignupService as bo, confirmPasswordResetService as bp, confirmSignupLinkService as bq, confirmTotpEnrolmentService as br, denyDeviceAuthService as bs, denyOAuth2AuthorizeService as bt, describeOAuth2AuthorizeRequestService as bu, disableMfaService as bv, finishPasskeyEnrollmentService as bw, finishPasskeyLoginService as bx, getDeviceAuthInfoService as by, getEnabledOAuthProviders as bz, type RequestPasswordResetResult as c, registerMachineVerifier as c0, registerOAuthProvider as c1, registerPublicKeyService as c2, registerService as c3, renamePasskeyService as c4, requestPasswordResetService as c5, requestSignupLinkService as c6, requireEnabledProvider as c7, requireMachineScope as c8, resolveAuthenticatedUser as c9, revokeAllKeysService as ca, revokeAllOAuth2GrantsForUser as cb, revokeKeyService as cc, revokeOAuth2GrantService as cd, revokePasskeyService as ce, rotateKeyService as cf, runAuthProfile as cg, selectAuthProfile as ch, sendVerificationCodeService as ci, startDeviceAuthService as cj, startPasskeyEnrollmentService as ck, startPasskeyLoginService as cl, startStepUpService as cm, startTotpEnrolmentService as cn, stepUpService as co, sweepUnconfirmedMfaService as cp, verifyCodeService as cq, verifyOneTimeTokenService as cr, verifySecondFactor as cs, type ConfirmPasswordResetResult as d, type StartDeviceAuthResult as e, type PasskeySummary as f, type ConfirmTotpResult as g, type RotateKeyResult as h, type RevokeAllKeysResult as i, type OAuthNativeResult as j, type ProfileInfo as k, type OAuth2ConsentView as l, mainAuthRouter as m, type OAuth2AuthorizationCodeIssued as n, type OAuth2GrantSummary as o, type AuthSession as p, PERMISSION_CATEGORIES as q, type PermissionCategory as r, VERIFICATION_TARGET_TYPES as s, type VerificationPurpose as t, type VerificationTargetType as u, type OAuthProvider as v, type Passkey as w, type MfaVerification as x, type MfaVerificationMethod as y, type AuthContext as z };
+export { type AuthDeletionCompletedPayload as $, type AuthInitOptions as A, type NewPasskey as B, type ConfirmSignupLinkResult as C, type DeviceAuthInfoResult as D, type Passkey as E, type FinishPasskeyEnrollmentResult as F, type MfaVerification as G, type MfaVerificationMethod as H, type IssueOneTimeTokenResult as I, type NewMfaChallenge as J, type KeySummary as K, type LoginResult as L, type MfaStatus as M, type NewUserPublicKey as N, type OAuthStartResult as O, type PermissionConfig as P, type MfaChallenge as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type TotpEnrolmentResult as T, type UserProfile as U, type VerifyMfaChallengeResult as V, type UserPublicKey as W, type AuthContext as X, type ApproveDeviceAuthParams as Y, type AssertStepUpParams as Z, type AuthDeletionCancelledPayload as _, type RegisterResult as a, type PollDeviceAuthParams as a$, type AuthDeletionRequestedPayload as a0, type AuthDeviceRegisteredPayload as a1, type AuthLoginPayload as a2, type AuthPasswordResetPayload as a3, type AuthProfileOutcome as a4, type AuthProfileVerifier as a5, AuthProviderSchema as a6, type AuthRegisterPayload as a7, type BearerOutcome as a8, type BearerRefusal as a9, MFA_CHALLENGE_ATTEMPT_LIMIT as aA, MFA_CHALLENGE_CHANNELS as aB, MFA_VERIFICATION_METHODS as aC, type MachinePrincipal as aD, type MachineVerifierRegistration as aE, type MarkPasskeyParams as aF, type MfaChallengeChannel as aG, type MfaChallengeHandle as aH, type NativeVerifyOptions as aI, type NewMfaVerification as aJ, type NormalizedIdentity as aK, type OAuth2AuthorizeParams as aL, type OAuth2ScopeDescription as aM, type OAuthCallbackParams as aN, type OAuthCallbackResult as aO, type OAuthCodeExchangeOptions as aP, type OAuthNativeParams as aQ, type OAuthStartParams as aR, type OAuthTokens as aS, type OAuthUnlinkedPayload as aT, type OpenStepUpChallengeParams as aU, PASSKEY_DEVICE_TYPES as aV, PASSKEY_LABEL_MAX_LENGTH as aW, type PasskeyDeviceType as aX, PasswordSchema as aY, PhoneSchema as aZ, PlatformSchema as a_, type ChangePasswordParams as aa, type CompletePasswordResetParams as ab, type CompleteSignupParams as ac, type ConfirmPasswordResetParams as ad, type ConfirmSignupLinkParams as ae, type ConfirmTotpParams as af, type DeferredLoginEvent as ag, type DenyDeviceAuthParams as ah, type DeviceAuthApprovedResult as ai, type DeviceAuthInfoParams as aj, type DeviceAuthPendingResult as ak, DeviceAuthPollResponseSchema as al, DeviceNameSchema as am, type DeviceRegistrationChannel as an, type DisableSessionBindingParams as ao, EmailSchema as ap, FingerprintSchema as aq, type FinishPasskeyEnrollmentParams as ar, type FinishPasskeyLoginParams as as, type FinishSessionRenewParams as at, type InvitationAcceptedPayload as au, type InvitationCreatedPayload as av, KEY_FINGERPRINT_PREFIX_LENGTH as aw, KeyIdSchema as ax, type LoginParams as ay, type LogoutParams as az, type RequestSignupLinkResult as b, getEnabledOAuthProviders as b$, type PollDeviceAuthResult as b0, PublicKeySchema as b1, type RecentAuthenticationParams as b2, type RegisterParams as b3, type RegisterPublicKeyParams as b4, type RegisterPublicKeyResult as b5, type RenamePasskeyParams as b6, type RequestPasswordResetParams as b7, type RequestSignupLinkParams as b8, type RevokeAllKeysParams as b9, authDeletionCancelledEvent as bA, authDeletionCompletedEvent as bB, authDeletionRequestedEvent as bC, authDeviceRegisteredEvent as bD, authLoginEvent as bE, authPasswordResetEvent as bF, authRegisterEvent as bG, authenticate as bH, bearerAuthContext as bI, buildOAuthErrorUrl as bJ, carryStepUpVerification as bK, changePasswordService as bL, completePasswordResetService as bM, completeSignupService as bN, confirmPasswordResetService as bO, confirmSignupLinkService as bP, confirmTotpEnrolmentService as bQ, denyDeviceAuthService as bR, denyOAuth2AuthorizeService as bS, describeOAuth2AuthorizeRequestService as bT, disableMfaService as bU, disableSessionBindingService as bV, enableSessionBindingService as bW, finishPasskeyEnrollmentService as bX, finishPasskeyLoginService as bY, finishSessionRenewService as bZ, getDeviceAuthInfoService as b_, type RevokeKeyParams as ba, type RevokePasskeyParams as bb, type RotateKeyParams as bc, type SendVerificationCodeParams as bd, type SessionBindingParams as be, type StartDeviceAuthParams as bf, type StartPasskeyEnrollmentParams as bg, type StartSessionRenewParams as bh, type StepUpParams as bi, TargetTypeSchema as bj, type UnlinkNotification as bk, UnlinkNotifyRejection as bl, type UnlinkNotifyRequest as bm, type UnlinkNotifyResult as bn, UserCodeSchema as bo, VerificationPurposeSchema as bp, type VerifyCodeParams as bq, type VerifyCodeResult as br, type VerifyMfaChallengeParams as bs, admitBearerKey as bt, approveDeviceAuthService as bu, approveOAuth2AuthorizeService as bv, assertNotLastRecoveryCredential as bw, assertRecentAuthentication as bx, assertStepUp as by, attemptSecondFactor as bz, type RequestPasswordResetResult as c, sweepUnconfirmedMfaService as c$, getGoogleAccessToken as c0, getMachinePrincipal as c1, getOAuthProvider as c2, getRegisteredProviders as c3, getSessionBindingService as c4, invitationAcceptedEvent as c5, invitationCreatedEvent as c6, isOAuthProviderEnabled as c7, issueOneTimeTokenService as c8, keySessionBindingService as c9, registeredBinding as cA, renamePasskeyService as cB, requestPasswordResetService as cC, requestSignupLinkService as cD, requireEnabledProvider as cE, requireMachineScope as cF, resolveAuthenticatedUser as cG, resumeStepUpChallengeService as cH, revokeAllKeysService as cI, revokeAllOAuth2GrantsForUser as cJ, revokeKeyService as cK, revokeOAuth2GrantService as cL, revokePasskeyService as cM, rotateKeyService as cN, runAuthProfile as cO, selectAuthProfile as cP, sendVerificationCodeService as cQ, startDeviceAuthService as cR, startMfaChallengeAssertionService as cS, startPasskeyEnrollmentService as cT, startPasskeyLoginService as cU, startSessionBindingDisableService as cV, startSessionRenewService as cW, startStepUpService as cX, startTotpEnrolmentService as cY, stepUpService as cZ, sweepMfaChallengesService as c_, listKeysService as ca, listOAuth2GrantsService as cb, listPasskeysService as cc, loginService as cd, logoutService as ce, machineAuth as cf, markPasskeySecondFactorService as cg, mfaChallenges as ch, mfaEnrolledForUser as ci, mfaStatusService as cj, mfaVerifications as ck, oauthCallbackService as cl, oauthNativeService as cm, oauthStartService as cn, oauthUnlinkNotifyService as co, oauthUnlinkedEvent as cp, openStepUpChallengeService as cq, optionalAuth as cr, passkeys as cs, pollDeviceAuthService as ct, regenerateRecoveryCodesService as cu, registerAuthProfile as cv, registerMachineVerifier as cw, registerOAuthProvider as cx, registerPublicKeyService as cy, registerService as cz, type ConfirmPasswordResetResult as d, userPublicKeys as d0, verifyCodeService as d1, verifyMfaChallengeService as d2, verifyOneTimeTokenService as d3, verifySecondFactor as d4, type StartDeviceAuthResult as e, type PasskeySummary as f, type ConfirmTotpResult as g, type RotateKeyResult as h, type RevokeAllKeysResult as i, type SessionBindingResult as j, type SessionRenewResult as k, type OAuthFinalizeResponse as l, mainAuthRouter as m, type OAuthNativeResult as n, type ProfileInfo as o, type OAuth2ConsentView as p, type OAuth2AuthorizationCodeIssued as q, type OAuth2GrantSummary as r, type AuthSession as s, PERMISSION_CATEGORIES as t, type PermissionCategory as u, VERIFICATION_PURPOSES as v, VERIFICATION_TARGET_TYPES as w, type VerificationPurpose as x, type VerificationTargetType as y, type OAuthProvider as z };